News for hackers. Stuff that matters.
Re:The dots do matter: how to scam a Gmail user by djur on Saturday April 07, 2018 @04:02PM (#16782565)
Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).
Re:The dots do matter: how to scam a Gmail user by hibbelig on Saturday April 07, 2018 @04:12PM (#16782635)
Well, google.com assigned semantics to the local-part, which they are allowed, even supposed, to do.
Re:The dots do matter: how to scam a Gmail user by djur on Saturday April 07, 2018 @04:36PM (#16782794)
My point is that the RFC doesn't say they "don't matter", it says they don't have to matter. For Netflix to assume they don't matter would be in violation of the RFC (it would be assigning semantics to the local-part).
Re:The dots do matter: how to scam a Gmail user by hibbelig on Saturday April 07, 2018 @06:39PM (#16783440)
Thank you. I misunderstood.
Re:The dots do matter: how to scam a Gmail user by stordoff on Saturday April 07, 2018 @04:37PM (#16782801)
Doesn't that support what Google is doing? Google is the host specified in the domain, and they are interpreting the local-part to refer to the same mailbox if they only differ by dots.

The RFC also notes that the local-part MAY be case-sensitive (i.e. it's up to the host).

Edit: the host SHOULD ignore case: "a host that expects to receive mail SHOULD avoid defining mailboxes where [...] Local-part is case-sensitive".

Re:The dots do matter: how to scam a Gmail user by djur on Saturday April 07, 2018 @05:36PM (#16783139)
It does. The relevant RFC says they don't have to matter and that senders shouldn't assume they do or don't. That means that both Google and Netflix are following the standard. The problem isn't with either company's compliance with the RFC, but that's not saying a lot. A mail provider could legally ignore all vowels in mailbox names.

(Similarly, although the RFC does say hosts shouldn't have case-sensitive local-parts, it doesn't say that senders can assume that local-parts are case-insensitive.)

Re:The dots do matter: how to scam a Gmail user by ams6110 on Saturday April 07, 2018 @07:45PM (#16783716)
By that logic, [email protected] and [email protected] could be delivered to the same mailbox. When I read TFA my first thought was "what does the standard say about it" and it does sound like Netflix is the one making the wrong assumption here.

But I also see his point about how this can confuse users who don't realize this or are not using this behavior intentionally.

Re:The dots do matter: how to scam a Gmail user by __david__ on Sunday April 08, 2018 @12:57AM (#16784685)
> By that logic, [email protected] and [email protected] could be delivered to the same mailbox.

They absolutely could. Netflix can't assume they are or they aren't. Which means Netflix is doing the correct thing here. All they can know is that the emails are potentially different and so they should treat them as different emails.

Re:The dots do matter: how to scam a Gmail user by spc476 on Saturday April 07, 2018 @08:27PM (#16783860)
Yup. Since I run my own email server, I have 200 email addresses that are delivered to a single account. Some are service accounts (like [email protected]) but a lot are single-use email accounts to track the selling of email addresses and spam.