Re:The dots do matter: how to scam a Gmail user
by __david__ on Sunday April 08, 2018 @12:40AM
(#16784644)
The + thing is common but is absolutely not universal. I can alias individual + emails on my system just fine (which means that [email protected] and [email protected] are not equivalent) and most smtp servers allow you to set an alternate character (I set it to '.' and '_' so [email protected] and [email protected] are aliased together).
In short, Netflix cannot assume things after the '+' are irrelevant and Netflix absolutely cannot canonicalize random emails like that.
Re:The dots do matter: how to scam a Gmail user
by drdaeman on Sunday April 08, 2018 @05:31AM
(#16785379)
All of this would be still useless regarding the proposed attack concept, because [email protected] is also [email protected].
And domain aliasing is certainly out of scope of any email RFCs I saw. Netflix (and everyone else) may know about googlemail.com, but it's virtually impossible to know about all other cases.
Re:The dots do matter: how to scam a Gmail user
by Franciscouzo on Saturday April 07, 2018 @10:40PM
(#16784308)
I'd hate it if websites started implementing that, I like being able to register to the same site with the same email multiple times.
Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for not accounting for provider-specific, non-standard equivalences.
Email address verification alone doesn't seem to fix all the erroneous aspects of this issue: Let's say Netflix was requesting verification, and then you receive the email for the +tagged mail address. Shouldn't it say that you already own a Netflix account, instead of asking for a verification at that point?
[1] https://tools.ietf.org/html/rfc5233