4 ms·
Further, it is trivial to picture an attack where through some other channel, the attacker already knows the email address of their target, and has the knowledg
by pryce 9y ago
Further, it is trivial to picture an attack where through some other channel, the attacker already knows the email address of their target, and has the knowledge that this victim has a netflix account.
If I only need these two pieces of information, neither of which is intended to be 'secret', then I might easily already have enough information to attempt this attack on (for example) my ex, or their new partner, or someone at either work or university that I dislike, even if I didn't have enough information to target a random person in another country.
It is good practice not to expose user's email addresses to attackers. It is breathtakingly bad practice to depend on those email addresses being secret.
- pttrpttrwttr 9y agoI really don't see why Netflix needs insider knowledge or whatever to be able to detect john.doe as being the same as johndoe.
- SlowBro 9y agoI believe it’s because this feature is largely unique to Gmail? So Netflix would need to know and maintain a database of rules based on domains. * Gmail: Dots are cool. * Hotmail: No capes! I mean dots. No dots! * Multiplied by 8 hundred gazillion domains...
- DataWorker 9y agoYou’re thinking too much like a programmer. It’s a single rule for a single domain that accounts for the majority of users. The right thing to do is ask for a password, but absent that, accounting for gmail addresses seems worthwhile. It would save them getting a thread like this on hn.
- patcheudor 9y agoNo database needed, just ask for e-mail validation by sending an account validation link to the e-mail. Problem mostly solved.