111–120 of 518 posts
Earlier quoted context omitted.
Dot's don't matter if the relevant RFC says they don't matter and I think this is the case. Google follows the standard, Netflix does not.
The other way around. It's Google who decided to do it that way.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Earlier quoted context omitted.
I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.
Dot's don't matter if the relevant RFC says they don't matter and I think this is the case. Google follows the standard, Netflix does not.
Earlier quoted context omitted.
I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.
If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com? If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (mayb…
Most of the startups I work for don't require a valid e-mail when you enter your payment information. Reasons are multiple - conversion drop, "we took your money, we don't care", the e-mail is anyway entered with the payment provider, etc.
Also what comes to your e-mail and you act on is your responsibility. I don't know about you, but I don't pay for more than a dozen services with my card and I usually am aware when / what is being paid, so a scam like this would be easy to detect.
I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…
These days I'll flag any email from a service as spam, no matter how well known, if there was no email verification step.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
If you have a bug in a system, do you fix it at the source, or do you fix it at all the leaves? Netflix might be wrong here, but fixing it at Netflix doesn't make the problem go away. Fix the problem once (GMail) and never ever have to deal with it again.
netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one. and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.
IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.
I don't see any excuse to not confirm an email address, honestly.
Earlier quoted context omitted.
IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.
> actually emails with dots in different positions should be different emails Don’t know from where this is coming from but there’s no such _should be_ rule, there never was. As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to. Any email server or service worth i…
Relying on email providers to do the right thing (read RFCs) so you can avoid best practices is the wrong conclusion to draw here. Netflix should validate all email addresses. It's really, really basic stuff.