81–90 of 518 posts
Now admittedly its dense to read, but the two sections that are relevant are;
https://tools.ietf.org/html/rfc2822#section-3.2.4 & https://tools.ietf.org/html/rfc2822#section-3.4.1
3.2.4 explains what a dot-atom can be made up of 3.4.1 explains what can be accepted in the make up of an address.
I'll always prefer vendors operating within spec even if the spec is a dense as fuck.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.
In general we do it in two steps:
1. User detail and password
2. E-mail confirmation
Instead, if we did
1. User details but NOT password
2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail.
Actually, I think the most optimal would be
1. Enter e-mail address only
2. E-mail confirmation and entering all details
This would simultaneously protect the person that initated account creation and the owner of the e-mail address from one-another.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
I can’t belive how many services don’t validate email. I have a fairly common name and my gmail is first.last@gmail.com I get so many emails that aren’t for me, more than one person out there thinks they have firstlast@gmail.com
I don't understand this though, how do they think they have an email address if they were never able to create it or sign into it? I think more likely they forgot the number at the end or something like that.
Totally wrong.
Dots don't matter is a great way to filter your messages without giving an obvious filter. An example...
I used to use first.last+yourcompany@gmail.com when I shopped online. But a lot of companies started blocking addresses that contained a "+" as an invalid address.
So now I use firstlast@gmail.com for general shopping, and first.last@gmail for friends and family. Lets me easily keep the same inbox, but filter all the unwanted crap.
Also, I like to rotate it around a bit -- since the lack of a dot doesn't really give me much insight... I will put the dot in based on which vendor I'm working with -- f.irstlas.t@gmail.com, for example -- then use my password manager to keep track of which vendor that goes to... another easy way to just block all crap I don't want from my inbox.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Yep. Bug is the ability for users to charge a credit card before verifying email. Or did the victim in this blogpost also verify their email at some point? Netflix could be forgiven for thinking that updating payment details via email = verifying email. But if the victim had to respond to two emails, the first of which is a “verify email for your new account,” the phishing would be less believable. Ultimately, the vi…
Making users retype the email (instead of merely click on a link) might be better for exposing scams but requires more work on the user’s part.
On the other hand, e-mail verification should be done eventually to protect Eve from James to recovering her account in case Eve had a typo unintentionally.
I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
Earlier quoted context omitted.
If you have a bug in a system, do you fix it at the source, or do you fix it at all the leaves? Netflix might be wrong here, but fixing it at Netflix doesn't make the problem go away. Fix the problem once (GMail) and never ever have to deal with it again.
But you can’t put the cat back in the bag. People have used the system to sign up for multiple emails at multiple sites, expecting them to go to the same inbox. I suppose you could solve the problem by grandfathering all existing aliases and whitelisting delivery of only those that received at least one email before the policy change. And also continuing to forbid registration of any aliases.
Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character.
I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explore the security issues around them.
I used to work for a company that dealt with these issues almost 10 years ago. It was also fun when Hotmail and Yahoo started recycling unused email addresses after ~6 months.