>This is Netflix's issue for not validating the email account. Eeeh, I just re-read RFC 2822. It explicitly states that the local-part of an address may contai

>This is Netflix's issue for not validating the email account. Eeeh, I just re-read RFC 2822. It explicitly states that the local-part of an address may contain any number of dots as long as they are separated by (if I'm reading this correctly) at least one character, and do not start with a dot. There's nothing in there that states you should treat dotted and undotted variants of an address as the same address. So, google isn't violating the specification, but they are extending it in an unexpected way. Google could extend it further by implementing a "giraffes don't matter" policy where any instances of the word "giraffe" are recursively snipped out, so that "test@example.com" is the same as "tegirgiraffeaffest@example.com", but if they did it would be a bit rich for them to expect the rest of the world to adapt code to that decision. It might be reasonable for google to expect others to handle this "dots dont matter" policy if it was some kind of defacto standard, but AFAIK it's not. I would argue that this form of attack is uniquely enabled by the gmail devs making a decision to add additional behavior to an otherwise well-understood spec, and that it's not netflixes problem to solve that. To be frank, netflix can't solve it. Asking netflix to change their code will only solve it for netflix, gmail users will still be "at risk" from, you know, potentially literally every other domain on the internet. So I would say that this is a risk that gmail users need to be aware of and mitigate themselves, perhaps by taking such drastic steps as reading their bills before paying them.