This seems like a really easy-to-fix problem on Netflix end: require the user to log into their account (or be logged in) prior to entering their payment inform

This seems like a really easy-to-fix problem on Netflix end: require the user to log into their account (or be logged in) prior to entering their payment information. This would completely eliminate the attack-vector the author mentioned. I can understand wanting to minimize user-friction, but if you're asking someone to enter their payment information, it's very reasonable to have them log in first. Email aliasing (dots/plus) in gmail is very useful to many people, and it seems overkill to blame Google for having introduced it. Besides, getting rid of it at this point would break backwards compatibility for a huge number of users, so the author's idea is completely infeasible.