5 ms·
Why doesn't Netflix require users to be logged in before they can change their card details? That seems like the biggest security flaw, not the Gmail dot alias.
by leoedin 9y ago
Why doesn't Netflix require users to be logged in before they can change their card details? That seems like the biggest security flaw, not the Gmail dot alias.
(I'm guessing they did A/B testing and found that having to log into your account lost them some percentage of people. If that's the case, Netflix are clearly putting their retention rate ahead of security)
There's probably a not insignificant number of people who are happily using a dotted variation of their gmail account. Putting a big warning above the email wouldn't make them very happy.
- deleted 9y ago[deleted]
- scott00 9y agoThey do. The author reset the password to gain access.
- evjim 9y agoBut then if the password is reset, the original scammer has no access to the account! And the scammer cannot reset the password because they do not have access to the email.
- anchpop 9y agoThis is true if changing the password s you to re-enter the password on every device (even those that were logged in at the time)
- shkkmo 9y agoChanging a password should always invalidate all existing sessions. If you aren't doing that, then you are doing it wrong. Edit: Or at least invalidate all sessions initiated using the old password if you have that tracked.
- will4274 9y ago> Changing a password should always invalidate all existing sessions Doesn't with Google. They display a prompt and let you select which sessions to expire.
- scott00 9y agoNetflix offers SMS password resets.
- stordoff 9y agoShould that not be a big enough red flag in most cases (I have to reset the password on this account -> maybe it isn't my account)?