There's a bit of a logic issue in the proposed attack. > 7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account. T

There's a bit of a logic issue in the proposed attack. > 7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account. This assumes that Eve is 1) still logged into the session despite the fact that Jim has changed their password and 2) that Netflix does not require a user to provide the current account password to change the email. I have no idea if Netflix does item 1; it's debatable, although it might be a good idea in some cases. But item 2 is a super basic security; I can't imagine they don't do that. And if they do that, then there's no real attack here.