Hacker News Reader

Comment by gcb0 | Hacker News Reader

netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one.

and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.

View on HN

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

> actually emails with dots in different positions should be different emails

Don’t know from where this is coming from but there’s no such _should be_ rule, there never was.

As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to.

Any email server or service worth its salt allows aliases. Which aren’t hard to guess for a determined attacker either.

Netflix has no excuse ;-)

subdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.

> Too many sites block + aliasing.

You actually mean: Too many sites were coded by incompetent people and have broken input validation.

Yes, unfortunately that's the truth.

For example: meetup.com

On an email with a plus in it, they complain with this exact error message: "This isn't a valid email address".

I contacted their support a year ago. They replied that they've passed along my "feedback". Nothing happened since then.

That said, plus aliasing is sort of a standard. And spammers could eliminate anything after the plus, its usage being pretty obvious, so you can't rely on it for tracing spam. Eliminating the aliasing is much trickier to do with sub-domains, as it's not at all clear when aliasing is used or not. And some email services support custom email routing based on your own regular expressions (e.g. GSuite) so you can come up with your own weird scheme.

Plus aliasing is only fine when you don't have control for doing something better, more opaque. Like when you have a work or a @gmail.com address.

As somebody who has multiple people who aren't me registering accounts to variations of my email address:

Companies who do not send "you've created an account! Click here if you didn't!" emails can die in a fire.

Ironically, the most i get of those emails is google itself

They allow any idiot to register my gmail address as their "alternative recovery email" without confirmation. And then from time to time i get a dozen "recover your account" emails from those accounts.

The thing is, the handling of the local part is MTA specific: you cannot just assume that different local parts correspond to different people because of aliases, +foo addresses and the fact that the administrator of the MTA can set whatever equivalence rules they like: I, for example, use - instead of + because so many internet forms reject + as a valid email character.

The only sane way to handle this is email-based confirmation.

I am not even sure what you are replying to. I never said opposite of "actually emails with dots in different positions should be different emails". I also strongly think so. Netflix suck for not letting the owner of the email know an account is associated with it in a much better way.

Not confirming the email is insane. And it's even worse if you're going to use that email address to send personal data.

I don't see any excuse to not confirm an email address, honestly.

There should be an account creation email and another for a payment method being added. A lot of sites nag you to verify email but never force it.

Yeah, another pattern I've seen is that confirmation is required just in case you need to provide a payment method.

Reply on news.ycombinator.com