411–420 of 518 posts
If that is the case, that is pretty scary and I cannot trust gmail to proceed my payment related email anymore.
When I asked Netflix's support to remove the association of that account with my e-mail address, they replied I had to change the card details with mine, because it was like I was "stealing" the scammer account credit card. I replied I would not add my credit card details. The operator then wrote me he was going to invalidate my e-mail address so that the user that would log in, had to change it. And that it should solve my issue.
The problem, for me, is not the Gmail feature. Nor the dots, neither the plus addressing. It's a lack of the validation systems. Just verify the e-mail ownership before allowing any interaction.
Earlier quoted context omitted.
Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain. The attack goes like this: * Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. * Eve creates a Netflix account w…
The difference is that the dot behavior is non-standard, the plus behavior is standard.
The acceptibility of the '+' character is specified in RFC 5322 [1].
However, the behaviour where an address comprised of:
local-part "+" some-suffix "@" domain
is automatically routed to the address: local-part "@" domain
it certainly not part of the standard. I find it very useful myself and would be displeased to see that functionality removed, yet this is certainly not part of the standard.
Earlier quoted context omitted.
> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher. The bug is right here - you shouldn't be able to determine if a user account already exists. If an account already exists: - Logon shouldn't tell you that you have an account and the password was wrong - Registration should send a "looks like you already have an account" email…
Agree that many steps can be improved. In real live, though, it's not so difficult to guess/find someone who has Netflix, and also find their email. That's a really weak security requirement, security shouldn't depend at all on that part (it seems more relevant for privacy to me)
If I only need these two pieces of information, neither of which is intended to be 'secret', then I might easily already have enough information to attempt this attack on (for example) my ex, or their new partner, or someone at either work or university that I dislike, even if I didn't have enough information to target a random person in another country.
It is good practice not to expose user's email addresses to attackers. It is breathtakingly bad practice to depend on those email addresses being secret.
Does it means that if I know a person's email is firstnamelastname@gmail.com, I can register firstname.lastname@gmail.com to sniff all the email of firstnamelastname@gmail.com? If that is the case, that is pretty scary and I cannot trust gmail to proceed my payment related email anymore.
"Someone already has that username. Note that we ignore full stops and capitalisation in usernames. Try another?"
Earlier quoted context omitted.
Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message) If the user already exists the email will be a warning + a link to the password reset form If the user does not exist, the email will b…
Why is it bad to know if an email is already registered?
Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email. If you are sending private transactional emails you need to verify accounts first.
I agree, the responsiblity for this flaw ultimately lies with netflix. And if laying blame is a helpful thing to do, the blame lies with netflix. But at the same time, in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.
Indeed. You should always validate emails for accounts.
The amount of accounts I “have” and can’t cancel because of sites not doing any email-ownership validation is quite annoying.
> in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.
Gmail is doing something very nonstandard here and it’s absolutely their responsibility to inform users why they are getting emails on addresses (most?) users would never know about nor use.
I’d even say that having this feature on with infinite whitelisting by default is a security issue which should be resolved.
Preferably by only allowing explicitly whitelisted entries created by (the few) power users using this feature.
Earlier quoted context omitted.
But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account. For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.
you still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?