The two security issues are user phishing and Netflix not performing canonicalization of email addresses. he signup process itself is not a security issue. Th

The two security issues are user phishing and Netflix not performing canonicalization of email addresses. he signup process itself is not a security issue. The issue from the perspective of the user should be that the author clicked on a link in an html email, when he should have instead gone to Netflix.com. He clicked first and only then checked. Gmail even warned him of the phishing possibility, and he still clicked on the link! He is the vulnerability that was almost exploited. It is true that there are other issues with user interactions, such as Netflix allowing signups without email verification, however those were purposefully designed that way by Netflix. They are features not bugs.