201–210 of 518 posts
Earlier quoted context omitted.
Of course they know. They delivered the emails to the aliases, which are permanently in the To: field of the metadata. As long as you can see the email “to” address in the gmail web interface, so can Google.
What about emails that were deleted?
I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
I just tried creating an account that differed from an existing account in the number of dots, and it was refused, explicitly on the grounds that periods and capitalization are ignored. Therefore, either at some point Google got this wrong and allowed the creation of such aliases to an existing account as if they were distinct, or this person is mistyping one of the non-dot characters of their address.
People just mistype addresses and vendors don't verify
I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
I just tried creating an account that differed from an existing account in the number of dots, and it was refused, explicitly on the grounds that periods and capitalization are ignored. Therefore, either at some point Google got this wrong and allowed the creation of such aliases to an existing account as if they were distinct, or this person is mistyping one of the non-dot characters of their address.
Earlier quoted context omitted.
If you have a bug in a system, do you fix it at the source, or do you fix it at all the leaves? Netflix might be wrong here, but fixing it at Netflix doesn't make the problem go away. Fix the problem once (GMail) and never ever have to deal with it again.
There is no bug in Gmail. This bug has nothing to do with Gmail, it is with Netflix not clearly communicating when verifying the address a user claims to own.
Earlier quoted context omitted.
But then if the password is reset, the original scammer has no access to the account! And the scammer cannot reset the password because they do not have access to the email.
This is true if changing the password s you to re-enter the password on every device (even those that were logged in at the time)
Edit: Or at least invalidate all sessions initiated using the old password if you have that tracked.
I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept. Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character. I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explor…
My understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature". edit: I was corrected in other comments that the + labeling is optional part of the standard.
Also, you'll have to elaborate on how the dot usage actually breaks the RFC. I assume it states that dots are just like any other allowable character, but that's not the same as actually breaking the RFC.
Earlier quoted context omitted.
That same problem can happen even without dots. People can simply mistype their email and have it be your email. That happens if even if neither of you have dots in your email.
So then send the verification email at signup and any time the user changes the stored email on their account. Am I missing something?
I agree that sending verification emails should be the standard. But if I can’t bounce the emails then there isn’t even the slightest way to inform the sending service that there might be a problem.
I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern” I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this pers…
I'm not sure of the legality of that process, and you could argue the morality of it, but doing this once to one of their less important accounts (library?) might be a good way to get enough information to contact them properly.
[1] It wasn't technically the same, because the typo was done by a phone carrier agent, not the person whose account they were setting up. My email is firstname.unrelatedstring, theirs was firstname.theirmiddlename.lastname, but my unrelated string happens to be their middle name.