171–180 of 518 posts
I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords. This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one. I have yet to see what happens if I try to set both accounts to the same password.
This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?
I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
You can (should) also mark the messages as spam because whoever accepted that address without verifying it shouldn’t be sending emails to it.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…
I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to reg…
Earlier quoted context omitted.
Gmail could let you specify a list of valid addresses: first.mid.last, firstmidlast, firstmid.last Any others bounce or display the warning header suggested in the article.
That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.
Earlier quoted context omitted.
Why can't it be both sides' issue? I have a fairly uncommon first and last name, but I still get emails from the few folk who share my name combination, and I too have gotten sensitive information that I shouldn't have. I cannot imagine the strangeness that must occur for folks with more common name combinations, and the idea that e.mail@gmail.com is the same as email@gmail.com just seems wrong to me. As far as I kno…
Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.
However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person.
In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address).
Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.
Earlier quoted context omitted.
Of course they know. They delivered the emails to the aliases, which are permanently in the To: field of the metadata. As long as you can see the email “to” address in the gmail web interface, so can Google.
What about emails that were deleted?
I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…
I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address. I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying. If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to reg…
Many services do strip capitalization when checking email address uniqueness, but this is as much a mistake as stripping dots.