5 ms·

This is indeed the case. I have checked it myself. The link below shows how this can be used maliciously. https://jameshfisher.com/2018/04/07/the-dots-do-matte

This is indeed the case. I have checked it myself. The link below shows how this can be used maliciously. https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/ https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-t... I do not know if this has been mitigated.

newsbinator 6y ago
OP of that post has an ad at the bottom for their product that I actually found compelling. It's a screencast tool- but instead of putting a video of your face in the corner, it overlays/ghosts your face on top of the full screen you're sharing. Now sure how well it would work in practice. Maybe it's too distracting. But it looks like a neat thing to try.
tialaramex 6y ago
James is wrong, this is Netflix's fault. The same "scam" would work under a variety of circumstances because Netflix relies on something it has no reason to believe is true. Maybe you signed up to Netflix but your house mate thinks she did, she gets an email because of Eve, now you're both paying for Netflix, but actually she's paying for Eve's account. Netflix could make this mistake with postal addresses even, if for some reason they used postal addresses. You get a letter from Netflix, you don't notice it's addressed to Eve, who had stupidly written your address instead of hers, you pay for her Netflix. This is a data protection violation, data processors have a duty to take reasonable care that the personal information they have about data subjects is correct. If you need it, make sure it's accurate. If you don't need it, don't collect it.
- Spivak 6y ago
  This is actually Google's fault. Because Google is large enough Netflix could be nice and have special handling for Gmail addresses but this would be going against the email RFC that says $inbox1+$subaddr@domain == $inbox2+$subaddr@domain iff $inbox1 and $inbox2 are identical. Netflix has zero idea how any particular email operator mangles or maps inboxes to actual users. Apple's private email service maps all sorts of inboxes to the same actual person. Mailinator maps every address to everyone.
  - robjan 6y ago
    This is Netflix's fault for not verifying email addresses before taking payment details for a recurring subscription.
    - Spivak 6y ago
      True, Netflix should have verified that the person signing up could actually receive an email at the address they gave. But in addition Netflix is right to allow the creation of two accounts where the difference is only dots.
  - kevin_thibedeau 6y ago
    There is no RFC specifying the interpretation of address formats. Every domain can use whatever scheme they wish. The RFC only declares that senders can't impose additional formatting rules on receivers.
giarc 6y ago
Wouldn't the real James be notified that someone used his email to sign up for another Netflix account? When 'Eve' signed up for Netflix with james.hfisher@gmail.comm the signup confirmation would go to jameshfisher@ inbox?

newsbinator 6y ago

OP of that post has an ad at the bottom for their product that I actually found compelling. It's a screencast tool- but instead of putting a video of your face in the corner, it overlays/ghosts your face on top of the full screen you're sharing. Now sure how well it would work in practice. Maybe it's too distracting. But it looks like a neat thing to try.

tialaramex 6y ago

James is wrong, this is Netflix's fault. The same "scam" would work under a variety of circumstances because Netflix relies on something it has no reason to believe is true. Maybe you signed up to Netflix but your house mate thinks she did, she gets an email because of Eve, now you're both paying for Netflix, but actually she's paying for Eve's account. Netflix could make this mistake with postal addresses even, if for some reason they used postal addresses. You get a letter from Netflix, you don't notice it's addressed to Eve, who had stupidly written your address instead of hers, you pay for her Netflix. This is a data protection violation, data processors have a duty to take reasonable care that the personal information they have about data subjects is correct. If you need it, make sure it's accurate. If you don't need it, don't collect it.

Spivak 6y ago
This is actually Google's fault. Because Google is large enough Netflix could be nice and have special handling for Gmail addresses but this would be going against the email RFC that says $inbox1+$subaddr@domain == $inbox2+$subaddr@domain iff $inbox1 and $inbox2 are identical. Netflix has zero idea how any particular email operator mangles or maps inboxes to actual users. Apple's private email service maps all sorts of inboxes to the same actual person. Mailinator maps every address to everyone.
- robjan 6y ago
  This is Netflix's fault for not verifying email addresses before taking payment details for a recurring subscription.
  - Spivak 6y ago
    True, Netflix should have verified that the person signing up could actually receive an email at the address they gave. But in addition Netflix is right to allow the creation of two accounts where the difference is only dots.
- kevin_thibedeau 6y ago
  There is no RFC specifying the interpretation of address formats. Every domain can use whatever scheme they wish. The RFC only declares that senders can't impose additional formatting rules on receivers.

giarc 6y ago

Wouldn't the real James be notified that someone used his email to sign up for another Netflix account? When 'Eve' signed up for Netflix with james.hfisher@gmail.comm the signup confirmation would go to jameshfisher@ inbox?