this is nothing new. people used to do this in maplestory a long time ago for multi accounts under one email
The dots do matter: how to scam a Gmail user
181–190 of 518 posts
Re: The dots do matter: how to scam a Gmail user
#182Earlier quoted context omitted.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
I was under the impression that literally anything goes on the left side of the @. It’s all up to the individual mail server
IIRC, not quite literally, but pretty close. The email RFCs in general tend to be much less constrained than one might expect.
Re: The dots do matter: how to scam a Gmail user
#183100% disagree. My standard gmail address is with dots but when I have to tell my (rather long because it is my full three part name) I either omit the dots or tell them they don't matter. Totally an important and useful feature. Netflix is at fault for letting someone else use your email without asking you for permission.
Why should netflix be required to adhere to the different ways that every email provider doesn't adhere to the spec?
The email providers do adhere to the spec. The spec does not guarantee that different local parts go to different inboxes.
Re: The dots do matter: how to scam a Gmail user
#184Earlier quoted context omitted.
Why should netflix be required to adhere to the different ways that every email provider doesn't adhere to the spec?
Because it's Netflix not adhering to the spec, which states that local addresses are to be interpreted by the host only. Netflix has no business caring about how Gmail interprets its local parts.
Well, if Netflix striped the periods, THAT would be not adhering to the spec. Netflix's issue is that they have a lax security practice, not that they don't adhere to the spec.
Re: The dots do matter: how to scam a Gmail user
#185Earlier quoted context omitted.
Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago. I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP. The rise of free webmail accounts from Hotmail etc changed…
Good to know. I had accidentally created multiple accounts for myself around '05 or so and was really surprised by it. Iirc back then they also required separate accounts per-country, but I could be wrong about that.
They still do AFAICT (I had to sign up for a Japanese account relatively recently).
Re: The dots do matter: how to scam a Gmail user
#186I don't see the scam here. If you have to go through password reset to get into the account and update the CC number, then the would be scammer does not have access to that account anymore (assuming Netflix logs you out of other devices when you change your password). Sure, you end up paying for an account you don't use, but nobody gains from that (other than netflix). It certainly is an issue that can easily be fixe…
I was thinking the same thing. This isn't really a viable scam unless maybe Netflix offers multiple ways to reset your password, which isn't addressed in the article. Maybe a text message reset is possible?
Re: The dots do matter: how to scam a Gmail user
#187One interesting thing to note, for GSuite accounts, the dots do matter. first.last@company.com is not the same account as firstlast@company.com.
This is true of gmail accounts as well. If you signed up with first.last you always must login with first.last. The real issue is that old account names are actually case sensitive too. Starting a few years ago Google normalized all account creation to lowercase, but existing case sensitive accounts remain. We implemented OAuth, normalizing accounts to lowercase in our db and everything was fine for years until we ra…
My wife has found this is absolutely not the case for gmail. She consistently gets firstnamelastname emails instead of firstname.lastname which is the one she signed up with.
To test a theory I told her to login as both using the same password. Both go to her gmail account. Logging in without the dot shows the address as still firstname.lastname.
My assumption at the time is during signup Google strips the dot and it's merely there for cosmetic purposes. The RFCs should treat the dots as separate accounts but Google does not.
Just to verify this is still happening, I also have a first.last account and signed in without the dot. When I got into my account it says 'signed in as first.last'.
This may affect accounts created up to a certain point in time though as both accounts are almost as old as gmail. I got invited back during the early days and invited my then girlfriend at the time (now my wife). If this has changed over time it's become way more confusing.
Re: The dots do matter: how to scam a Gmail user
#188Earlier quoted context omitted.
I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem. But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission. Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibl…
I strongly disagree with the author as well. Netflix is not doing its job. But the scam described by the author works because he victim already has an account registered with their Gmail address. The warning could be a good idea also I wish the email address of both the recipient and emitter were shown in a better in Gmail.
The scam works because of Netflix's lax security practices around verifying emails. Given how easy it is to make a mistake filling in your email address, and email address should never be trusted until it is verified AND you should make clear during your sign-up process that the user should expect a verification email so they know something is wrong when they don't receive one.
Re: The dots do matter: how to scam a Gmail user
#189Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
It really bothers me the number of web services which reject email addresses containing '+' in the local part.
If you're going to try to "validate" an email address, read the goddamn RFCs.
Re: The dots do matter: how to scam a Gmail user
#190Earlier quoted context omitted.
Just create a filter to send everything that doesn’t match your dot pattern to the trash. I have a relatively common first name / last name gmail account and it gets out of control sometimes.
My issue with doing that is that the other person will never get help. They’ll just say “oh my emails keep getting lost”, but if google would bounce them, then hopefully one of these services would notify the person that that isn’t their email. Instead of them happily continuing to send it all to me.
Very few services manage email delivery well enough to propagate email bounces back to their user account info.