I don't understand why this post made it the front-page. As many have pointed out in the comments, Netflix should be verifying ownership of the account. Also, w

I don't understand why this post made it the front-page. As many have pointed out in the comments, Netflix should be verifying ownership of the account. Also, when you click the link, you would be either taken to your own logged in account on Netflix, or you'd try to log in with your canonical address. James in this case decided to get access to alternative email address Netflix account, but when he reset his password, the "attacker" can no longer control the account. They may still have sessions open that'll give them free TV for a while, but won't be able to change the password because that should trigger a prompt for the old password even when logged in. So I really don't see the attack vector here.