291–300 of 518 posts
It's still a statistics game. Not everyone would pay without verification and not everyone would click the big green button in the verification mail, but some people will without realizing what's up, just like people fall for Nigerian scams mails.
There's no technical solution, only education can help.
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
Not only that, but apparently he was able to change Eve's account details without having to enter a password. If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his. All around very bad security design on Netflix's part.
Earlier quoted context omitted.
I like the idea of adding +spam@gmail.com, but it would be really easy for this to be invalidated by just stripping this from your email before selling it in a mailing list.
Instead of blacklisting the +spam@gmail.com email, you could whitelist emails like +netflix@gmail.com. You can create a filter so that if it doesn't match the whitelist - including stripping the plus - then it will be automatically binned. I describe this technique in my blog post[0]. I'll warn everyone now though, you'll probably want an email address for real people that you trust (like +friends@gmail.com). Also, y…
Earlier quoted context omitted.
IIRC, not quite literally, but pretty close. The email RFCs in general tend to be much less constrained than one might expect.
Yup. Even spaces are allowed if you put double quotes around the local part: “Kevin Spacey”@example.com. It’s really surprising, there’s very little that can be verified if you strictly follow the RFC.
Muhammad.(I am the greatest) Ali @(the)Vegas.WBA
I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character. I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explor…
I must be missing something but the + and . feature both have the same problem for this "scam", right?
Earlier quoted context omitted.
Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface. Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.
No one's saying that they aren't spec compliant, the writer is complaining that google doesn't tell its users that their inbox will include emails for more than 1 address.
Earlier quoted context omitted.
Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).
By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox. When I read TFA my first thought was "what does the standard say about it" and it does sound like Netflix is the one making the wrong assumption here. But I also see his point about how this can confuse users who don't realize this or are not using this behavior intentionally.
1) mentions the dots DO matter, and calls for they're removal as a feature, but makes no mention of the ability to add '+{whatever}' to an email providing the exact same attack vector
2) states this is a gmail issue, when any email provider could do the exact same thing and have it be a problem
3) states the Netflix not verifying the email before payment is somehow not a fix because "using someone else’s address on signup only cedes control of the account to that person", when the receiver has full ability to _not_ confirm the phishing account.
Netflix is what, just supposed to know and stay up to date with all possible email providers various email mappings? No, rather, they should verify the email address before payment. Granted, the onus is on the user to notice a new 'Confirm your email with Netflix' email. Maybe Netflix could make it really obvious that the email is for a _new_ account? Defense against phishing attacks will always rely on some amount of intelligent user behaviour, if a user is going not going to read an email and blindly click-though I'm not sure there's much that can be done anyway.
I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff. One's in Chile. I have almost no knowledge of Spanish. The other is in California. Having experienced this: Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid ema…
I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in. Then they can never access the account and continue to to use the service. Where available, I will delete the account as well. I found that if I don't do this, then I am just going to be receiving notification emails forever…
Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.