3 ms·

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address.

by dpwm 9y ago

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to register without obtaining a new email address. I wouldn't mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.

Pxtl 9y ago
Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.
nebulous1 9y ago
Why can't you claim the original accounts?
- dpwm 9y ago
  The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address. I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash. I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this. There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form. A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details. You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited. In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.

by dpwm 9y ago

Pxtl 9y ago

Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.

nebulous1 9y ago

Why can't you claim the original accounts?

dpwm 9y ago
The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address. I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash. I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this. There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form. A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details. You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited. In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.