Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by morpheuskafka on Tuesday December 17, 2019 @03:12PM
(#21818227)
I wouldn't go so far as to call it an antifeature--in fact, I wouldn't be surprised if a common use is to allow people to maintain multiple accounts on the same service with one email. It isn't standard, but it's not in violation of any standard--nothing says that the server must store each distinct valid email in a separate mailbox with its own login. Many servers implement "catchall" emails or aliases which result in the same thing, distinct addresses going to the same mailbox.
What is a problem, and what is non-standards-compliant, is GitHub incorrectly assuming that all mail providers will do this when many do not. It would be no different from assuming that "admin" and "postmaster" go the same mailbox because that's the way a lot of software is configured.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
by contravariant on Tuesday December 17, 2019 @07:48AM
(#21812950)
This seems like it would take a lot of effort to mildly annoy someone.
And the only way it can be automated is if the service doesn't protect itself against automated user sign-ups, which they will either start doing once someone really takes advantage of it, or will result in their domain being categorised as spam once they start sending lots of sign-up emails (either by the user or gmail in general).
For example, a malicious user can register
with a service, which will (quite reasonably) send a "Welcome" email. That results in a flood of emails to the GMail user.