The dots do matter: how to scam a Gmail user

- Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them.

- Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But this would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm.

1. In order to provide the payment details, they had to do a password reset to the dot-email address. I can only assume that locks out 'eve' in this case, but I suspect it doesn't force a re-login on all devices.

2. When 'eve' signed up to the dot-email address, surely Netflix would have sent a welcome email thanking them for starting a trial. So in that case, I can't see how it would have gone completely undetected up to this point.

I personally feel that Netflix should validate the email address on registration. Otherwise people who genuinely sign up with a typo in their address may lose access to it forever.

(I'm guessing they did A/B testing and found that having to log into your account lost them some percentage of people. If that's the case, Netflix are clearly putting their retention rate ahead of security)

There's probably a not insignificant number of people who are happily using a dotted variation of their gmail account. Putting a big warning above the email wouldn't make them very happy.