News for hackers. Stuff that matters.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by Symbiote on Tuesday December 17, 2019 @04:36AM (#21812063)
It is actually an antifeature, since it is non-standard and leads to various attacks.

For example, a malicious user can register

  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
with a service, which will (quite reasonably) send a "Welcome" email. That results in a flood of emails to the GMail user.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by morpheuskafka on Tuesday December 17, 2019 @03:12PM (#21818227)
I wouldn't go so far as to call it an antifeature--in fact, I wouldn't be surprised if a common use is to allow people to maintain multiple accounts on the same service with one email. It isn't standard, but it's not in violation of any standard--nothing says that the server must store each distinct valid email in a separate mailbox with its own login. Many servers implement "catchall" emails or aliases which result in the same thing, distinct addresses going to the same mailbox.

What is a problem, and what is non-standards-compliant, is GitHub incorrectly assuming that all mail providers will do this when many do not. It would be no different from assuming that "admin" and "postmaster" go the same mailbox because that's the way a lot of software is configured.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by contravariant on Tuesday December 17, 2019 @07:48AM (#21812950)
This seems like it would take a lot of effort to mildly annoy someone.

And the only way it can be automated is if the service doesn't protect itself against automated user sign-ups, which they will either start doing once someone really takes advantage of it, or will result in their domain being categorised as spam once they start sending lots of sign-up emails (either by the user or gmail in general).