3 ms·

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2

by jsnell 9y ago

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.) If any of them had shared my name, the effect would have been just the same as in your case despite there being no canonicalization issues. Likewise would you really have been suspicious about seeing the notification come in for e.g. jamesfisher+netflix@gmail.com? Who can remember exactly what services they used a +something for? No. This hole is totally on Netflix. It's a total shitshow, especially for a company that loves to brag so much about how they only hire the best technical people. No. Either they don't hire the best, or they let some kind of piece of growth hackers actually run the show.

jjeaff 9y ago
I feel like you are being a bit harsh. What is really the exposure in this case? I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway. And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.
- jsnell 9y ago
  All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack: - When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving. - In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account. - In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using. From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.

by jsnell 9y ago

jjeaff 9y ago

I feel like you are being a bit harsh. What is really the exposure in this case? I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway. And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.

jsnell 9y ago
All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack: - When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving. - In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account. - In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using. From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.