5 ms·
So add step 2.5: Netflix sends a confirmation mail and the victim confirms for the same reason as in step 4.
by ben0x539 8y ago
So add step 2.5: Netflix sends a confirmation mail and the victim confirms for the same reason as in step 4.
- josteink 8y agoSo basically Gmail broke internet email. Again.
- lotsofpulp 8y agoIf Gmail sends emails for first.last@gmail.com to firstlast@gmail.com, then I would hope Gmail wouldn't allow another account to be made with f.irstlast@gmail.com or fi.rstla.st@gmail.com or any other permutation of the dots (or lack of).
- koolba 8y agoThey don’t allow it. The user is at fault for validating their email address. Also Netflix gets partial responsibility for accepting email validation via a different browser session. Unfortunately it’s either that or have people constantly complain they can’t validate their emails from their phone yet browse on a different device. Middle ground may be IP address check so if you’re on the same WiFi it’ll work. Of course IPv6 kills that.
- josho 8y agoNope. If the user clicks a link in the email they won’t be able to log in to that account to confirm the change. If the user navigates to Netflix themselves they won’t have anything to confirm in their own account.