The dots do matter: how to scam a Gmail user | Hacker News Reader

The dots do matter: how to scam a Gmail user

jameshfisher.com

1,023 pointsjamesfisher506 comments

Totally disagree with the conclusion. This is Netflix's issue for not validating the email account. Not sure if Uber has changed this since then, but back in the day I used to get the full ride details and receipts from someone else who mistyped their email.

If you are sending private transactional emails you need to verify accounts first.

PayPal and eBay also don't validate email, not even before attaching a bank account or making a purchase.

i found out that ebay.in does not, iirc they do for US accounts or am i wrong?

I think these are orthogonal issues. The dots do matter, but Netflix should also validate email addresses. However, I don't think it's as critical. Lack of email validation means I receive someone else's ride details (I agree, annoying), but dots-don't-matter means I might accidentally pay for that person's rides.

But if just the email validation problem were addressed - you wouldn't accidentally pay for someone's rides. Their account would never be created as they don't have access to the email they provided. Just dealing with email validation solves both problems.

If Google fixed dots-don't-matter, couldn't someone still sign up for Netflix with jameshfisher+netflix@gmail.com?

If Netflix checks for + address duplicates, then that's not an issue. But you could still have the situation where someone signs up for, let's say, Hulu with your standard jameshfisher@gmail.com account. And then you could still end up paying if you forget whether you ever signed up for Hulu or not (maybe you were about to sign up and didn't, maybe you planned to in the future).

Email validation seems like the most important defense against this kind of thing. Dots mattering seems secondary.

A similar problem exists for weird services like Amazon that allow multiple accounts for the same email address (unless they finally fixed that stupid idea?).

Multiple accounts with the same email haven't been available for many, many years. I'm not sure exactly when registration for these was disabled, but it was 10+ years ago. Possibly 15-20 years ago.

I think it was a valid design decision at the time, before accounts on websites were widespread and a family might only have a single email address from their ISP.

The rise of free webmail accounts from Hotmail etc changed that, of course. And now we have a shared understanding of how accounts on websites should work. Neither of those were true in 1994.

Good to know. I had accidentally created multiple accounts for myself around '05 or so and was really surprised by it. Iirc back then they also required separate accounts per-country, but I could be wrong about that.

They still do AFAICT (I had to sign up for a Japanese account relatively recently).

Amazon Japan and Amazon China are the only ones that have separate accounts from the rest of the Amazon sites.

I don't think they require separate accounts per-country, but my only experience is with .com and .ca. They might do the accounts on a per-realm basis (North America, Far East, Europe, etc.) rather than strictly per-country.

I have same account (same mail) with amazon that works across their .com, .in, .fr., .co.uk

Naw, I left about 10 years ago and out was still there, and still had co-workers at a different job asking me about it a couple years later, because they got bit by it.

The justification I heard was that someone would have a personal and business (or library) account to the same email, but it definitely persisted longer than you think.

Well, they were enabled but you couldn't create new ones when I joined 7 years ago. I was under the impression they'd long since been retired at that point. Given the turnover there, ancient lore could have only been a year or two before that.

I had to jump through some hoops to get one of the accounts to test something I worked on with them.

Doesn't seem stupid to me. In the real world can have multiple accounts with a business using the same physical address. Why should contact information be limited to a single account? Why should an email address be assumed to uniquely identify a person? Email sharing is still very common, and many organizations have addresses like info@ or help@ that don't identify anyone at all and could be read by any number of people.

Right. The +-suffix suffers from the same problem as the dots-don't-matter-policy: While some implementations use + as a separator between a mailbox name and a suffix, there is nothing in the RFC that encodes that, so different server implementations could just as well see + as a regular letter of the local part. Netflix has no choice but to treat james.h.fisher@gmail.com, jameshfisher@gmail.com and jameshfisher+netflix@gmail com as different email addresses. Really, to the left of the @, almost anything goes, and how an MDA maps the local part to a specific mailbox is completely up to the implementer.

As you point out, the only way around this email verification.

They're both issues, I agree there, but I think Netflix's screwup is larger here.

Lack of validation means that Netflix is emailing someone asking them to pay for something, who may be totally different than the person getting that thing.

Thinking about this a bit more, I believe that there is another problem with how account creation is done.

In general we do it in two steps:

1. User detail and password

2. E-mail confirmation

Instead, if we did

1. User details but NOT password

2. E-mail confirmation and subsequently entering the password on the page that was sent via e-mail.

Actually, I think the most optimal would be

1. Enter e-mail address only

2. E-mail confirmation and entering all details

This would simultaneously protect the person that initated account creation and the owner of the e-mail address from one-another.

Second solution seems pretty optimal for security but not sure if users up for that.

Typically when I implement user self-registration for my portal-website clients, I use a variation of your third option:

1. Enter email address and some out-of-band information that only an existing-account-holder should know. Eg: a web portal for a utility company could ask for the account number and amount due from a recent bill.

2. Send confirmation email with a code/link.

3. After user enters a valid code, continue registration by gathering additional user details, password, and (usually) recovery Q&A.

The user account is not created until step 3; if they provide a fake email, it's as if the registration attempt never occurred. Absolutely no access is granted until after the final step.

The extra details in step #1 only works for website registration of a user that has a pre-existing relationship with the company, of course. For a new account, email address is all you should request at that point.

I wish requiring validation was still the norm. I get that services and sites want to reduce “friction” and get people using it right away, but anybody like me with fairly generic gmail address knows, many people don’t know their own email address. I must have hundreds of active accounts linked to that email that I didn’t sign up for (although I’m sure a lot of them can’t be logged into anymore and the people can’t recover their passwords). That account became unusable, I got my own domain account a decade or so ago to replace it but still look in there occasionally.

Please though, anybody implementing signups - if you are going to let people sign up without validating email addresses, put a “I didn’t sign up for this account” link in every email you send.

Please don't use recovery Q&A.

As a user, I cannot trust that a website gets the recovery flow right. Some websites will allow you to bypass email and password if you know the answer to the question. Because of that, I cannot put in the real answer, as that would be a massive security risk.

So I usually put in some random garbage, which means it's essentially a second password. Well, if I lost my first password, chances are good that I lost the second password as well.

So please, don't do security questions. Just send a password reset link by email.

If you're worried about stuff like payment info stored in the account, just ask me to re-enter those details after I changed my password.

Fair points, and I'm not a fan of the recovery Q&A either. But here's the process that I use:

1. User must enter their email address, and I send them an email with a recovery code.

2. After they enter the code, validating control of the email address, I show them the Question they chose and let them enter the answer.

3. After they enter the correct answer, I force them to update their password, and I send a confirmation email about the password update.

The emails all provide contact information and ask the user to get in touch if they didn't initiate any of these actions.

You're right about the answer being essentially a second password, and I treat it as such: only an encrypted hash is stored, type=password fields are used to enter it.

One of my clients did request getting rid of the Q&A, which I was able to do pretty easily because email verification step and reset code were already implemented.

On a personal note, I never use real answers for security questions. I use randomly generated strings, just like my passwords. If I can choose my own question I use a random string for that too.

Maybe I don't understand the second option, but it seems to me that if you do the second option and a wrong email address is provided in step 1, then in step 2, the wrong person can take ownership of the account and provide his own password. So I agree with codetrotter that the third option is best of the three, to protect the two people from each other.

The possible disadvantage I see with the third option however is that if you are at a service desk, and they are trying to sign you up for a membership of some sort, they can't complete your registration on the spot. You would have to go home and use the computer to complete your registration (unless you can use email client on your smartphone). Which means they may lose a possible member if they don't ensure that you finish the registration right there and then.

For that reason it may be better to collect the email address, all customer details, and the desired password (typed twice). Then when the confirmation link is sent, the confirmation link should take you to a link that asks you for your password again (once) before your account is validated. This ensures that the person at the service desk is really the person using the email account to do the validation. Mere access to the email account should not be enough. The main advantage here is to make sure as little work as possible is left to the customer to do by himself when he gets home. I agree that this is a lot more messy than Doug Webb's approach, because the only accounts in that approach are validated accounts.

However to the extent that one does not want to lose a possible new membership because someone went home and decided not to continue the process because it is a lot of work, it may be worth it.

Dot's don't matter if the relevant RFC says they don't matter and I think this is the case.

Google follows the standard, Netflix does not.

The other way around. It's Google who decided to do it that way.

Which the RFCs for email do allow. The local part is the local part, under local control, and should not be assumed about by remote systems.

Regular people, upon looking at an email address, might think that

- alert@example.com

- A.Lert@example.com

- Al.Ert@example.com

etc. were different.

Requiring them to know or check what's the "local control" policy at each site may be a stretch.

Principle of least surprise, etc.

These are all different e-mail addresses; that part should not be surprising, and Netflix is absolutely doing the right thing by considering them different. (The same goes for "+labels": a "+" is a perfectly valid character in the local part of an e-mail address and the meaning of the "+" is entirely up to the mail host, so e.g. rejecting e-mails with a "+" or stripping out the "+" and following characters would violate the RFCs.)

No, Netflix's errors lie in (a) sending e-mail for any purpose other than account validation to an unvalidated e-mail address, and (b) including a pre-authenticated link in the e-mail that bypasses the normal account access controls. Pre-authenticated links are poor security practice in general; e-mail is notoriously insecure, and simply being able to read an e-mail sent to the address on file does not imply that the reader should have access to the account.

As for "dots don't matter", it can be argued that Google made some scams a bit easier by routing e-mails to non-canonical e-mail addresses to users who don't realize they even have such addresses; my own recommendation would have been to block registration of e-mails differing only in the number or placement of dots, but bounce any incoming mail where the "To:" field doesn't match the canonical form chosen at account creation time. However, since doing away with the "dots don't matter" policy would not significantly impact the more general issue of e-mail address aliasing, I do not believe that Google's policies are to blame for this particular security gap.

Those are three different addresses. On some systems they may be three different accounts. On others they may be one account.

On some systems, anything ending in '@example.com' may be a single account.

It may be that defined address to account mappings exist on a domain and all other addresses map to a default account. It's common enough the hosting industry supports it and it has a name - a catchall email account.

Nobody sending mail to any of those addresses needs to know how many addresses map to the account associated with the address to which they are sending. It's an address, not an identifier. I would argue you don't have a reason nor a right to know the address to account mappings in my systems.

What a sender should reasonably expect is that someone who can receive mail delivered to a particular address is in charge of the email account to which that address maps. Sending a verification email to someone expecting to receive it is the way to validate the recipient is the intended recipient. That's it.

If I give you my phone number, do you need to know what other phone numbers will ring that phone or how many phones I answer in order to call me? Do I need to disclose all the possible places I might receive a package if I want one delivered to a single place? No.

Email addresses are addresses. That's all they are. Stop pretending they are something else, and this will become much clearer for you.

Nope. RFC 5321: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address". That means it's actually technically against the RFC to do any normalization of the local-part (like ignoring dots or case).

Well, google.com assigned semantics to the local-part, which they are allowed, even supposed, to do.

My point is that the RFC doesn't say they "don't matter", it says they don't have to matter. For Netflix to assume they don't matter would be in violation of the RFC (it would be assigning semantics to the local-part).

Thank you. I misunderstood.

Doesn't that support what Google is doing? Google is the host specified in the domain, and they are interpreting the local-part to refer to the same mailbox if they only differ by dots.

The RFC also notes that the local-part MAY be case-sensitive (i.e. it's up to the host).

Edit: the host SHOULD ignore case: "a host that expects to receive mail SHOULD avoid defining mailboxes where [...] Local-part is case-sensitive".

It does. The relevant RFC says they don't have to matter and that senders shouldn't assume they do or don't. That means that both Google and Netflix are following the standard. The problem isn't with either company's compliance with the RFC, but that's not saying a lot. A mail provider could legally ignore all vowels in mailbox names.

(Similarly, although the RFC does say hosts shouldn't have case-sensitive local-parts, it doesn't say that senders can assume that local-parts are case-insensitive.)

By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox. When I read TFA my first thought was "what does the standard say about it" and it does sound like Netflix is the one making the wrong assumption here.

But I also see his point about how this can confuse users who don't realize this or are not using this behavior intentionally.

Yup. Since I run my own email server, I have 200 email addresses that are delivered to a single account. Some are service accounts (like postmaster@example.org) but a lot are single-use email accounts to track the selling of email addresses and spam.

> By that logic, jacksmith@example.com and johnjsmith@example.com could be delivered to the same mailbox.

They absolutely could. Netflix can't assume they are or they aren't. Which means Netflix is doing the correct thing here. All they can know is that the emails are potentially different and so they should treat them as different emails.

dots-don't-matter isn't sufficient to fix this issue - any other canonicalization issues would surfacea as the same problem. That might include casing, unicode issues, the `+irrelevantsuffix` stuff, and probably more, including perhaps any kind of aliases in the hostname.

The idea that you can tell whether two accounts are the same is questionable; netflix should not be relying on it.

Furthermore, the hack is possibly much less serious (but nonetheless conceivable) even without any canonicalization issues whatsoever. Apparently, a user can trick netflix into sending email to arbitrary email addresses. Sure, this is likely not to be an issue if the recipient doesn't have netflix in the first place - but if you try 1000 times (which spammers and phishers are wont to do) - you may well happen to hit a person that'll pay nonetheless - perhaps they forgot which email they used for netflix in the first place, or perhaps they share an email account, or perhaps the real owner is dead/on vacation/otherwise unavailable and somebody else is tending the account and thus more gullible than usual.

Netflix should never ask for money from random strangers without making 100% clear what the context of that request is.

(If indeed this article is accurate, because I wouldn't rule out the chance that the author made some oversight earlier).

I assume lots of emails get validated like this by people who doesn't know what they are doing.

Sad, really...

Absolutely. I don’t blame people who don’t interact with email for not reading the relevant RFCs, but not verifying control and expecting local part uniqueness to mean uniqueness of users is obviously busted to anyone who has worked with email. This is Netflix failing to understand part of their product surface.

Both the dot behavior and the even more common ‘+’ feature are perfectly spec compliant.

I was under the impression that literally anything goes on the left side of the @. It’s all up to the individual mail server

IIRC, not quite literally, but pretty close. The email RFCs in general tend to be much less constrained than one might expect.

Yup. Even spaces are allowed if you put double quotes around the local part: “Kevin Spacey”@example.com. It’s really surprising, there’s very little that can be verified if you strictly follow the RFC.

This is a common issue with text based formats and ietf/RFCs. HTTP allows comments in some headers. And allows line breaks:

  H: hi
    Mom

Is the same as

  H: hi Mom

Bets on how many http clients and servers get this right? Without losing speed?

My guess is when you're not responsible for ensuring compatibility or having to deal with writing robust, fast, code, the temptation to be cute with your format overtakes things.

I expect all commonly used HTTP clients (Chrome, Firefox, IE, even libcurl) and servers (Apache, Nginx, does IIS still exist?) get this right.

I, too, would expect that the most common pieces of software with massive amounts of engineering time invested get it right (but almost certainly with a performance hit). But I'd be unsurprised to find that one doesn't handle the http parsing spec correctly somewhere.

The issue is that such a spec is entirely unneeded and overly complicated. No benefit, only downsides. And for something as simple as basic parsing rules! Not even getting into anything that should be difficult.

And comments:

    Muhammad.(I am  the greatest) Ali @(the)Vegas.WBA

(an example lifted directly from RFC-822, apparently written by a madman in love with 70s parser theory).

> there’s very little that can be verified if you strictly follow the RFC.

That's not correct. You can reliably, completely validate all email addresses . . . by sending an email to them containing information that can be used to confirm the owner's identity. All together now: the MTA is the only source of "is it valid or not" for email addresses.

Even things at the right side of the @ are up to the E-Mail server. You can send an E-mail to @gmail.com or @GMAIL.COM and Google could be routing it differently.

It'll resolve the same in DNS, but what the user typed will be encoded in E-Mail headers, and you could route differently depending on whether it's upper-case, mixed-case or whatever.

Not true, domain part is case insensitive by the standard.

Server can decide for non-standard behavior, but that would be foolish.

The name part, per the standard, is case sensitive. However, some organizations I get email from canonicalize it to all caps - and one even removes the dots(!) and all-cap it, which for my gmail I have a filter that sends all non-dotted email to spam, since 90% of my spam is non-dotted. Since that particular email was important and I'd just happened to notice it in spam, I checked the capitalization change and called them and even managed to get through to speak with their email manager. He absolutely insisted I was wrong about it mattering and said they wouldn't change it.

Changing case could be a co's lazy way of checking for existing accounts. In a perfect world they would store the input as-is and also use a lower or upper func on the indexed col. I suppose if they are verifying emails with their users and not seeing a big drop-off in verified accounts, they probably don't care to be too exact. Removing dots from the user portion is pretty shitty though.

The domain being in any case for the purpose of delivery is part of the standard, but there's nothing I know if which would prohibit you from implementing local delivery and routing in any way you want once the mail is accepted.

You have no guarantee that the domain part case is preserved from what the user wrote, if it's not defined to be case-sensitive. So you can do what you want, but the input data are not reliable.

It really bothers me the number of web services which reject email addresses containing '+' in the local part.

If you're going to try to "validate" an email address, read the goddamn RFCs.

I like the idea of adding +spam@gmail.com, but it would be really easy for this to be invalidated by just stripping this from your email before selling it in a mailing list.

Instead of blacklisting the +spam@gmail.com email, you could whitelist emails like +netflix@gmail.com. You can create a filter so that if it doesn't match the whitelist - including stripping the plus - then it will be automatically binned.

I describe this technique in my blog post[0]. I'll warn everyone now though, you'll probably want an email address for real people that you trust (like +friends@gmail.com). Also, you'll rarely have to email companies, but it is a pain if you need to do it from the +plus email.

[0]: http://iamqasimk.com/2016/10/16/absolutely-zero-email-spam/

Thanks for sharing! You thought this one through more thoroughly than I have. And your closing line about it being impractical is unfortunately all too true.

>Also, you'll rarely have to email companies, but it is a pain if you need to do it from the +plus email.

This is absolutely true, and it's very painful. I sadly now recommend against using +plus addressing if there is a possibility you'll need to get in touch with support for a website for any reason, and I have a cautionary tale. So many websites have incredibly shitty "security features" and incredibly shitty code.

I had an account with a payment processing website with myname+website@mydomain.tld. They sent me an email requesting some additional info about a payment I was to receive in order for it to clear. I responded from myname@mydomain.tld. The automated system helpfully informed me that they can only accept email from the email in the account (argh). So I sigh, go over to the website, and change my email to myname@mydomain.tld. No luck---there's already an account with that email. OK, I might have created one before and don't remember. I try to login with this info, hoping I can delete that account, but can't seem to get the password right, and it's not saved anywhere. So I use the "Forgot Password" feature. Oops, it looks like I haven't finished the onboarding process with that account, and so I can't reset the password on it (who even thought of this?!). So I make an alias of website@mydomain.tld, change my email to that, and try responding from that alias. No luck. Turns out that you have to actually use the address they originally sent the email to. If you've changed it, oh, that's too bad---please open a support ticket with us.

It took around 7 days of back-and-forth and waiting for responses from support (lots of waiting!) to explain that I'm just trying to respond to an email they sent me, and a lot of canned responses from people completely misunderstanding what my problem is.

Would not recommend to anyone.

I recently decided to ditch Gmail because I don't trust Google any more than Facebook. One nice side effect of this is that now that I'm using my own domain, all company signups can be to me@spam.domain.com, which is much harder to filter well.

I use my own domain, but still use Google for my email service.

I've had fleeting thoughts of moving away, but am pretty used to the Google's spam filtering, labelling, search, and not having to care about space or managing my own kit.

Are you DIY'ing everything?

I delayed moving away for literally years for this reason, but in 2016 I finally made the jump to fastmail and it was much smoother than I thought it would be. I don’t get any more spam than I did with gmail. I still forward my gmail to my fastmail but typically when I get a forwarded mail I either cancel whatever subscription it is or update it’s email settings, so I get rather little forwarded now.

Like dkersten, I moved to Fastmail. I used to DIY it but got tired of maintenance.

Try using an email address with .wedding or .solutions TLD. Loads of absolutely brain-dead sites refuse to allow them, sometimes they validate by TLD length (all TLDs are 2 or 3 characters, apparently) or other times rejection TLDs they haven't whitelisted.

"(all TLDs are 2 or 3 characters, apparently)"

Which is odd, since there are some very, very old TLDs that are "long" ... I am thinking of .bitnet, .uucp and even the old .ussr[1] ...

[1] "Initially, before two-letter ccTLDs became standard, the Soviet Union was to receive a .ussr domain." (https://en.wikipedia.org/wiki/.su)

Those were never in widespread use in the email era. Anyone who knows about them is already technically sophisticated enough not to make this mistake.

One of the two reasons i changed my recipient_delimiter parameter to '.'

The other would be that spammers know that anything after a + is usually optional and strip it. Can't do that when the delimiter is a '.'

I do the same thing, for the same reason. I haven't A/B tested both options or anything, but I know I've gotten spam where they stripped the "+" parameter.

I also did that, but I made '_' work, too. Part of me wants to add 'x' as an alternative just for further obfuscation.

Someone definitely just copied a regex from StackOverflow (frankly if you actually look at the RFC a regex seems like a crazy approach).

No one's saying that they aren't spec compliant, the writer is complaining that google doesn't tell its users that their inbox will include emails for more than 1 address.

When I get an email to an address that isn't exactly the same as mine (e.g. due to extra dots in it), desktop gmail does actually show a small informational link next to the receiving address saying something along the lines of "yes, this really is you; click here to learn more". I haven't seen this on mobile, although I use the Inbox app, so it's possible that this it's there on the vanilla gmail app

Yeah they're both spec-compliant, but (IIRC, as of a few months ago), in gmail at least, there's a huge difference:

janedoe+acme@gmail.com resolves to janedoe@gmail.com, and the "+acme" is simply a useful bit of metadata for Jane to track the provenance of the sender's mailing list. the "+" and anything following it are ignored. It signifies an optional suffix.

Whereas janedoe.acme@gmail.com resolves to janedoeacme@gmail.com -- a completely different address than janedoe@gmail.com. The "." is simply ignored as if it weren't there, making j.anedoeacme and jane.doeacme and janedoe.acme equivalent.

Yeah this is specific to how gmail chooses to handle these spec-compliant-though-often-mishandled characters, but anyone who works with email professionally absolutely has to come to terms with how gmail works.

What great timing -- I've been fighting Uber on this very issue as of last night: https://twitter.com/mholt6/status/982414407941611520

completely agree, I've a rather common name with a corresponding gmail, it's absolutely shocking how little validation major Airlines do around emails!

Yep. Bug is the ability for users to charge a credit card before verifying email.

Or did the victim in this blogpost also verify their email at some point?

Netflix could be forgiven for thinking that updating payment details via email = verifying email. But if the victim had to respond to two emails, the first of which is a “verify email for your new account,” the phishing would be less believable.

Ultimately, the viability of a phishing scheme depends on the plausibility of receiving an email from a source. In this case, Netflix does send emails about updating your card details when a subscription charge fails, so plausibility of receiving the email from Netflix is high.

Another symptom that this is a bug with Netflix is that they granted the ability for one user to trigger a crafted email to another user.

The standard email verification patterns rely on the user clicking a link. I am not sure how that would have helped here.

Making users retype the email (instead of merely click on a link) might be better for exposing scams but requires more work on the user’s part.

Ultimately the bug relies on how believable the emails from Netflix are. If I got an email from Netflix asking me to update card details, I wouldn’t be surprised because maybe my card expired. But if I got an email asking to verify my new account, I would be very surprised. I didn’t sign up for a new Netflix account. If after that, I got an email to update my card details, I would be alarmed because of the recent unexpected signup email.

Yes, I've received emails of the form, "You recently signed up on our website for Fooflix, please confirm by clicking here. If you did not recently sign up, please disregard this email. Anyway, now that this is a known problem, both Netflix and Gmail should take reasonable steps to mitigate.

Maybe some middle road:

+ Netflix can send an email about optionally(!) confirming a user's address.

+ Now, rather than disabling all features and slowing down on-boarding it is possible to update the communication towards unregistered users.

+ If an email has to be sent to an unconfirmed address, preceed it with a warning. If pietjepuk@gmail.com has been confirmed, but pietje.puk@gmail.com not, emails for the latter will have this warning automatically.

+ Remaining option: do you want to send regular safety requests to unconfirmed addresses as provider? Policy might differ. However, it is possible to use this email to tell the user about safety/security w.r.t. your system. I'd say yes.

Why can't it be both sides' issue? I have a fairly uncommon first and last name, but I still get emails from the few folk who share my name combination, and I too have gotten sensitive information that I shouldn't have.

I cannot imagine the strangeness that must occur for folks with more common name combinations, and the idea that e.mail@gmail.com is the same as email@gmail.com just seems wrong to me. As far as I know, all other email services and providers treat such accounts as unique, and it's a strange situation with very limited benefit to the end user. While I have made use of "the dots don't matter", it's always been as a way of circumventing account restrictions. The casual convenience of "dots not mattering" seems like it's overshadowed by the difficulty this can cause (as evidenced with the article and my own experience)

Permitting separate "sarah.jones" and "sarahjones" accounts would be pretty bad, too. Too easy to impersonate people. "Dots matter but are not included in uniqueness checks" is probably the safest approach.

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address.

However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person.

In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address).

Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.

To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.

Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them.

This on service providers to implement secure access properly.

I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.

Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution.

You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

> You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak.

> I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness?

You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.

> Why can't it be both sides' issue?

Even if Google didn't provide this feature to their users (and it is a feature that I regularly use to track who leaks my email address and then auto block emails to that address), Netflix's approach of sending sensitive emails without verifying the email address is still prone to security problems. Many people have multiple email accounts, or aren't really aware which email account they used to sign up. Sending a "please update your billing info" without verifying the email account first is purely on Netflix.

If you have a bug in a system, do you fix it at the source, or do you fix it at all the leaves? Netflix might be wrong here, but fixing it at Netflix doesn't make the problem go away. Fix the problem once (GMail) and never ever have to deal with it again.

But you can’t put the cat back in the bag. People have used the system to sign up for multiple emails at multiple sites, expecting them to go to the same inbox.

I suppose you could solve the problem by grandfathering all existing aliases and whitelisting delivery of only those that received at least one email before the policy change. And also continuing to forbid registration of any aliases.

I'm (naively?) hoping that Google doesn't know which aliases received at least one email.

Of course they know. They delivered the emails to the aliases, which are permanently in the To: field of the metadata. As long as you can see the email “to” address in the gmail web interface, so can Google.

What about emails that were deleted?

Do you mean emails marked as deleted with timestamp?

They weren't deleted

There is no bug in Gmail. This bug has nothing to do with Gmail, it is with Netflix not clearly communicating when verifying the address a user claims to own.

The bug is in humans. Heck, I regularly come across people who think the case in an email address matters! While there is no bug in Gmail, that is irrelevant because you have to deal with the reality of how people use your product. Its basic engineering. Standards are simply a means for interoperability. In this case, the dots don't matter much for that goal.

The case in an email address does matter. Look it up.

RFC-5322 (the current standard for Internet Message Formats) in section 3.4.1 states, "... how address is used and how messages are transported to a particular host is covered in separate documents, such as [RFC5321]."

RFC-5321 states in section 2.3.11: ''The standard mailbox naming convention is defined to be "local-part@domain"; contemporary usage permits a much broader set of applications than simple "user names". Consequently, and due to a long history of problems when intermediate hosts have attempted to optimize transport by modifying them, the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address.'

Furthermore, it states in section 2.4: 'The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. In particular, for some hosts, the user "smith" is different from the user "Smith". However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged. Mailbox domains follow normal DNS rules and are hence not case sensitive.'

While you are pedantically correct, to me that reads, "don't try to change the case of the local portion of email addresses and apply no meaning to it." In other words, treat it "as-is" and assume nothing about it.

Where does it matter? Can you give an example?

If I send an email to John@company.com instead of john@company.com and the server of company.com is configured to be case sensitive, then john will never see my email.

It is allowed to matter per the rfc. However I believe 99% of all mail servers in the world are configured to make it non case sensitive.

>It is allowed to matter

And we don't know when it will matter and when it won't matter, therefore we have to assume that it does matter unless we are sure it doesn't for our specific case.

I see, so not relevant in the real world. Thanks!

Please don't be rude on HN.

https://news.ycombinator.com/newsguidelines.html

I wasn't trying to be. I was mildly annoyed that this person was being needlessly pendantic about an irrelevant point that doesn't matter in any way whatsoever in the real world. They failed to give an example that matters.

While I agree with you from a technical perspective, Netflix isn't going to be the only one with this particular issue. If you addressed the issue at gmail, you can be sure you've fixed it for all the little leaves.

The problem with this reasoning is that doing away with the "dots don't matter" policy would not fix the more general issue of e-mail aliasing. Besides variations in dots, there are also "+labels" (which Netflix must also consider a valid and necessary part of the e-mail address, per the RFCs) and the fact that for every "xyz@gmail.com" address there is an equivalent "xyz@googlemail.com" address. Unlike "dots don't matter", labels are a useful and well-liked feature, supported by many mail servers (though not always using "+" as the delimiter). Removing them would be an extremely unpopular move on Google's part.

No account-related emails (other than e-mail validation) should be sent to the e-mail address on file until it has been validated. Period.

The verification email too is a phishing attempt, as it gets delivered to wrong person. All it takes is just a click.

The verification e-mail is going to say something like "Please verify this e-mail address for your new Netflix account", which is going to look very suspicious to anyone who didn't just sign up for an account. As phishing attempts go, this is not likely to be very effective. It's not nearly as bad as skipping right to the part where they ask for updated payment information (with a pre-authenticated link!)—someone who has a Netflix account, and perhaps a credit card which recently expired, has no reason to suspect such a request, and most likely would not notice that the e-mail address the notice was sent to does not match the one they used when setting up their own account.

I had a similar issue with Sony/PSN recently. Someone had registered their account and even though I received a validation email I didn't click the link. I then got a welcome-to email a few days later.

PSN's emails don't have a "This is the wrong email" link like some services do, and the US support page link geo redirects to a UK 404 page. I had to go googling for an email address to complain to in order to remedy this.

I see a lot of claims that email addresses should be verified prior to a transactional email being delivered - that that’s the “norm” or stupidly obvious way.

But when there is a real consequence on a conversion funnel for requiring email address verification (say ecommerce), I imagine the obvious business decision is to do the exact opposite.

It's about risk management. In this case they decided to take on the risk of account information leaking by not verifying the address instead of the risk to account conversions. The former shows more care toward their users and the latter shows more care to their bottom line. You can argue which is the right decision all day long but ultimately is a question of risk tolerance.

What's the point of a conversion funnel that creates exactly one conversion and then a huge amount of customer grief when they can never use the account again?

If the email address matters then validate it, if it doesn't need to be validated then don't ask for it.

I don’t understand what you mean by a “CF that creates exactly one conversion”.

Anyways, your response isn’t relevant in that I’m not suggesting an email address should (not) be verified. Rather, we’re discussing whether verifying identity needs to come before or after (or alongside) the transactional email - e.g. a receipt of purchase.

At the same time, validation and verification are not the same thing - and sometimes it’s not necessary to perform address/identity verification.

This has happened to me with quite a few websites (netflix, nytimes, dropbox, and many smaller more localised websites for small businesses / services): people somehow seem to have registered and/or added payment details with an email address they don't own.

What you say can be applicable for subscription billing. But there are hundreds of other sites and apps where you can "checkout" stuff without needing to register, which is also a welcome/better feature. And yes, they do notify when a transaction failed.

You cannot ask a whole ecosystem to change because of a feature/flaw on a central vendor. Where will you start? Force people to create accounts and verify emails when buying a one-off train ticket or ordering a pizza? What if people/market don't want this registration/activation crap for doing small utility stuff? For a payment, I have to authenticate with my payment provider, not to my email vendor. And payment providers do have delayed reconciliation issues that are sometimes notified back. And where would you stop? Validate each and every piece of info the user provides? Send a SMS verification code to the phone for same utility bill?

The conclusion is correct: Fix the vendor. I asked for a specific email address when I signed up. Similarly I should get emails only for "dots" that I have specifically opted in to. Deny receiving the email, show me a warning, don't allow it until I opt in. Anything else is just asking for trouble.

>This is Netflix's issue for not validating the email account.

Eeeh, I just re-read RFC 2822. It explicitly states that the local-part of an address may contain any number of dots as long as they are separated by (if I'm reading this correctly) at least one character, and do not start with a dot.

There's nothing in there that states you should treat dotted and undotted variants of an address as the same address.

So, google isn't violating the specification, but they are extending it in an unexpected way. Google could extend it further by implementing a "giraffes don't matter" policy where any instances of the word "giraffe" are recursively snipped out, so that "test@example.com" is the same as "tegirgiraffeaffest@example.com", but if they did it would be a bit rich for them to expect the rest of the world to adapt code to that decision.

It might be reasonable for google to expect others to handle this "dots dont matter" policy if it was some kind of defacto standard, but AFAIK it's not. I would argue that this form of attack is uniquely enabled by the gmail devs making a decision to add additional behavior to an otherwise well-understood spec, and that it's not netflixes problem to solve that.

To be frank, netflix can't solve it. Asking netflix to change their code will only solve it for netflix, gmail users will still be "at risk" from, you know, potentially literally every other domain on the internet.

So I would say that this is a risk that gmail users need to be aware of and mitigate themselves, perhaps by taking such drastic steps as reading their bills before paying them.

There is no bug in Gmail. The bug is that the vendor is sending unclear email contents.

The spec say that the server can alias valid addresses as much as they like and the sender should not assume any form of aliasing.

Netflix second guessing the aliasing pattern is the bug

I agree, the responsiblity for this flaw ultimately lies with netflix. And if laying blame is a helpful thing to do, the blame lies with netflix.

But at the same time, in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.

> the responsiblity for this flaw ultimately lies with netflix

Indeed. You should always validate emails for accounts.

The amount of accounts I “have” and can’t cancel because of sites not doing any email-ownership validation is quite annoying.

> in a purely practical sense the mockup at the end of the article showing an explicit warning about email being sent to a non-canonical address is clearly excellent and should be implemented.

Gmail is doing something very nonstandard here and it’s absolutely their responsibility to inform users why they are getting emails on addresses (most?) users would never know about nor use.

I’d even say that having this feature on with infinite whitelisting by default is a security issue which should be resolved.

Preferably by only allowing explicitly whitelisted entries created by (the few) power users using this feature.

I have the same problem with Netflix, Uber and other sites. They simply do not check the email. It's an absurd. And the biggest problem is that the person who mistakenly uses my email asks a hundred times to reset MY password. Gmail and these sites need to take this issue more seriously.

Absolutely. Netflix is using ID created by some other service as their ID without verifying with the other service if the ID in question belongs to the user who is claiming it's theirs. There needs to be a 2nd factor to confirm whether an ID belongs to someone - password/confirmation/code/pin which Netflix doesn't use here at all.

Not only that, but apparently he was able to change Eve's account details without having to enter a password.

If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his.

All around very bad security design on Netflix's part.

He said in the post that he was able to reset the password because the account was linked to "his" email.

But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account.

For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.

you still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?

In that case, he must have been logged into Eve's account before he received the email. How did that happen?

The parent comment means the scammer case who can set the password back because they are still logged in. Which might be feasible.

But I don't think a scam that relies on you resetting the password and not becoming suspicious is a bit of a stretch.

Fully agree. All authentication operations should always be completely explicit and clearly display the identity you are authenticating to. An email link implicitly logging you in looks like completely unacceptable. The email to recover your password can be excepted, because it is clearly an authentication-related thing and maintain the invariant that at most one person is actually able to log in.

I think this is the bingo. The scam doesn't work if you don't treat "access to email" as the sole authentication mechanism.

This gives the excuse for companies to request phone numbers. What if I don't have a phone (I am frequently without mobile phone access due to some personal circumstances recently, and it's a massive butt pain).

Totally... different services provide different ways to have multiple addresseses. The article already mentions one (plus addressing), but there are also others (like FastMail's subdomain addressing)[1]. And many people have catchall or misspelling addresses on their own domain.

That said, I dislike Gmail's "the dots don't matter" since it really screws up calendar invitation handling, because calendars don't handle aliases well.

[1] https://www.fastmail.com/help/receive/addressing.html

Absolutely - his proposed solution - disabling the dots-dont-matter feature and retiring them does nothing to stop this exact same attack vector instead employing the '+' feature that he admires and wishes to retain.

The attack goes like this:

* Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.

* Eve creates a Netflix account with address jameshfisher+netflix

* Sign up for free trial with a throwaway card number.

* After Netflix applies the “active card check”, Eve cancels the card.

* Wait for Netflix to bill the cancelled card. Then Netflix emails jameshfisher+netflix, going to jameshfisher's inbox, asking for a valid card.

* Hope Jim reads the email to jameshfisher+netflix, assumes it’s for his Netflix account backed by jameshfisher, then (follows a link in the email and) enters his card 1234.

* Eve changes the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account.

* Use Netflix free forever with Jim’s card 1234!

Either they're both security liabilities, and they should both be removed, or the problem lies elsewhere.

Moreover some broken email validators reject plus addresses. It's nice to be able to fall back on special dot combos when you want to keep track of sites selling your email to spammers.

Spammers already know the dot rules. Its fairly easy to identify a Domain Group (ymail/yahoo) or (google/gmail/somewhere.edu) and then strip and reapply certain rules based on what that Mail Provider allows.

That's true in theory. In practice however, I've had success with figuring out a service that leaked my dotted address (I used a dot because the service didn't validate email with plus). I think this is often the case too because, spammers don't really bother validating emails by postprocessing etc. and just sell the emails in bulk in shady markets

Thank you.. I use this feature in exactly the same way. As I read,I was sitting there thinking "I can't possibly be the only one who knows about,uses,and likes this feature". Disabling it at this point would seriously screw up my life. It also prevents people from registering all of those close variations of my gmail address, which I also like.

I used to use + for that purpose and was always pretty annoyed when a website wouldn’t accept it. I’ve since dropped gmail for fastmail though so now I use sitename@sites.mydomain for all website registrations. No site ever rejects it and it works great for knowing where spam comes from, although I’ve had some funny phone calls where people were baffled that my email address starts with their website name.

> No site ever rejects it

Have you ever tried it on Yahoo? They wouldn't let me set my email address to yahoo@mydomain a few years ago, claiming that the "email owner" had blocked this: https://www.dropbox.com/s/t213wkajdz5753k/yahoolies.png?dl=0

Perhaps Netflix people are to blame for taking +tagged mail addresses as different than the ones that are not tagged. It is a well-acknowledged [1] and commonly offered feature by the email providers that should have been accounted for.

Dots-don't-matter, on the other hand, is very specific to Google, and they simply do matter in many other (if not all other) email providers. I think Netflix shouldn't be blamed for not accounting for provider-specific, non-standard equivalences.

Email address verification alone doesn't seem to fix all the erroneous aspects of this issue: Let's say Netflix was requesting verification, and then you receive the email for the +tagged mail address. Shouldn't it say that you already own a Netflix account, instead of asking for a verification at that point?

[1] https://tools.ietf.org/html/rfc5233

I'd hate it if websites started implementing that, I like being able to register to the same site with the same email multiple times.

Yeah I do it all the time

The + thing is common but is absolutely not universal. I can alias individual + emails on my system just fine (which means that x+a@example.com and x+b@example.com are not equivalent) and most smtp servers allow you to set an alternate character (I set it to '.' and '_' so x.a@example.com and x_b@example.com are aliased together).

In short, Netflix cannot assume things after the '+' are irrelevant and Netflix absolutely cannot canonicalize random emails like that.

All of this would be still useless regarding the proposed attack concept, because eve@gmail.com is also eve@googlemail.com.

And domain aliasing is certainly out of scope of any email RFCs I saw. Netflix (and everyone else) may know about googlemail.com, but it's virtually impossible to know about all other cases.

> Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.

The bug is right here - you shouldn't be able to determine if a user account already exists.

If an account already exists:

- Logon shouldn't tell you that you have an account and the password was wrong

- Registration should send a "looks like you already have an account" email to the recipient with "maybe this wasn't you" warning, and the web form shouldn't indicate anything out of the ordinary.

- Password reset should say "if an account exists, we just sent it an email"

Fair warning. That does add a certain level (quite significant) of inconvenience to existing users though. But probably a happy trade-off for most people entrusted with protecting accounts.

Agree that many steps can be improved. In real live, though, it's not so difficult to guess/find someone who has Netflix, and also find their email. That's a really weak security requirement, security shouldn't depend at all on that part (it seems more relevant for privacy to me)

Further, it is trivial to picture an attack where through some other channel, the attacker already knows the email address of their target, and has the knowledge that this victim has a netflix account.

If I only need these two pieces of information, neither of which is intended to be 'secret', then I might easily already have enough information to attempt this attack on (for example) my ex, or their new partner, or someone at either work or university that I dislike, even if I didn't have enough information to target a random person in another country.

It is good practice not to expose user's email addresses to attackers. It is breathtakingly bad practice to depend on those email addresses being secret.

I really don't see why Netflix needs insider knowledge or whatever to be able to detect john.doe as being the same as johndoe.

I believe it’s because this feature is largely unique to Gmail? So Netflix would need to know and maintain a database of rules based on domains.

* Gmail: Dots are cool.

* Hotmail: No capes! I mean dots. No dots!

* Multiplied by 8 hundred gazillion domains...

You’re thinking too much like a programmer. It’s a single rule for a single domain that accounts for the majority of users.

The right thing to do is ask for a password, but absent that, accounting for gmail addresses seems worthwhile. It would save them getting a thread like this on hn.

No database needed, just ask for e-mail validation by sending an account validation link to the e-mail. Problem mostly solved.

> the web form shouldn't indicate anything out of the ordinary

How will the user know that the registration failed and what to do about it?

Upon entering a valid email (whether it is already registered or not) the form will show the following notification "an email was sent to user@email.com with the sign up instructions, please follow the link in the email to continue the registration" (rewrite for more concise message)

If the user already exists the email will be a warning + a link to the password reset form

If the user does not exist, the email will be a link that confirms the ownership of the email address and the rest of the registration process.

An attacker trying to guess if an email is registered would not know, because the form does not give away that info.

Got it.

Why is it bad to know if an email is already registered?

because if you know someone's email address you have now also discovered that they have an account with a particular service which you should not be able to do.

Furthermore, people reuse passwords. So of course there are a number of known-good login/password combination lists in the wild.

As soon as you find a valid login, you can test all known passwords (plus variations) associated with it.

Can’t you do this anyway on the service? You are assuming there is no rate limiting and the passwords are used directly as bearer tokens to access the site.

But since you are giving advice to the DESIGNER of the site, why not simply tell them not to use passwords? https://qbix.com/blog for example

It's not, necessarily.

It's a tradeoff between usability and security, and each site should make their own decision about what is right for them.

It obviously makes attacks like the one in the article easier, but there are other ways to mitigate that.

An example often given for when revealing an email is registered would definitely be bad is dating website and pornography websites - where identifying someone is a member alone could be embarrassing or compromising.

Outside of such scenarios, websites may decide the increased conversion from a more streamlined registration process and lower numbers of support requests for login issues outweigh the marginal security gains from hiding that information.

And conversion drops right away. On every of my projects as soon as "auto sign in" was dropped -- conversion dropped as well. (assuming that the "conversion" is to make a user to register and do something afterwards)

I know that there should be some kind of compromise since any security measure added to secure accounts will lead to some inconvenience for users.

If your goal to make sign in process as smooth for users as possible you may want introduce as little steps as possible between their landing on a page and "purchase".

But verification of email address should be kind of mandatory and happen before something important will be sent to this email.

Many sites allow you to continue, but limit your account and nag you about verifying your email. This seems like more of a happy medium, if you're concerned about conversion.

> Registration should send a "looks like you already have an account" email to the recipient with "maybe this wasn't you" warning, and the web form shouldn't indicate anything out of the ordinary.

Well that wont work. If you can't register with an email it's obviously because an account has already taken it.

The difference is that the dot behavior is non-standard, the plus behavior is standard.

That's incorrect. The validity of accepting the '+' character as part of an email address is part of the standard (-though it is a standard ignored by many prominent websites, aliexpress is just one example I believe)

The acceptibility of the '+' character is specified in RFC 5322 [1].

However, the behaviour where an address comprised of:

local-part "+" some-suffix "@" domain

is automatically routed to the address: local-part "@" domain

it certainly not part of the standard. I find it very useful myself and would be displeased to see that functionality removed, yet this is certainly not part of the standard.

[1] https://tools.ietf.org/html/rfc5322#section-3.2.3

I don't understand - won't this process fail when the person signs up for "jameshfisher+netflix@gmail.com"? Netflix will send a confirmation email to the real jameshfisher@gmail.com, and not confirm it, and so Netflix won't create the account. Things stop at this point.

Yep, but it's still a misfeature.

I set up a firstname.lastname account for someone. On other services (e.g. iTunes) they've used that combo with and without dots.

It's a nightmare trying to help them with password resets. They're not an internet-savvy individual.

Gmail can't cure stupid.

These companies are stupid and not worthy of respect. Not only Netflix, but Apple and even some banks don't (or didn't) verify email before sending private information.

Eh, but consider online shopping carts. I go to some ecommerce site, enter in my email to buy something. If I have to verify the email first, conversion rates will plummet. Instead, (and this is what we do at my company), we attempt to validate that the email is a real one with MX lookups and even SMTP checks. But otherwise, you just have to trust the shopper.

Still... I get so many other people's email because of this dot's don't matter feature it's very frustrating!

For example I'm regularly cc'd on a list of a South African film production company.

I often get invites to parties from a group of students in Georgia.

And, someone seems to use a dot alternative of my name to buy sex toys! And that is just a few!

I used to send back the emails saying "Hey you go the wrong person" until I realized it has no effect on these types of group emails.

Not because dots don't matter. That's unrelated. It's because people don't know or lie about their own email address.

And if they do require a verify, they should make it obvious that it was user initiated just then. Otherwise it could be the same scam: Eve creates an account. James gets the email. "Hmm that's funny. Okay I'll verify again".

EmIl address is an identity. The core philosophical issue here is that an identity provider assigns you bucket of identities without your knowledge. Now others who do have knowledge of your assigned identities can take advantage to impersonate you. The idea that it can be resolved by email verification does not hold well because in several circumstances it might not be possible (for example, you need to create your account at the PoS). It’s a bug indeed if you think of email address as identity. It’s unrealistic expectation that all non-technical users should be aware about this feature as well as that all login system must use email verification.

The solution is simple: email provider should let user create additional identities with their knowledge. That is by default dot feature is not enabled but user should be able to go in and create alternative identities that they want explicitly.

Agree, this said the "dot don't matter" is also an awful thing. I'd rather have gmail create a real alias system instead of this hack. That's the thing that is good with Yahoo.mail, it has real alias system.

Why is it awful?

I get these types of things nearly daily since everyone mistakenly assumes they have my gmail account, single first initial and common last name. Many services don't require you to confirm e-mails, this is the problem. My apple ID account was created by someone else and they set the security questions and if you "forget" all the answers you cannot reset them online!

Only services I've seen that handled this properly are gmail and snapchat which send a verification e-mail to the entered address (for gmail its the secondary) and there is a link that you can click indicating your e-mail should not be associated with this account.

although this is Netflix's fault, gmail should have an account feature to toggle "dots don't matter" on and off.

That was exactly my reaction after reading the first few paragraphs. “How did Eve circumvent the email verification step?”

Netflix should totally fix this, even my local public library asks for email verification after signing up.

I really wish this was the norm!

I have a very common name and signed up for gmail address right at the start. I now receive tons of spam because there are people who sign up to the weirdest things with my gmail handle.

I have multiple "e-mail doppelgangers" - confused people who don't know their own email address and so accidentally use my address when they register stuff.

One's in Chile. I have almost no knowledge of Spanish. The other is in California.

Having experienced this:

Services need to email new email accounts they become aware of ASAP. They have literally zero UI available to me to notify them that this is an invalid email address. The very first interaction when a user registers an account with their email on the service needs to be "Welcome username to MyCompany.com! If you didn't create an account with MyCompany, click here to let us know and we'll remove the email address from this user's account!"

If Netflix does not do this, Netflix is doing it wrong. It also would solve your security issue - by immediately notifying the address that a new account has been created on them, it notifies the user to expect additional emails and allows them to take action immediately.

This also prevents another problem: What happens if somebody has already accidentally claimed my email address on a service I want to join? If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

I have this problem a lot as well. There was someone with my name with a Bank of America account that regularly bounced checks, and BoA provided no way to disassociate my email address from the account.

These days I'll flag any email from a service as spam, no matter how well known, if there was no email verification step.

Yup. I had some guy's credit card bills appearing. It was actually super weird - somehow Google had metadata about the credit card bill that was not in the body of the email, so I'd get "reminders" on Google Now saying "pay $1200 to Notyourbank by the 1st of Octember", but I couldn't actually see that bill without logging in (which, obviously, I could not and did not try to).

Btw that meta data I believe it's in the body of the email. Hidden with some html tags that Google tells companies to use so they can do those things. Inspect the source of the html of the body and see if you can find it there.

I actually have dots in my Netflix account email address because somebody who wasn't me had previously started to register for Netflix using my email address.

I have had to do this with some other services as well. Some services won't allow the + in gmail addresses, which is pretty annoying.

If a service starts recognising the dots don't matter and denying the plus symbol, there's a good chance I won't be able to register without obtaining a new email address.

I wouldn't mind but my name is really not that common -- my surname is uncommon enough for me not to have met another with that surname outside my family.

Yeah, that. While the dots may present a marginal security risk, they provide a useful workaround for sites that fail to allow the owner of an email address to remove their address from another user's account.

Why can't you claim the original accounts?

The thought did cross my mind. But there's something that feels weird about claiming an account that I never set up, especially where it's not clear if the service allows payment or usage with an unverified email address.

I personally don't believe the penalty for putting my email address in instead of yours (which could be very close) should be complete account hijack. Instead, I usually just filter the messages to trash.

I would much prefer to be able to click a link saying "I didn't expect this email." Very few services actually do this.

There will be some people who read the OP and see treating dots in email addresses where dots don't matter as another thing on their todo list for a signup form.

A more considered approach would be to think about how you handle emails. A lot of the time the email is the most important thing -- access to the email address is often the only credential you need to get into the account, so you want it to be correct before anybody spends time entering details.

You can make sure there are no mistakes by giving users a link to click within a window of time (e.g. 7 days), before they can enter any data associated with that account. Provide a link that says "nothing to do with me." Do not count the account as real until the link has been visited.

In the case of the linked article, Netflix asking for billing information before confirmation of email address is a clear example of a threat vector that has far more to do with Netflix prematurely pestering for payment than it does with Gmail aliasing email addresses.

Yep, same here. I've got a "DJ" in the US, but also a guy in India. The Indian guy is always getting legal threats for not paying his phone bill.. I feel a bit bad that he's not even getting the emails, but I have no idea how to actually contact either of these people...

Reply to the sender then, saying they have the wrong email account. That's what I do and over time it cuts down on the incorrect email I get.

Half the time these emails come from donotreply@domain.tld

I have the same issue, except I have a 6 character nickname using 3 unique characters at gmail and people use it for all sorts. Games, flights, utility bills, shopping sites, phone contracts, dating sites and much more. From all over the world. I had someone else's dropbox too, and even after the continued warnings they would cancel it and had cancelled it there were messages to access it still, that it was still there with the ability to view data.

The strangest by far though is the huge amount of gmail accounts created with my email as the backup. I have to assume that wording on some localisations indicate you need one so they mash the keys and pop in my gmail.

So I have hundreds of security alerts for recovery and notifications it has been set.

Funny old world.

Same here. I have a six character gmail address which includes a common name, and I get an average of between one and two misdirected emails a day, sometimes more. Stuff from all over the world, signup emails, invoices, love letters, confidential documents, etc. Mostly the non-dot version, but sometimes a version with one dot. It's infuriating, but I couldn't possibly change my email address at this point; it's tied to hundreds of accounts :(

Same with me, I have someone who is in the US (I'm in the UK) who has registered for a university and attempted to buy a car using my email address.

They must be fairly disorganised as I keep getting emails about overdue library fees. No matter how many times I email these places, they never remove the email from their system. I'm hoping GDPR might give me a hand with that, though I'm doubtful if they're places like a US University.

Email validation is a must for all services, people make mistakes and clearly some people don't even know their own email address. This is a problem with both Google and Netflix. Netflix are being negligent and Google should retire this feature.

I have a very short email address and get lots of these. What I do is immediately log in to the service and change the password. Then, if possible, I log out any other devices that are logged in.

Then they can never access the account and continue to to use the service.

Where available, I will delete the account as well.

I found that if I don't do this, then I am just going to be receiving notification emails forever from that account.

If this was me and it was happening often enough to be such a nuisance I had to hijack people’s accounts, I’d just get a different email.

Mind you, I’m saying you should have to give up your email because other people have trouble spelling, just stating how I’d handle it.

I've had my gmail address for 14 years now (to the day actually). There is no way I'd give it up because of some morons.

I have a few.

On in New York used by to confirm a doctors appointment (with some information on their condition). They also gave my address to their broker who sent an account summary. Bond portfolio in the millions.

Some lunch delivery server in Mumbai sends sends out emails to the address provided with no option for me to remove my address.

Another one or two in the UK who put me down for random stuff.

I just got one for a hotel booking. Google usefully added it to my calendar.

"My" X-Box live account seems to have gone.

I did enjoy repeatedly rejecting "parental" permission for some kid to join Club Penguin though.

It's funny, saying "email doppelgangers" reminded me that I have the same issue with phones and physical addresses (but not email since I use a unique domain name).

I get multiple snail mail bills for DirecTv to people with different names but my address. One of them apparently didn't pay, so now I'm also getting collections letters addressed to them at my address.

I've also had someone in Oregon use my google voice number at some doctor's clinic, so I was getting voice mail transcriptions about appointments and certain tests that needed to be run.

Turns out lots of people just can't figure out their own unique ids, whether they're email, phone, or home address.

> If you don't provide a way in the emails to say "that's not me", then I have no way to ever register for your service with my address.

This happened to me - someone registered an Uber account with my email address. So I password reset it and now I have an Uber account for no good reason.

One of my emails is a "one name" gmail address so I get a few of these fairly often. I've tried doing the good thing where possible and trying to get it changed by contacting the provider but I just gave up. If I get more than a couple of emails from any account, I just hijack it permanently; I've found that deleting the account will only lead to the offender recreating it.

I have the same issue, but Uber has 2FA on the account through SMS. This way I can't login to cancel the account, and there is no 'unsubscribe here' link in the emails.

Also had someone use my email to sign up to an airline. After messing with the seat assignment and meal selection a few times it became old and customer service didnt know what to do, so I changed the associated email to 'helpdesk@airline.com'

Even funnier was how a gameshop website that I did have an account with actually changed my password and account details to be assigned to someone in another country. No notifications etc... So now there are a bunch of trade-in credits on my account, after changing it back to my own details.

I don’t get the argument that the email dots stripping should be removed but the “+” tag feature should be kept.

Both of them allow infinite email addresses. The tag feature is not always available because app developers frequently don’t allow the plus character.

I would prefer that (1) a Netflix require email verification and (2) GMail describe in detail all of the email address features so app developers can explore the security issues around them.

I used to work for a company that dealt with these issues almost 10 years ago. It was also fun when Hotmail and Yahoo started recycling unused email addresses after ~6 months.

> The tag feature is not always available because app developers frequently don’t allow the plus characte

Should we stop using a feature because some buggy apps don’t support it?

This is why, on my semi-personal (<10 users) email server I process several different characters as tagging characters: dot, dash, underscore, and plus IIRC.

I use a subdomain as catch-all; *@something.example.com all goes to one folder. That way it's impossible for the spammers to know that this is a "sorted" e-mail address since lots of people have e-mail addresses under a subdomain and it's not trivial to filter out like myrealidentity+youareaspammer@example.com turning into myrealidentity@example.com.

Other users on my setup can use it, they just have to pick a different "something" if they want to use the same example.com as me.

My understanding is + sign is in the RFC, so of course it should be supported. If you want to identify your users by email, you should probably strip the + and everything after before checking for uniqueness. On the other hand, dots matter in the RFC and Gmail is breaking it with their "feature".

edit: I was corrected in other comments that the + labeling is optional part of the standard.

> I was corrected in other comments that the + labeling is optional part of the standard.

Allowing + in emails is not an optional part of the standard.

> you should probably strip the + and everything after before checking for uniqueness.

No, you shouldn't. Different email providers use different characters to allow "subaddressing" or "tagging" and the presence of those characters doesn't mean that any subaddressing will be done.

https://en.wikipedia.org/wiki/Email_address#Subaddressing

Gmail isn't breaking anything. It's none of Netflix's business that Gmail gives its users aliases. This issue has nothing to do with dots, and everything to do with Netflix sending bills to unverified email addresses.

As far as I can tell it isn't in the standard at all, optional or otherwise (although the character '+' is allowable). Gmail are not the only ones to implement this feature though.

Also, you'll have to elaborate on how the dot usage actually breaks the RFC. I assume it states that dots are just like any other allowable character, but that's not the same as actually breaking the RFC.

I must be missing something but the + and . feature both have the same problem for this "scam", right?

Right. Which is exactly what the GP said.

a dot looks way less suspicious to a non-technical user. a plus is more jarring, and more likely to incite suspicion.

I'd say most "non-technical" users dont even look at the email address it was sent to. They just assume that since it landed in their inbox, the magic 'computer' knows what its doing and they just need to read their email and reply appropriately.

> The dots do matter: how to scam a Gmail user

The dots do not matter, this does not enable a scam, and 99% of people replying to this seem to have utterly missed the point.

First off, let's be clear: The story is about someone who entered the wrong email. They should have entered "eve@foo.com" but actually entered (or later changed it to) "james@foo.com", which means that James got some emails from Netflix about Eve's account, incorrectly assumed they were about his account, reset the password on Eve's account, and came close to entering payment information into it.

All of which is fine; this is how email works, and how modern services (correctly) use email: By identifying an account with an email address, and assuming that if you have control of the email address you should have control of the associated accounts.

The author is weirdly focused on the fact that gmail allows some flexibility in how the local part of the address is interpreted, but this is a feature of most email providers (yahoo, outlook.com, protonmail, and fastmail all do it), and is a feature offered by qmail, courier, and postix as well. It's also explicitly required by the relevant RFCs. And...

...it's utterly unrelated to the issue at hand. This isn't about how the local part is interpreted; it's about someone typing the wrong address that they don't control when they sign up for an account. Sub-addressing and the details of how some random mail server normalises the local part is not what this is about. If gmail bounces all emails with "incorrect" periods, it might have stopped this particular incident, but it doesn't solve the issue which is about people giving out your address instead of their own when creating an account, which is the actual issue here.

Further, the proposed scam, if it works, only works because (allegedly) Netflix lets you change an account email without verifying that you know the current password. This violates every tenant of account security; because email is used to prove you control an account (allowing, eg, password resets), changing the email obviously requires you to prove you control the account. You have to ask for the password! I rather suspect Netflix does, but if not, this is the core issue.

Are we reading the same article?

The author is writing about getting a Netflix account funded by causing Netflix to send an email to a Gmail account holder. For all intents and purposes this is a legitimate email originating from Netflix. It is not about someone surreptitiously transferring control of another person's Netflix account to himself.

> It is not about someone surreptitiously transferring control of another person's Netflix account to himself.

That's exactly what we're talking about. Keep in mind that by the end of the proposed "scam", there are two accounts, both registered to James' email address, and with passwords that only James knows. He has control over both accounts.

Any attempt to profit from the scam would require surreptitiously transferring one of the two accounts James controls to someone else, which 1) may not even be possible 2) doesn't have anything to do with Gmail's normalisation of the local part of email addresses.

If there's an attack here, it's about Netflix not stopping an attempt at gaining control of an account when you do not control its email address and do not know the password.

Not really. There are two Netflix accounts, and both recovery emails are directed to James’s Gmail account.

The scam is operating on the chance that James does not realize that it is someone else's Netflix account and goes ahead to add funds to it. The other person then logs in before James realizes his mistake and changes the recovery email to something else.

> The scam is operating on the chance that James does not realize that it is someone else's Netflix account and goes ahead to add funds to it.

Right, but keep in mind that he's already changed the password.

> The other person then logs in

How? They don't know the new password.

The timing doesn't seem to work; James can't add funds without resetting the password, and Eve can't hijack it without knowing the new password. There's a potential loophole if Netflix 1) doesn't invalidate the old session when the password changes and 2) doesn't require a user to provide the current password for changing the email but as far as I'm aware, that isn't the case. (It certainly shouldn't be! And if it is, then that's the real issue here...)

The perp can regain access to the account by using alternative forms of account recovery in the account management settings, which the user would unlikely notice if he doesn't suspect anything amiss. e.g. an SMS password reset link sent to a phone number the perpetrator controls, or a secondary email address.

But he can't add funds to it without logging in to it, which requires him to reset the password. Once the password is reset, the scam can't benefit the scammer.

In order for the scam to work, either he has to be able to change the credit card details without knowing or changing the password, or the scammer has to be able to access the account without access to the password or e-mail address. Both of these are serious security issues, but not what the article was about.

> the issue which is about people giving out your address instead of their own when creating an account, which is the actual issue here.

If the other person had tried to use the author's email address written exactly the same as his existing Netflix account, Netflix wouldn't have let the other person create a new account, but would instead have made them log into the existing account. The fact that Netflix and Gmail don't have the same notion of "existing account" IS the key issue here.

> the proposed scam, if it works, only works because (allegedly) Netflix lets you change an account email without verifying that you know the current password

Well, Eve knows the account's password at the time she changes the account email, the article explicitly mentions this: "Eve has access to account N2 because she set its password when signing up".

But this does touch on an interesting point. If Netflix required him to enter his password before he could update the credit card from Eve's to his own, then to go through with it he'd have to reset the password, so even if he went through with it and double-paid at least Eve wouldn't be able to reap the benefit of a free Netflix account, which is at least a less severe security issue than the current situation.

> Well, Eve knows the account's password at the time she changes the account email, the article explicitly mentions this

Right, but read the rest of the sentence:

> I also have access to the account because I own james.hfisher@gmail.com, and so I can follow the password reset process for this account. I did so.

So at a minimum, Eve did not know the password at the time they would have (hypothetically) tried to change the email, as James says he had reset the password. And at least based on my interpretation of the linked article, this is unavoidable; you can't manipulate payment details without being logged into an account, and the only way to log into his bogus second account would be via a password reset.

If that's true, your proposal is in fact the situation: You do have to reset the password, and there's no benefit to the "scammer"; at most you can trick someone into paying for two different Netflix accounts. And this does seem to be true; he provides the link as https://www.netflix.com/simplemember/editcredit?locale=en-GB which doesn't contain an account identifier and does (of course) require authentication.

> The fact that Netflix and Gmail don't have the same notion of "existing account" IS the key issue here.

Well, first it's worth noting that Gmail is following the relevant RFC here (as per RFC 5321 2.3.11 Mailbox and Address, "...the local-part MUST be interpreted and assigned semantics only by the host specified in the domain of the address."), so if Netflix is relying on the semantics of the local-part then they're simply in error. And second even without this there's a lot of ways of getting a plausible looking phishing email into someone's inbox. If Netflix security relies on targets not seeing a malicious email, then they've done something terrible.

> All of which is fine; this is how email works, and how modern services (correctly) use email: By identifying an account with an email address, and assuming that if you have control of the email address you should have control of the associated accounts.

That is not the correct way to use e-mail. Unless you're encrypting all your customer messages with S/MIME or PGP, a number of people have access to the content other than the account holder. This includes the e-mail provider, the operators of any servers the message happened to pass through, and of course anyone who happened to hack them, plus anyone who can listen in on the links between the mail servers in the event that those aren't encrypted. None of these people should have control over the associated accounts just because they have the technical ability to read e-mails send to the address on file.

> If gmail bounces all emails with "incorrect" periods, it might have stopped this particular incident, but it doesn't solve the issue which is about people giving out your address instead of their own when creating an account, which is the actual issue here.

The actual issue is more nuanced than that. This isn't just about signing up for a service with someone else's address, it's about signing up for a service the target already subscribes to using an alternate e-mail address routed to the same account. Now, it is absolutely true that getting rid of the "dots don't matter" policy would not prevent this from happening, since there are other ways of aliasing e-mail accounts such as "+labels". However, in the absence of aliasing this issue wouldn't exist, since someone who doesn't subscribe to Netflix would (probably) not fall for a request to update their payment information, and the scammer couldn't create a new account with exactly the same e-mail address as an existing subscriber.

> Further, the proposed scam, if it works, only works because (allegedly) Netflix lets you change an account email without verifying that you know the current password.

The scam does not require the ability to change the e-mail address. That just makes it harder for the target to regain control, but ultimately the scheme depends on the target remaining blissfully unaware that they're paying for someone else's account. If the target becomes aware of what is going on then they can just dispute the charges with their card issuer; they don't need access to the Netflix account for that.

No, this scam only works because Netflix does not require validation of the e-mail address on file before sending account-related e-mails to that address. This is the core issue. The first e-mail you get related to an account should always be the notice that a new account is being created, with active effort required on the recipient's part before the address is considered valid.

100% disagree. My standard gmail address is with dots but when I have to tell my (rather long because it is my full three part name) I either omit the dots or tell them they don't matter. Totally an important and useful feature. Netflix is at fault for letting someone else use your email without asking you for permission.

Gmail could let you specify a list of valid addresses:

first.mid.last, firstmidlast, firstmid.last

Any others bounce or display the warning header suggested in the article.

That's exactly how it works today with the added benefit that the user does not have to enumerate the list and it's hard for other people to squat on slight variations to your email.

Canonization for deliverarbility (the enumerated list) can differ from canonization for uniqueness check (ignore all dots).

That isn't how it works today. They do not display any warning, and you have to hover your name to see what address it was sent to.

The infuriating part is that one can't reply from the address it was sent to, only from the one that's primary.

Yes, in fact this is one of the more annoying parts of this feature. When you're doing a support thing you usually have to reply with the exact same email. In my Google Suite account I have many domains setup to a single account and often times a reply uses my main account instead of an alias+domain I've setup on the account which received the email.

Would be nice to be able to easily reply as any of those combinations and default to the one it was sent to (dots, +'s, and domain).

Why should netflix be required to adhere to the different ways that every email provider doesn't adhere to the spec?

Because it's Netflix not adhering to the spec, which states that local addresses are to be interpreted by the host only. Netflix has no business caring about how Gmail interprets its local parts.

Well, if Netflix striped the periods, THAT would be not adhering to the spec. Netflix's issue is that they have a lax security practice, not that they don't adhere to the spec.

The email providers do adhere to the spec. The spec does not guarantee that different local parts go to different inboxes.

Gmail does adhere to the spec, which has nothing to do with this bug which is Netflix sending emails without verifying. Email isn't even relevant here. The exact same thing happens with postal mail addresses if something gives your address as theirs.

Although I agree Netflix is more at fault here, I think gmail could also make you aware if an email is sent to a non-canonical address. They do have the canonical version to compare to, whether that's with dots or without.

I also have to put forward that if you have trouble telling people your email address then you probably chose a bad address. You didn't have to put in the dots, and he isn't actually suggesting that they get rid of them now anyway. I point this out only because it means your use case doesn't mean it's an "important and useful feature".

DONT do this. I own the dotless version of an email address like this. I constantly get email intended for some realtor in California that does this. I see so much paper work that I should never see.

I really wish that I could tell google to bounce all the emails that don’t match my “dot pattern”

I’m now in complete control of someone else’s commercial business hvac account because of precisely this problem. And the worse part is that I don’t know the correct email to get ahold of this person. They’ve set up library appointments, I received a receipt for a down payment on a lake house, basically most of this persons recent attempt to start a commercial business has been emailed to me.

I don’t want this email google. Please give us the option to make it stop.

Just create a filter to send everything that doesn’t match your dot pattern to the trash. I have a relatively common first name / last name gmail account and it gets out of control sometimes.

My issue with doing that is that the other person will never get help. They’ll just say “oh my emails keep getting lost”, but if google would bounce them, then hopefully one of these services would notify the person that that isn’t their email. Instead of them happily continuing to send it all to me.

Very few services manage email delivery well enough to propagate email bounces back to their user account info.

The amount of consideration I'm willing to extend to a person who either doesn't know their own email address or is trying to scam me isn't that great.

Sometimes I'll text the person and complement them on their choice of purchases- yesterday it was a stunningly large Domino's pizza order.

Don't see a way to do that in the web UI. There's a "To" box in the first page for filter setup, but no obvious way to negate so as to specify "NOT To".

Do you also, by chance, have a short Gmail address? I've also definitely gotten signups from other individuals mistyping their address on my six letter account.

My comedy ownership of someone else's identity is a Staples account. Presumably someone in New York with a similar name had a store person look up their Staples account, which was actually my Staples account, and associate their business name with it. Their business name now appears on mailings I get from Staples and sometimes I get sample pens and the like branded with their business name.

It’s not too short. 12 characters including the name separating dot.

This person that recently started using this email is using the same name but with no dot.

first.lastname@gmail is what I use, and now I’m getting a bunch for firstlastname@gmail.

Some of these emails look pretty important too, if I had malicious intent, I could probably ruin and or steal this persons identity and or business with the specific mail that I’ve received recently.

I’m really amazed at the lack of confirmation of emails before sending things like your HVAC business license, or city contracting permits, that have other people’s identifying information in them too.

Wouldn't the same thing be happening if they'd entered first.lastname@gmail, or if you used firstlastname@gmail? It seems like the problem is that they entered an email address that wasn't actually theirs. The dots don't seem to make a difference.

Indeed, my wife gets this problem all the time on gmail because her name is a fairly common one. The dots don't enter into it in the general case.

That same problem can happen even without dots. People can simply mistype their email and have it be your email. That happens if even if neither of you have dots in your email.

So then send the verification email at signup and any time the user changes the stored email on their account. Am I missing something?

I agree that's the answer. Unfortunately many services out there (including Netflix apparently) don't do that.

You’re not missing anything, but if gmail delivers all the mail, and I just trash it, we’ve fixed the symptoms, but not the problem, and we’ve made the problem invisible.

I agree that sending verification emails should be the standard. But if I can’t bounce the emails then there isn’t even the slightest way to inform the sending service that there might be a problem.

Obligatory XKCD: https://xkcd.com/1279/

I also combat with the same problem from time to time.

I'm now in complete control of someone else’s commercial business hvac account because of precisely this problem.

But that has absolutely nothing to do with the dots. Indeed, almost every comment about this has nothing to do with the dots, including the submission.

Someone entered the wrong email address, and in the process got yours. It isn't like the dotted or undotted one is legitimately theirs -- it can't possibly be -- but that they forgot a middle initial or something of the sort.

I've written about this before-

https://dennisforbes.ca/index.php/2016/04/08/email-addresses...

-but the issue is with email itself, and the notion that once someone enters an email address it is authoritative. Like you I get a tonne of email for other people. I get travel tickets. I get room reward points. I get calendar events for car service in England. The dots aren't the reason.

I strongly disagree with the author as well. Netflix is not doing its job.

But the scam described by the author works because he victim already has an account registered with their Gmail address.

The warning could be a good idea

also I wish the email address of both the recipient and emitter were shown in a better in Gmail.

The scam works because of Netflix's lax security practices around verifying emails. Given how easy it is to make a mistake filling in your email address, and email address should never be trusted until it is verified AND you should make clear during your sign-up process that the user should expect a verification email so they know something is wrong when they don't receive one.

But the author reset the scammer's password, denying them access to their fake account. The scam doesn't seem to work unless Netflix allows you to enter a new credit card number /without/ resetting the password of the scammer's account.

In the initial submission, without the dots issue though, the wrong address entered wouldn't be able to match an existing user.

That's why you send an email to whatever the user typed in with a link they have to click before they can complete the signup process. This is really, really basic stuff.

Yes, I agree. My point was just that the dots did have an effect in the initial submission story.

I agree there's that fundamental problem with the way email gets handled.

But at the same time I still wish Gmail would stop you from receiving emails on addresses other than the one you created yourself (ie by treating dots like any other character). It'd save me from getting several misdirected emails per day.

It's true that all these misdirected emails come down to people misremembering their addresses, but I think you're overlooking an important class of such misremembering (which can be addressed on its own).

I have a dot in my actual email address. There are several people who have a similar address who must be forgetting that their email address actually contains an additional initial or number. However some of these people do not have the dot in their actual email address.

I.e my email address: this.that@gmail.com

The other email addresses: thisnthat@gmail.com, thisthat7@gmail.com, etc

...where the other addresses get misremembered as: thisthat@gmail.com

I get these peoples' emails, but that could be easily avoided if Gmail took note of the dots.

I do this, using a Google Apps script to send any emails to unexpected addresses to Spam.

Something like this: https://stackoverflow.com/questions/24540743/how-to-spam-fil...

I have a concern with that. Say I train the filter to treat emails from company X as spam, and then in the future I sign up with company X and their emails to me get treated as spam.

I dont know for sure if that's how the filter would behave, though.

I just tried creating an account that differed from an existing account in the number of dots, and it was refused, explicitly on the grounds that periods and capitalization are ignored. Therefore, either at some point Google got this wrong and allowed the creation of such aliases to an existing account as if they were distinct, or this person is mistyping one of the non-dot characters of their address.

Gooogle had a dots bug about 14 years ago and fixed it about 13 years ago.

People just mistype addresses and vendors don't verify

You can create a filter on the “to” field of emails. Any email sent to the undesired dot pattern will have whatever action you choose taken on it. Put them in a folder and mark them as read or send them to trash.

You can (should) also mark the messages as spam because whoever accepted that address without verifying it shouldn’t be sending emails to it.

Can't you use the "report as spam" feature?

It would be nice if gmail's filters had "bounce" and/or "report as spam" as available actions.

Something similar happened to me once [1] and I used the password reset process to "hijack" the account. I used that to contact them over facebook, and then assigned the account to their proper email address. They were quite grateful.

I'm not sure of the legality of that process, and you could argue the morality of it, but doing this once to one of their less important accounts (library?) might be a good way to get enough information to contact them properly.

[1] It wasn't technically the same, because the typo was done by a phone carrier agent, not the person whose account they were setting up. My email is firstname.unrelatedstring, theirs was firstname.theirmiddlename.lastname, but my unrelated string happens to be their middle name.

Anytime this happens to me, I immediately log in and change the password.

They can work with customer service to get the email corrected.

You may be able to set up filters to automatically trash everything sent to incorrect addresses. It might be fairly annoying, but it should certainly be possible. Just set a filter for firstlast@gmail.com to send them to spam. Also, software such as mailwatcher allows you to bounce emails after they've been received by the server if you think it necessary.

>Where is the security flaw here? Some would say it’s Netflix’s fault; that Netflix should verify the email address on sign up, or that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But such policies would not add security, and would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm.

This is a bizarre quote. The fact that "Netflix should verify the email address on sign up" would not "force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm".

I'm sorry, this sentence wasn't clear, and I agree with you. What I meant by this was:

- Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates. Using someone else's address on signup only cedes account control to them.

- Others would say that Netflix should disallow the registration of james.hfisher@gmail.com when a Netflix account already existed for jameshfisher@gmail.com. But this would force Netflix and every other website to have insider knowledge of Gmail’s canonicalization algorithm.

Does anyone else use dots in their email service? Wouldnt your second point be as simple as Netflix checking every gmail address against a dotless version of all of those addresses? Eg email-1 in the table is their address as input and email-2 is the dotless version, Netflix could then ensure that email-2 is unique. Seems pretty straight forward to accomodate an admittedly silly ‘feature’ of the largest email provider.

> Some would say that Netflix should verify the email address on sign up, but there's no obvious attack that this mitigates.

Someone could carry out this exact attack but without dots. The attacker creates an account, associates it with your email, and hopes you put your credit card info into the account.

How come the attacker didn't "[cede] account control to [you]" when the attacker put your email into the attacker's account? The control issue seems the same regardless of how dots are treated.

They couldn't carry out the same attack without the dots, because the attack relies on the target mistaking the attacker's Netflix account for their own account. If you get a Netflix email when you've never signed up using that email account then it's obviously not for you.

I have ~1000 online accounts. I can't remember every site that I've signed up for or not, and whether or not they've been deleted.

Many websites allow multiple accounts to have the same email address.

You probably know whether you're paying for Netflix though.

Why are dots special? I have several email addresses that all find my inbox. Heck, I've done this annoying identity split to myself by accident, creating two accounts with a product I only wanted one account for.

People can't automatically derive those other email addresses. The existence of xapata@somehost doesn't allow assuming the existence of xapata.spam@somehost, but the existence of xapata@gmail does allow assuming the existence of xa.pa.ta@gmail.

At least three people have successfully created a Netflix account with my gmail address, written in exactly the same way I would normally write it: Jessica in 2012, John in 2013, and Jen in 2017. The first two somehow managed to recover and change the email address, the last one never did. (So maybe it's now finally blocked off from further registrations.)

If any of them had shared my name, the effect would have been just the same as in your case despite there being no canonicalization issues. Likewise would you really have been suspicious about seeing the notification come in for e.g. jamesfisher+netflix@gmail.com? Who can remember exactly what services they used a +something for?

No. This hole is totally on Netflix. It's a total shitshow, especially for a company that loves to brag so much about how they only hire the best technical people. No. Either they don't hire the best, or they let some kind of piece of growth hackers actually run the show.

I feel like you are being a bit harsh. What is really the exposure in this case?

I can't really imagine that there are that many blackhats trying to get free Netflix accounts when torrents or Usenet gets you more content anyway.

And while yes, there is some friction getting torrents, it's not nearly as much as trying to phish multiple people in hopes that they will pay for your account.

All kinds of other problems follow from not verifying the emails, for both the person who owns the email account and the person owning the Netflix account. In addition to this kind of targeted attack:

- When these accounts were active, I'd keep getting email from Netflix that I could not stop receiving.

- In the first two cases, I could have done a password reset on the accounts and just started using them. The original owner would have to continue paying for it, since they'd have no way to disassociate the CC from the account.

- In the third case the user didn't get the account back at all after forgetting their password (maybe no recovery phone number?). They lost all their viewing history and probably also ended up paying Netflix for service they had no way of using.

From a technical perspective, this email handling is total garbage. The only persons winning are on growth hacker scumbags who get to write slides every quarter about how they lose no customers in the email verification part of the signup funnel.

> but there's no obvious attack that this mitigates

Anyone who owns fmail.com hmail.com gmil.com gmai.com can easily steal account details an personal information from people who have a typo when entering their email address if you don't verify the email address before sending that personal information.

If you are not verifying an email address before sending sensitive content or allowing an account to access sensitive information, you are doing security wrong.

edit: typo spelling typo...

Why doesn't Netflix require users to be logged in before they can change their card details? That seems like the biggest security flaw, not the Gmail dot alias.

(I'm guessing they did A/B testing and found that having to log into your account lost them some percentage of people. If that's the case, Netflix are clearly putting their retention rate ahead of security)

There's probably a not insignificant number of people who are happily using a dotted variation of their gmail account. Putting a big warning above the email wouldn't make them very happy.

They do. The author reset the password to gain access.

But then if the password is reset, the original scammer has no access to the account! And the scammer cannot reset the password because they do not have access to the email.

This is true if changing the password s you to re-enter the password on every device (even those that were logged in at the time)

Changing a password should always invalidate all existing sessions. If you aren't doing that, then you are doing it wrong.

Edit: Or at least invalidate all sessions initiated using the old password if you have that tracked.

> Changing a password should always invalidate all existing sessions

Doesn't with Google. They display a prompt and let you select which sessions to expire.

Netflix offers SMS password resets.

Should that not be a big enough red flag in most cases (I have to reset the password on this account -> maybe it isn't my account)?

> But firstly, no one wants this infinite set of email addresses. Gmail already provides this in the better form of plus labelling.

What is the difference between dots and pluses? They both have the same flaw: to Netflix they will both be distinct addresses.

It's easy to accidentally type "bob.foo" instead of "bobfoo", and it's also easy to miss the difference if you're the recipient of a malicious attack.

It's harder to accidentally type "bobfoo+abc", and it's harder to miss the difference if you're on the receiving end.

>It's easy to accidentally type "bob.foo" instead of "bobfoo"

If someone made that typo (for a gmail address) everything would be fine, because both emails would go to the same correct person. There needs to be some additional typo for it to go to a different person.

Pluses are part of email standard, dots are some nonsense Google thought was a good idea.

As far as I know, plus wildcards are not part of the standard either.

This is an RFC 5233 subaddress.

Both + and . are allowable characters in the user part of an email address. AFAIK, the tagging functionality isn’t part of the email standard any more than ignoring dots is.

EDIT: huh, turns out RFC 5233 covers this. TIL. Thanks, ipsin

Plusses are an optional part of a standard[1]. The main email standard does not require a+b@c.com to be treated the same as a@c.com [2].

[1] https://tools.ietf.org/html/rfc5233

[2] https://tools.ietf.org/html/rfc5322#section-3.2.3

Another interesting part of dots in emails is that they apparently can't be at the end of the username, EXCEPT if you also "quote" the entire username. So, <a.b.@example.com> is probably invalid but <"a.b."@example.com> (including the "quotes") is supposedly valid.

Had an acquaintance who was signed up to a popular email service with "a.b." (their initials) for years until they changed their underlying platform, after which they actually were very sorry to let him know that they could not support his strange email address any more and terminated the account.

The use of pluses for tagging/subaddressing is an optional part of the standard. + being valid in an email address is not an optional part of the standard.

Maaaany email address validators will reject Gmail addresses with + in them as "not valid".

"Read the Friendly Standard", I know, but dots are much less likely to be rejected.

Half the time I think it's because the site wants it to be less obvious when their database is compromised.

Authorize.net just started rejecting emails with + signs in them, causing transactions to start failing for many businesses.

https://community.developer.authorize.net/t5/Integration-and...

I have a similar problem due to the whole "gmail.com" vs. "googlemail.com" thing that came about in Europe in the earlier days of Gmail.

When I got my gmail account, Google gave me a "googlemail.com" address, due to a pre-existing trademark in Europe. These days the "gmail.com" suffix works for my account, but I've already set everything up with the "googlemail.com" form and saw no reason to switch. Sometime in 2016, someone started using the "gmail.com" version to sign up for stuff, and I repeatedly nearly fell for this exact problem... It's made more difficult by the fact that Google clearly _want_ me to use the "gmail.com" form, and refer to it by that address in many places, despite me opting to use the long form in settings.

I don't think the person using my email address is being malicious, I think it's by mistake, but I have no means to contact him to fix the problem.

I don't see the scam here. If you have to go through password reset to get into the account and update the CC number, then the would be scammer does not have access to that account anymore (assuming Netflix logs you out of other devices when you change your password).

Sure, you end up paying for an account you don't use, but nobody gains from that (other than netflix). It certainly is an issue that can easily be fixed by netflix validating email addresses, but I don't see any incentive for scammers abusing it.

I was thinking the same thing. This isn't really a viable scam unless maybe Netflix offers multiple ways to reset your password, which isn't addressed in the article. Maybe a text message reset is possible?

As someone who commonly has other people mistakenly use my email when signing up for things, I 100% blame the service (Netflix) for this. This is only done as a way for them to increase signups/revenue and the fact that so few services require verification is why people don't realize they are using an email that isn't theirs for years.

Getting rid of dots only solves one tiny portion of this problem which would be completely solved if Netflix and others required verification. Gmail cannot stop people from using my email address to sign up for things, but Nextlix et al. can do that and protect their users privacy and personal info with one single email.

A better example is that a few years ago Turbo Tax emailed me personal details and gave me access to someone else's taxes because they didn't require verification. That is insane (and I believe/hope was since fixed)!

netflix security suck for not doing email confirmation and the ONLY email to be sent to the updated address being a billing one.

and no, it should never "know about" the dot feature in gmail. that is working as intended all around. it's simply that netflix put user bounce rate metric in front of protecting users from scam. plain and simple.

IMO It's not Netflix fault, actually emails with dots in different positions should be different emails. Also, not sending a confirmation email is a common pattern now. Maybe an email about "you created an account :D" should be enough mitigation, but this is not their fault.

The thing is, the handling of the local part is MTA specific: you cannot just assume that different local parts correspond to different people because of aliases, +foo addresses and the fact that the administrator of the MTA can set whatever equivalence rules they like: I, for example, use - instead of + because so many internet forms reject + as a valid email character.

The only sane way to handle this is email-based confirmation.

As somebody who has multiple people who aren't me registering accounts to variations of my email address:

Companies who do not send "you've created an account! Click here if you didn't!" emails can die in a fire.

Ironically, the most i get of those emails is google itself

They allow any idiot to register my gmail address as their "alternative recovery email" without confirmation. And then from time to time i get a dozen "recover your account" emails from those accounts.

There should be an account creation email and another for a payment method being added. A lot of sites nag you to verify email but never force it.

Yeah, another pattern I've seen is that confirmation is required just in case you need to provide a payment method.

> actually emails with dots in different positions should be different emails

Don’t know from where this is coming from but there’s no such _should be_ rule, there never was.

As a matter of fact an email server can have any aliasing setup it wants. FastMail for example does sub-domain aliasing, which is awesome because I can use an unique email address for any service I sign up to.

Any email server or service worth its salt allows aliases. Which aren’t hard to guess for a determined attacker either.

Netflix has no excuse ;-)

subdomain aliasing sounds way better than + aliasing. Too many sites block + aliasing.

> Too many sites block + aliasing.

You actually mean: Too many sites were coded by incompetent people and have broken input validation.

Yes, unfortunately that's the truth.

For example: meetup.com

On an email with a plus in it, they complain with this exact error message: "This isn't a valid email address".

I contacted their support a year ago. They replied that they've passed along my "feedback". Nothing happened since then.

That said, plus aliasing is sort of a standard. And spammers could eliminate anything after the plus, its usage being pretty obvious, so you can't rely on it for tracing spam. Eliminating the aliasing is much trickier to do with sub-domains, as it's not at all clear when aliasing is used or not. And some email services support custom email routing based on your own regular expressions (e.g. GSuite) so you can come up with your own weird scheme.

Plus aliasing is only fine when you don't have control for doing something better, more opaque. Like when you have a work or a @gmail.com address.

Not confirming the email is insane. And it's even worse if you're going to use that email address to send personal data.

I don't see any excuse to not confirm an email address, honestly.

I am not even sure what you are replying to. I never said opposite of "actually emails with dots in different positions should be different emails". I also strongly think so. Netflix suck for not letting the owner of the email know an account is associated with it in a much better way.

A couple of things that I didn't quite follow.

1. In order to provide the payment details, they had to do a password reset to the dot-email address. I can only assume that locks out 'eve' in this case, but I suspect it doesn't force a re-login on all devices.

2. When 'eve' signed up to the dot-email address, surely Netflix would have sent a welcome email thanking them for starting a trial. So in that case, I can't see how it would have gone completely undetected up to this point.

I personally feel that Netflix should validate the email address on registration. Otherwise people who genuinely sign up with a typo in their address may lose access to it forever.

I'm pretty sure Amazon allows unlimited accounts as long as you have different passwords.

This is beyond bizarre. I have at least 2 accounts with the same email and the way into it is by knowing what password leads to which one.

I have yet to see what happens if I try to set both accounts to the same password.

This is hard to believe. So you're saying that they hash/bcrypt (user+pass) to determine uniqueness?

I have at least two accounts; same email; I have two passwords and sometimes I screw it up.

I'm trying to think of a simple way to screenshot / show this without leaking person info...

Maybe, or maybe they just test the password you enter against all of the accounts when you try to log in.

However it's implemented, this is a well-known, long-standing "feature" of Amazon. I think it happened to me once when I first tried to sign up for AWS, and accidentally ended up with a second Amazon account. See http://adaptivepath.org/ideas/the-woes-of-multiple-accounts/

I just took a screenshot of being logged into both accounts.

https://imgur.com/a/jxmhI

How did you get the 2nd account in the first place? I'd like to reproduce this.

I guess I signed up for a new account with the same email and set a diff password?

Pretty sure that is all it takes.

I don't know how it's implemented, but it's definitely the case -- I can currently log into two different accounts with the same email, depending solely on which password I use. I have a deliberately typo in my name on one of them so I can easily tell which I'm logged into.

Is this really possible? So when you reset password, anyone know which account will it reset?

They used to allow this, but AFAIK they don't anymore. I don't believe you'd be able to sign up a new account with that same email, and if you changed the email address on one, you wouldn't be able to change it back.

Source: I used to work at Amazon, though never on any systems that would be directly involved in this.

IMO, the big takeaway here is that protecting yourself from phishing is not just about making sure the email is from who it says it is but also making sure it's actually serving the purpose you believe it is.

While I, like many in the comments, agree that Netflix needs to validate the email account, my hunch is this trick would still be quite effective with that.

Wait.. he logged in to the N2 account by going through the password reset procedure, right? So now, the scamster loses access to the account, because the password that she set is no longer valid.. So how does she get back access to the account once he's changed the password and put in his credit card details?

Exactly what I was thinking. As my next step would be to deactivate other sessions. Then bam, no more access for this other person....

One interesting thing to note, for GSuite accounts, the dots do matter. first.last@company.com is not the same account as firstlast@company.com.

Interesting! And makes the situation even more confusing ...

Perhaps they realized their mistake but knew it was too late to change it without harming users who relied on the dot aliasing, and so only eliminated it for the newer system?

This is true of gmail accounts as well. If you signed up with first.last you always must login with first.last.

The real issue is that old account names are actually case sensitive too. Starting a few years ago Google normalized all account creation to lowercase, but existing case sensitive accounts remain. We implemented OAuth, normalizing accounts to lowercase in our db and everything was fine for years until we ran across a user who's account legit was FirstLast@ and would only auth that way.

My wife has found this is absolutely not the case for gmail. She consistently gets firstnamelastname emails instead of firstname.lastname which is the one she signed up with.

To test a theory I told her to login as both using the same password. Both go to her gmail account. Logging in without the dot shows the address as still firstname.lastname.

My assumption at the time is during signup Google strips the dot and it's merely there for cosmetic purposes. The RFCs should treat the dots as separate accounts but Google does not.

Just to verify this is still happening, I also have a first.last account and signed in without the dot. When I got into my account it says 'signed in as first.last'.

This may affect accounts created up to a certain point in time though as both accounts are almost as old as gmail. I got invited back during the early days and invited my then girlfriend at the time (now my wife). If this has changed over time it's become way more confusing.

If what the GP said is true it sounds like nobody else signed up for the "non dot version" before Google normalized accounts. Gmail would only treat the accounts different if first.last and firstlast weren't the same people.

Or you could make sure vendors follow RFC2822.

Now admittedly its dense to read, but the two sections that are relevant are;

https://tools.ietf.org/html/rfc2822#section-3.2.4 & https://tools.ietf.org/html/rfc2822#section-3.4.1

3.2.4 explains what a dot-atom can be made up of 3.4.1 explains what can be accepted in the make up of an address.

I'll always prefer vendors operating within spec even if the spec is a dense as fuck.

What’s your point? The vendor in question (gmail) is within spec.

The article shines light on three separate failures on Netflix's part:

1. Canonicalize email addresses

Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups.

2. Never leak information through sign-up forms

A login attempt either succeeds or fails. That is all the user should know. Telling the user if the attempted email address exists or does not exist is a privacy breach and a security breach as demonstrated in this article.

3. Never assume ownership of an email address until it is verified

Some services verify email addresses at some point in the user flow, some never verify, and few verify at the right point. The best sign-up flow I've seen is Slack where setting a password is part of the email verification flow and a user cannot set a password and own the account until they have verified the email address.

Thus, sending transactional emails beyond verify your email or reset your password before the email address has been verified opens one up to security breaches as in the case of Netflix.

> Whether or not dots or +asdf is considered okay, an email address used for identification needs to be canonicalized in order to avoid duplicate sign-ups.

Since it isn't a standard or norm, how would that work? These are gmail exclusive features, and other services have other unique features.

Disagree with the first two.

1. Netflix shouldn't have to care about the internal implementation of Gmail addresses. It's perfectly fine to treat ab@service.com and a.b@service.com as separate accounts.

2. If you attempt to sign up for Netflix with an email address which already exists in their system and they tell you that, it isn't a security or privacy breach. There is absolutely no other way to handle the situation.

Agree with the third one though. A "click here to activate" email absolutely needs to be standard in every sign-up flow.

By canonicalization I'm not saying any arbitrary practice by Gmail or any other email provider should be considered as standard. I haven't looked at the RFC in some time, but I don't believe the use of plus suffixes is standard either. Nonetheless, I believe plus suffixes are more commonplace, generally permitted, and serve a reasonable purpose. For instance, sending email to a user using their email address as provided is a good practice in order to preserve a plus suffix which may aid the user in organizing their email. At the same time, canonicalizing email addresses in a sensible way, e.g. stripping plus suffixes, can be an aid for preventing unintentional, duplicate sign-ups. Just consider a sign-up form on the homepage of a website. It's not uncommon for people to enter their email and password into that form by mistake thinking they're signing in. Additionally, if the website compares canonical email addresses when checking login credentials, then a user who signed up with an email address containing a plus suffix can sign in using their base email. These two situations combined could lead to the accidental creation of a duplicate account if canonical email addresses are not compared during registration. There are some trade offs with this strategy, but as long as the canonicalization is implemented reasonably, I see it as an aid to the user. Note that reasonably doesn't necessarily mean stripping dots.

As for the second point, I consider it a privacy breach if a service publicly associates my email address with their service without my consent. Sign-up forms do this when giving different responses when an email address is registered vs not registered.

As for how to handle it, if a user signs up with a new email address, you send them an email to verify their email address and instruct them to check their email. Similarly, if a user attempts to sign up with an already registered email address, you send them an email letting them know they already have an account and instruct them to check their email, which will provide them with a link to login.

In the latter case, if they enter the correct password, you can just directly tell the user they already have an account, as they've proven their identity.

The problem with your canonicalization idea is that it doesn't work in all cases. Yes, it might work with gmail addresses, but there's no way that you can assume that "david+x@example.com" and "david+y@example.com" are actually the same mailbox. If you so assume that, then you've just broken you websites for users where that isn't the case.

Why would you broadly assume an incorrect rule? Email address parsers correctly implement canonicalization rules that consider the domain e.g. gmail. It doesn't require any extra work as a developer and the logic is hidden behind the abstraction. But certainly, you shouldn't go implementing arbitrary rules that aren't reasonably applicable.

The article is wrong: The number of email addresses is NOT INFINITE.

The 'user' part of an email address (before the @) has a maximum length of 64 characters. If n is the number of non-dot characters in the user part, then only (64 - n) dots can be added to the address for it to still be valid.

The valid email addresses for that user are a subset of all 64 character combinations possible with dots, alphanumeric chars, _, and a finite set of characters that I don't remember right now. That is a finite set, therefore the subset is also finite.

For Gmail, you can add a plus to the left side of your email address and then append an arbitrary string. For example, email@gmail.com and email+foo@gmail.com are the same address.

And, it's still finite, right? Just a large, finite number :P

No? You can put whatever string you want there, of which there are an infinite number…

The poster already explained that no, you can only write up to 64 characters which is not "infinite"

Ah, I didn't catch that.

It is weird that Netflix is allowing James to update Eve's payment information without logging into Eve's account. I think that is the actual security vulnerability.

On the other hand, e-mail verification should be done eventually to protect Eve from James to recovering her account in case Eve had a typo unintentionally.

Pretty sure he reset the account password using the email he has. That allowed him to access the account and view the payment information. This is why validating email addresses is critical before accepting payment information to a subscription service.

Frankly feels like these comments are being astroturfed by Google.

Sure, Netflix should have done things differently, and technically what Google is doing is not wrong, but if we look back at reality for a second here, it is simply the case that many services (and users) make the assumption that only one e-mail address leads to a user's inbox.

This breaks this paradigm and as a result does cause realistic security issues, whether it requires a Netflix to make a mistake, too, or not.

> but I also have access to the account because I own james.hfisher@gmail.com, and so I can follow the password reset process for this account. I did so.

I wonder if others feel that it is ethical or unethical to log into other people's accounts in this situation.

I get lots of emails resulting from people typo'ing my email address instead of theirs—and the unsubscribe links are often hidden behind a login page. But I feel uncomfortable signing in using a "forgot password" link into an account that I know isn't mine. At the end of the day, I usually just create (yet another) email filter to automatically delete these emails (marking them as spam doesn't train the spam filters in my experience).

I'd be interested to know what others think of the ethics of this, or if there are other workarounds.

I'd log in an cancel the account. Why feel wierd? Someone is using your email address without your permission.

Curious how often this happens.

I have firstname.lastname (although now it just forwards to my FastMail vanity domain) and I've shut down new eBay and Amazon accounts plus received doctors appointments and even school lunch duty emails. Sometimes I respond, and I even forwarded a couple after figuring out one mis-user's real email (firstnamelastname0) when a cable company csr chat log was emailed, but they never responded so now I delete them all.

Wow, what a shitshow.

Do we have a word to describe frustrations caused as a byproduct of other people's use of technology? I wonder if the Japanese do.

I've had the same: I have firstname.lastname, and I've had netflix, nytimes subscription, dropbox registrations (and warnings that it's full), hotel bookings, and many other things that are nothing to do with me, targeted to firstnamelastname.

I also get regularly added to conversations with other people who think I'm someone else. Again and again I've had to try and explain that they've got the wrong email address, but it happens so often now, I just don't bother now and ignore the emails.

When this happens to me, I reset the password and abandon the account. I assume whoever created the account made a mistake, but I have no way to contact them. When they have to sign in again, they’ll have to create a new account, but they’ll hopefully use their own email address.

It’s never happened to me with a paid account, but if it did, I’d cancel it.

Ethically - you shouldn't log in to other people's accounts, but rather, you should delete the email (and possibly notify them if you can).

I'm pretty sure that legally it's problematic as well.

(I get a ton of misdirected email because I have a six character gmail address with a common name.)

My rule is that I'm willing to "steal" the account and cancel it or change the email for "unimportant" services, like dating sites. For financial institutions, I contact the institution instead. (My email has gotten associated with at least two bank accounts that aren't mine.)

The law isn't on your side if you log into a litigious person's account without their permission.

I'm receiving other peoples mail all the time. My first gmail account was about 13-14 years old. Recently i'm receiving mails from Argentina constantly about museum trips, school meetings of people. I reply them explaining that i am from far far away and notify the person about the situation. When i check the "To:" section, the mails sent myhandle67@gmail.com or myhande.78@gmail.com.

My other gmail account is namesurname@gmail.com and i receive about 6-7 of different peoples mail with the same name surname combination. It happened in hotmail also btw.

I got phone bills, cargo shipment details, hospital working schedule documents, private messages from a marriage social network kind of a site. I can easily login to the site with link in the mail and can read all his really private messages, flirting with the ladies.

I called the phone bill guy, his parents answered it a little panicking, i explained them the situation. But the mails keep coming, so i call the phone company. They said they take action immediately but nothing changed.

I called the cargo guy tell him his cargo is on his way and who i am. He surprised and confused like others when he heard a guy with the same name surname called him.

I called the hospital, someone else answered. Explain him the situation to let him know. He was surprised and asked me if i have the last months schedule pdf because it got lost or something.

I couldn't reach the old womanizer guy, contact the site and mails stopped.

I'm not using the dot feature myself but somethings not working correctly with it i guess. In this particular case i think Netflix should validate the e-mail addreses.

Fascinating article, thanks for the info!

> The only clue in the screenshot above is that the interface says “to james.hfisher”, instead of “to me”.

I just tested it, and I'm not even getting that clue. It says "to me", and it's only when I click on the little arrow that it says "(Yes, this is you.) Learn more". But you'd have to be suspicious in the first place to click the arrow...

I find this to be a very poor idea indeed, and hiding the clue is poor design to boot.

Oddly a friend has an email that’s first.middle initial.last. I just tried without dots and it got bounced.

I'm sorry but this is ridiculous. The author

1) mentions the dots DO matter, and calls for they're removal as a feature, but makes no mention of the ability to add '+{whatever}' to an email providing the exact same attack vector

2) states this is a gmail issue, when any email provider could do the exact same thing and have it be a problem

3) states the Netflix not verifying the email before payment is somehow not a fix because "using someone else’s address on signup only cedes control of the account to that person", when the receiver has full ability to _not_ confirm the phishing account.

Netflix is what, just supposed to know and stay up to date with all possible email providers various email mappings? No, rather, they should verify the email address before payment. Granted, the onus is on the user to notice a new 'Confirm your email with Netflix' email. Maybe Netflix could make it really obvious that the email is for a _new_ account? Defense against phishing attacks will always rely on some amount of intelligent user behaviour, if a user is going not going to read an email and blindly click-though I'm not sure there's much that can be done anyway.

Author does mention the “+” feature.

Netflix was billing TWO of our cards for the same account EVERY MONTH! when I finally noticed this and called Netflix only last charges were refunded. Netflix has very loose rules when it comes to billing as long as they are getting paid

Or, whenever you get an unexpected email, go retrieve your credentials from your password manager, log in via the main page, and check you can see the message/problem it's referring to.

(Some of us use the dots to trick some sites into using a nonstandard email, rather like the username+netflix@gmail trick, so you can see who sold your email to the viagra trolls. Some sites reject + in emails, making the dots v handy.)

Netflix should validate the email account. But, also, when you get the email to update the invalid credit card information and you click on the link, shouldn't Netflix force you to Sign In? This kind of security step is already common to thwart attack vectors where someone finds your computer unlocked and tries to reset your password on you. Google does this when you go to accounts.google.com. They always verify it is you sitting in front of the computer. So getting back to the Netflix situation, once you click on the link to update your credit care info you won't know the password for the rogue account and it's not your account UUID or whatever so I'm assuming Netflix is smart enough to make you prove it's you by entering the password. But you won't know the password. If you were tempted to click Forgot Password and go through all that rigamarole, then you hijacked the attacker's account. I guess what I'm trying to say is, most of the issue here should already be solved by appropriate defenses against different types of attacks. No?

Interestingly Gmail will let you filter in a dot sensitive way. Anyone missing my dot gets sent to a folder called “wrongguy”. Whenever I drop by to look at it it’s full of spam.

That works for the usual, accidental missing-dot case. Won't work for phishing that injects a '.' in some other position.

It happened something similar to me a few weeks ago: the scammer registered an account indicating my Gmail address, with dots. I wasn't signed to the service with that address.

When I asked Netflix's support to remove the association of that account with my e-mail address, they replied I had to change the card details with mine, because it was like I was "stealing" the scammer account credit card. I replied I would not add my credit card details. The operator then wrote me he was going to invalidate my e-mail address so that the user that would log in, had to change it. And that it should solve my issue.

The problem, for me, is not the Gmail feature. Nor the dots, neither the plus addressing. It's a lack of the validation systems. Just verify the e-mail ownership before allowing any interaction.

Some guy from the UK uses my Gmail address all the time. I once received a British Airlines confirmation for him. After clicking on the link (no authentication required!), I arrived on a page where I could change his notification settings. His phone number was listed there, so I texted him asking that he stop using my email address. He replied back and sounded alarmed that I had his phone number.

I also received a photo of his passport once. Using that, a friend in the UK was able to look up his parent’s home address. I phoned them up and left a message asking that he stop using my email address.

He’s still using it, so I eventually set up a Gmail filter to shunt his likely emails into a separate folder. I’ve changed my password since all this happened, and I don’t get why he still uses my address.

As an aside, it seems a lot of people assume your email address is just your first name and last name with "@gmail.com" tacked on the end.

I get a lot of emails for other Evans this way. I've had wedding invitations, been CC'd in on rental dispute discussions and all sorts of stuff because of this assumption.

The most recent was an invitation to edit a 5th grade basketball roster google doc. So at the top of the document I wrote a politely worded rant on the subject of email addresses. At the same time, the original author was editing the document and trying to delete my rant as I was typing it, so we had a little battle going on for a few minutes. I reckon that's one person who will never do that again.

On the subject of reading someone else emails:

When a company that I worked for went under, I managed to catch their falling domain name. I setup catch-all which was mostly boring emails of ex emps Fecabook notifications and some bills etc, BUT the emails for the owners and few top execs were very interesting. In that sense that 3 years later I decided to build exactly the same business (well, one of a few)

Now it is running mostly on autopilot with $2.5MM annul revenue. Many times it obviously is what you don't know that is stopping you from entering the market. Everything I learnt by reading my ex bosses emails in few years allowed me to setup somewhat successful business, all on the side.

It’s not just Netflix. I am having the same problem. Someone has signed up to instagram, yahoo and others using a form of my mail address without the dots (the one I chose had the dots before I knew gmail didn’t care). I believe a lot of them are spam accounts. But what do I do. I don’t want to spend time trying to speak to a customer service rep for companies that don’t want to be contacted.

Instagram had a link at the bottom of the mail called ‘remove your email from this account’. I click it and it says it’s not a valid link...

I don’t want this from gmail. I want the address I signed up with. It should be simple. It’s hard to explain to others why the dots don’t matter.

Really, it was simply your mistake for following a link in an email and then entering credentials where you landed, i.e.. you fell for phishing.

The idea that a company should only accept one account per email address is bullshit (it a contact address, not an identity), and if they don't do that, any of that "don't allow any aliases for email addresses" on the part of the email provider would be completely pointless anyway. You simply don't use context delivered by email as a starting point for disclosing credentials, and you have solved all (email) phishing attacks.

The opinion of the author is ridiculous. What about someone use your email, without dots, to register as a netfix user?

You won't pay for it then since you know you don't have a Netflix account. In this case you have one and you mistakenly pay for theirs too.

What about you have ever used another of your emails, without any dots, to register as a netfix user?

I prefer creating a unique email alias from dots more than plus. Especially if I sign up for something I'm worried will leak my email address to a third party, I use the dots. A malicious sharer of emails could trivially strip all the "+site@gmail.com" before sharing, but they can't know ahead of time if they get my primary email by adding or removing dots.

Also, a few times when I've signed up with "name+service@gmail.com", I've then failed to unsubscribe because their unsubscribe form didn't accept the + but the subscription form did.

The malicious sharer could modify the rule to not only remove the "+site" part but remove all the dots. Then, your trick is useless.

They might realize the "+site" and not the dots, but your point was about ability not awareness. ;)

except my "real" address has dots, so I know that 0 dots are being cleaned. I just can't tell who did it.

Which doesn't provide extra information for you, as you probably don't go around subscribing to spam mailing lists.

But all right, '+site' is more well known, so it does definitely work better.

I can’t belive how many services don’t validate email. I have a fairly common name and my gmail is first.last@gmail.com

I get so many emails that aren’t for me, more than one person out there thinks they have firstlast@gmail.com

Same thing happened to me with my original gmail address. So much spam before google was really good at filtering it. Had to change address to include my area code, and of course I don't live there anymore.

I don't understand this though, how do they think they have an email address if they were never able to create it or sign into it? I think more likely they forgot the number at the end or something like that.

I haven't had issues with the dot feature but have run into problems using plus.

My problem was that I used a "first.last+website@gmail.com" format when I signed up for a website and some time later I needed to contact customer support by e-mail. They had no record of my account because my e-mail came from "first.last@gmail.com" and not "first.last+website@gmail.com".

It turns out there is a way to send mail from "first.last+website@gmail.com" but I don't think it existed at the time.

* The below is copied verbatim from a deeper branch of the thread, but may clarify some things for others as well. *

Those are three different addresses. On some systems they may be three different accounts. On others they may be one account. On some systems, anything ending in '@example.com' may be a single account.

Email addresses are addresses. That's all they are. Stop pretending they are something else, and this will become much clearer for you.

The real kicker here though is that it IS possible to have registered a separate email address in gmail with a dot. My wife has been dealing with this in the opposite, she has a valid first.last@gmail and another person has a separate firstlast@gmail. She has the dot but frequently gets emails for the non dot address. We’ve gotten to know the person over like 10 years. If we’re victims of some sort of con game, then they’re certainly in it for the long haul...

But how do you know that the other person registered a gmail account, as opposed to, say, them registering the wrong email address with the email senders?

Send an email and see if that email shows up in your inbox?

If gmail ignores dots in the email address, of course that email is going to show up in your inbox.

And if it shows up it someone else's inbox then you know that the other person registered a gmail account with the dots, which was the question.

Which goes back to my question; how did he know that there is another inbox? Unless he happens to know the other person... well, in person.

And if he knows them in person, why hasn't either of them switched email addresses already (within the last 10 years)? Something doesn't add up here.

You should realize that there is no additional gmail account registered with no dots. Just your wife's account. And somebody simply signs up for things using your wife's address, because they feel like it should be theirs. This is a very common thing. https://xkcd.com/1279/

Removing the dots and the pluses is not enough.

Let's say that James Fisher also owns jameshfisher@yahoo.com. Eve finds that jameshfisher@gmail.com has a Netflix account, so she registers a new account with jameshfisher@yahoo.com. The scam proceeds the same way; if James registered for Netflix a while ago, he may not remember whether he registered with his Gmail address or with his Yahoo one (he has some services registered with the one, and some with the other). If he set up forwarding from his Yahoo account to his Gmail one, or if he's using a mail client, he may not even notice that the message went to a different address.

So the solution in this case is for Google to disallow registering jameshfisher@gmail.com if jameshfisher@yahoo.com already exists? Or to display phishing warnings on every email that was sent to a different address (and possibly forwarded)?

Maybe Netflix should simply verify the address upon registration after all.

> Actually, the blame lies with Gmail, and specifically Gmail’s “dots don’t matter” feature.

Totally wrong.

Dots don't matter is a great way to filter your messages without giving an obvious filter. An example...

I used to use first.last+yourcompany@gmail.com when I shopped online. But a lot of companies started blocking addresses that contained a "+" as an invalid address.

So now I use firstlast@gmail.com for general shopping, and first.last@gmail for friends and family. Lets me easily keep the same inbox, but filter all the unwanted crap.

Also, I like to rotate it around a bit -- since the lack of a dot doesn't really give me much insight... I will put the dot in based on which vendor I'm working with -- f.irstlas.t@gmail.com, for example -- then use my password manager to keep track of which vendor that goes to... another easy way to just block all crap I don't want from my inbox.

You've explained why dots don't matter is a useful feature, but that has nothing to do with whether it's responsible for some security issues.

I just got a non-dot response to someone paying their Duke Energy bill, addressed to my name. I did find another person with my name in Indiana so maybe they screwed up their rmail? I checked my credit and I have no fraud activity, so it’s just weird.

I don’t like the dots-don’t-Matter policy. It’s just an opportunity for abuse.

If they can get 6 months free access to Netflix with a dodgy CC, just keep going down that route. No reason to do the double scam when a single is working so well for you.

> Gmail already provides this in the better form of “plus labelling”

True, but lots of singups disable the +.

Netflix should do what everyone else does and do an email verification test.

Speaking of plus addressing, too bad gmail doesn't have a feature that automatically adds a label of the "detail part" of a plussed address, without having to create the label and a specific filter for it. That'd make it so much easier to create vendor-specific addresses.

1. ignore all mail coming to the base (no plus) address that isn't also whitelisted/greylisted (too bad gmail doesn't support greylisting)

2. give out foo+vendor to any vendor, or foo+date to throwaway time limited mail. now you can see how +vendor gets distributed and decide to block all such mail easily.

3. stop accepting the time-limited mail after some period. eg

  +2018     stop accepting after 2/2019
  +201803   stop accepting after 4/2018
  +20180407 stop accepting after 4/8/2018

boom, magic filters.

I don't understand why this post made it the front-page. As many have pointed out in the comments, Netflix should be verifying ownership of the account. Also, when you click the link, you would be either taken to your own logged in account on Netflix, or you'd try to log in with your canonical address. James in this case decided to get access to alternative email address Netflix account, but when he reset his password, the "attacker" can no longer control the account. They may still have sessions open that'll give them free TV for a while, but won't be able to change the password because that should trigger a prompt for the old password even when logged in. So I really don't see the attack vector here.

This seems like a really easy-to-fix problem on Netflix end: require the user to log into their account (or be logged in) prior to entering their payment information. This would completely eliminate the attack-vector the author mentioned.

I can understand wanting to minimize user-friction, but if you're asking someone to enter their payment information, it's very reasonable to have them log in first.

Email aliasing (dots/plus) in gmail is very useful to many people, and it seems overkill to blame Google for having introduced it. Besides, getting rid of it at this point would break backwards compatibility for a huge number of users, so the author's idea is completely infeasible.

I tentatively agree that it's an anti-feature and should be phased out, but the risk seems pretty small.

1) It can only be exploited on sites that don't verify email addresses, which is a relatively small number 2) In Netflix's case it's a pretty small "scam". $14 each month which you'd probably notice on your credit card history isn't going to break the bank. And presumably Netflix doesn't ever show a user's full credit card number, especially before email verification.

It's an interesting case, but I can't think of any bigger ways this could be exploited.

There's a bit of a logic issue in the proposed attack.

> 7. Change the email for the Netflix account to eve@gmail.com, kicking Jim’s access to this account.

This assumes that Eve is 1) still logged into the session despite the fact that Jim has changed their password and 2) that Netflix does not require a user to provide the current account password to change the email.

I have no idea if Netflix does item 1; it's debatable, although it might be a good idea in some cases. But item 2 is a super basic security; I can't imagine they don't do that. And if they do that, then there's no real attack here.

If they don't do item 1, you could pull off the scam by just staying logged in to the same session forever.

There are more ways to resolve this.

- Netflix shouldn't charge cards without verifying email addresses. Security should be an integral part of UX, and not subservient to it.

- Individual email address canonicalisation/resolve _could_ actually be a standard. I'm not sure whether it is or not, but if we can agree on emoji we could also maybe agree on something that binds the internet together. Email is infrastructure, Netflix is not.

- There is still a potential issue by having configured catch-all email addresses on some domains, but we should in that case optimise for the hundreds of millions of gmail.

Why is it okay for the link on the email to automatically sign you into your Netflix account? I received a similar email as well and suspected a phishing attempt and was genuinely surprised when it wasn't.

Gmail has all sorts of bugs or had. I had used to get a lot of email addressed to someone else. These were genuine email - when I forwarded them to the intended recipient (basically resend to the "to" address) I got responses from people thinking I am a hacker or being stunned why would I get their email. After that I decided to just ignore those emails, especially that I haven't got response from Google. These had in common that they didn't use gmail domain. It was long time ago and I don't think I got any of those recently.

Many here don't see a window of attack, the reasoning being that if the (presumably) malicious user gives the wrong email address they lose access to the account. Same outcome if the password gets changed by the recipient of the message. I'd like to offer a glimpse as to a potentially alternate outlook. Maybe it doesn't even apply to this specific situation, it nonethelss has a general relevancy to this conversation.

As an alternative (and sometime supplement) to the regular email/password sign-in, social sign-in is increasingly popular (mainly with OpenID Connect aka Authentication with OAuth2.0). A clear realization by many that have implemented social sign-in has been the separation of concerns between "account management" and "authentication management", which has the natural and arguably convenient side-effect of connecting multiple identifiers to the same account. The way it's done is that registered users are offered the possibility to add alternate sign-in methods to their existing account (e.g. you registered with Google, now you can add Facebook, or email/password).

The multiple login channels feature when correctly implemented with only OpenID Connect is safe since the identifier verification step is always part of the flow. Chances that the owner of the account unwillingly adds a sign-in channel not under their control is slim.

Consider on the other hand a situation where an organization would attempt to offer the same feature with OpenID Connect and their own email/password flow. If they do the latter à la Netflix, that is without confirming that the user owns the claimed email, there's your exploit window.

Malicious user John registers the account using social login (lets say Facebook). He later adds email/password as a login method along with an invalid credit card, but he uses unsuspecting user Jane's email, much like it was done in the Netflix case. Jane receives a message and thinking that it's her account that needs updating she first changes her password as a precaution, before "correcting" her credit card info. All throughout never realizing that an additional social sign-in option is enabled (Facebook).

As previously said here by many, always validate that the user owns the address you're communicating or authenticating with.

Can't understand people who are trying to place blame on a single service. IMO Gmail has to make those addresses disabled by default. I doubt that most mistypes come from dots, so it is useless to handle mistypes. So it is only useful to have those multiple email address to use them in different places. Then why enable them by default? You can still own them but they can be disabled until you need them. As for Netflix it is obvious that emails have to be verified before any usage begins.

The site that doesn't verify that the user who signed up owns their email is obviously at fault here. I had someone register on Twitter with my actual email, and it was never verified. Later when I wanted to register on Twitter I found that my email was banned because the user who registered with it was a random spamming bot from Malaysia. I was never even notified when someone signed up with my email, nor when my email was banned. Looks like Netflix uses the same braindead system.

Email addresses should only be used as contact info, not as a login name (and login names should also be different from your display/user name). Maybe I’m paranoid, but many sites will gladly tell anyone who knows your email that you at least have an account there. As the browser/password manager already fills in the password, why not just randomly generate the login name too? I currently use email aliases and burner email addressees on sites that don’t handle this well

ebay in india also has no email based verification and can use phone only based verification because users are actually more likely to have a phone # and only use sms than any email or chat app. A person from india used my mom's email address (a us resident/citizen) to sign up and purchase men's underwear from ebay.in (with no email verification). She had never signed up for an ebay account. I took over the ebay account and after speaking with an ebay rep it seems there was no way to even convert the ebay indian account to an ebay US account. Customer support in the US didn't even think it was possible to sign up for an account without a valid email and thought her email was hacked (which it wasn't!). Unfortunately all they could do is offer to disable the account forever. So now if she ever actually does want to use ebay she'll have to use an address like foo+ebay@gmail.com or intersperse her addr with dots assuming ebay allows it. I did email ebay's security disclosure team and I only got a reply saying that they would look into it.

For some added fun and since I was pissed for all this wasted time (figuring out what exactly happened, if my mom's email was hacked or not because I was very confused initially about not seeing an email verification email from ebay), I call the guy in india and asked if he had ordered some chaddi's, he said yes, freaked out and hung up the phone.

So yes the moral of the story is companies, PLEASE VERIFY YOUR USERS' email, or if you don't then don't associate that email address with the account and only do business with that user through SMS.

Many of these scams are based on people clicking links provided in emails. Just don't ever click on those links. Go to your favorite password manager and log in yourself.

It's a user's problem. If user is willing to click through some unsolicited email and pay, he will probably click on the verification link too if the service would send those.

It's still a statistics game. Not everyone would pay without verification and not everyone would click the big green button in the verification mail, but some people will without realizing what's up, just like people fall for Nigerian scams mails.

There's no technical solution, only education can help.

Lots of services send me legitimate e-mails asking me to update my credit card information. I'm supposed to click on those. They come from Netflix and all of the text in the e-mail tells me to click on them. I don't click on them because I don't trust links from e-mails, but I'm supposed to.

No service ever sends me account verification e-mails for existing accounts. I'm not supposed to click on those. The text in the e-mail has instructions about whether I should click on it. This makes it different from the credit card e-mail.

You don't click because you're educated in these matters. Most people are not.

Not clicking on the credit card update e-mail requires being educated in these matters. Not clicking on the account verification e-mail just requires reading the e-mail before clicking. I think that's an important distinction.

Depends on the service. I've seen verification e-mails that just contain a link with no other text. Or with texts like "Continue here: [link]".

I believe there is a technical solution. The verification link should ask you for a password or a passcode of some sort which is provided to you out-of-band --- ie, not via email. For example the webpage where you sign up can give you a short 6 digit passcode for the purposes of validating your email. Then the link that you are sent via your email directs you to a form that asks you for the passcode. That way another person can't validate the email if you mistype your email address as their email address and the validation link is sent to them.

That's pretty good. It would require some serious gullibility to defeat. If it's active attack, attacker may send the second mail with the passcode and instruct the user to enter it.

Though people are forwarding their second factor SMS confirmation codes for their banking accounts to attackers upon request, so it's not too far fetched someone would find a way to trick some users to enter it.

Here's one study about the phenomenon (the N is basically zero, but this happens and banks are warning people against doing this):

https://engineering.nyu.edu/files/VCFA_PasswordsCon15.pdf

This makes no sense. Only 1 person can receive the email with or without dots. How can this be taken advantage of when you have to login on netflix to update your card details?

You don't have to login to Netflix to update your card details. Since the link you follow is coming from inside your email account, effectively Netflix considers you to be already logged in. And we are arguing that they should not.

Completely disagree about the solution, I use that all the time and it's very useful.

This would be a Netflix issue IMO for not validating emails properly and allowing duplicate signups.

Have never thought about this vector, good to learn. Doesn’t the “+” matter too? You can sign up with <victim>+<anything>@gmail.com...

My work-around:

1. Create a filter on "To", with correct dotting, with the action being to apply a new tersely-named label e.g. "dot".

2. Color all instances of the new label a greenish shade to signify goodness. Do this by going back to Inbox, hovering over the name of your new label, clicking on the downward triangle, and following the menus from there.

Anything incoming lacking the green label is a suspect.

This is exactly why you need to normalize email addresses. The people who wrote the email RFCs just plain got it wrong, so it’s up to every SaaS site to do this so that they aren’t putting their users at risk. If someone is using an email with that’s the same as someone else’s except for the capitalization, it should be on them to get a new email address.

In gsuite dot matters.

My understanding is that the RFCs define how the Internet work so by definition, they are not wrong. You're certainly free to assert that they made a bad decision and I'm not qualified to offer an opinion on whether you are right or wrong.

However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong.

> However since Netflix is not managing email addresses in accordance with RFC-5322 They are clearly wrong.

Where are they not?

I was wrong. I cannot find any information that indicates that the RFC specifies that the period is not significant, only that it is allowed. In this case I suppose it is Google that is wrong.

How is Google wrong?

They consider email addresses composed of different (valid) characters to be equivalent.

They do? How so?

I disagree with the conclusion. I own the domain name sweet.id and it has catch-all email.

Apparently some people (all women so far) found my domain name cute, they use it to register services (usually Twitter).

Maybe they think "Email" field in the signup form akin to "Username", something you create instead of something you already have.

THere is SO much more to worry about than 'dots' https://www.reddit.com/r/sysadmin/comments/7wnz7e/this_years...

It's a Gmail issue. I sometime gets wrong mail coz of this FEATURE. Not talking about any specific site. Gmail to Gmail only.

Just to clarify with an example: My email is: abcd.wxyz@gmail.com Other guy: abcdwxyz@gmail.com

I wonder how many of my emails the other is receiving. All my stuff is linked with Gmail. Any suggestions to resolve this?

There is no "other guy" getting your emails.

There are just idiots who genuinely don't remember their own email address. So they'll type in your address, or the dotless variant of it, and as described for Netflix this "works" except you get all the stuff sent to you.

I get emails to my gmail account for some elderly person who lives in NYC about him not seeing his doctor all of the time. He has my same email address with a dot between his first and last name. I used to reply to the emails saying they had the wrong person, but now I just auto delete them.

Slightly off topic, but why Gmail built a feature of Dots Don't Matter is beyond me.

Might have been a happy accident for all I know, but it changes the behavior that people expect from emails, which IMO is a bit of an inconvenience for other systems that rely on uniqueness of email addresses.

Does it means that if I know a person's email is firstnamelastname@gmail.com, I can register firstname.lastname@gmail.com to sniff all the email of firstnamelastname@gmail.com?

If that is the case, that is pretty scary and I cannot trust gmail to proceed my payment related email anymore.

No, you can't sign up like that - you can choose to register the firstname.lastname@gmail.com and it will make that your primary. If you sign up without the dots, you get an error message:

"Someone already has that username. Note that we ignore full stops and capitalisation in usernames. Try another?"

I would note that while Gmail is the only one to ignore periods in the local part, many services ignore capitalization and face the same issue.

Many services do strip capitalization when checking email address uniqueness, but this is as much a mistake as stripping dots.

If you're reading this and thinking about implementing your own email registration flow, I suggest that you use something like https://portier.github.io/

The problem is simply that apparently you do not have to authenticate via password before entering/changing your credit card details. The scammed user should not be able to authenticate for the scammers account just by receiving an email.

> But firstly, no one wants this infinite set of email addresses.

Fuck off, that is my favorite feature.

Also while we're on dots, android has troubles with them, it suggests yo...ur.na..me.......@gmail.com and other variations on that theme. It's alright though, that's the kind of error that's so bad it's good.

Isn't email verification after onboarding, and prior to any account management emails a viable solution on the part of Netflix here?

What they want is an easy way to begin using subscription. What users need is a safer process to manage their account.

WIN-WIN?

Article is wrong in several ways. Like correcting someone's grammar, one should get the facts straight first. So many here have also got it wrong, so it's not super surprising but those posters here haven't gone and published a righteous article making wrong conclusions.

First, this is all on Netflix. Regardless of what any provider does, Netflix has to protect its own accounts and the obvious way to do that is to verify an email address before taking payment info. It could do that in a specific way (per-provider, understanding how gmail specifically treats addresses) but treating it in a generic way seem better and insulates them from changes to gmail or other providers.

Now, gmail certainly could do things that bring attention to the quirks of their own platform, but that doesn't take any of the onus off of Netflix or any other service to DTRT themselves.

The flaws in the article:

1. You cannot have an infinite number of addresses. per RFC 5321 par 4.5.3.1.1, only 64 chars are allowed in the mailbox name.

2. Further, unless the mailbox is quoted, eg "mailbox", then dots may not be at the beginning or the end, and consecutive dots are not allowed. (RFC 5322, par 3.4.1 and 3.2.3). The article doesn't mention the need for quoting in its description of "infinite" addressing. This is due to the use of dots to atomize the text around it, for domain name parsing. It happens to be used in the local-part for some reasons, I suppose because dot isn't otherwise allowed and they didn't want to create another named grammar item.

3. There is no requirement for plus or dot to be non-unique elements. RFC 5233 defines plus addressing, but this only applies to systems that care to treat the plus in this special way. There's no general requirement that foo+bar and foo+baz are both subaddresses of the foo mailbox; they could instead be 2 distinct addresses. The specific relevance is that Netflix should treat plus just like dot -- don't treat it specially.

Relying on email providers to do the right thing (read RFCs) so you can avoid best practices is the wrong conclusion to draw here. Netflix should validate all email addresses. It's really, really basic stuff.

I've read the RFCs for email. The RFCs explicitly state not to make assumptions about another site's use of the local part or how it maps an address to a user/account.

I think the best solution for this problem is to move the password setting after the email verification, so that if someone has an account attached to their email, it has a password that they sed.

Note the link in the article to throwaway credit card number provider (and yc company) Final is no longer valid because Final is defunct. Well, the link works, but you can no longer sign up.

I think I'm missing something here. If he reset the password and the email address of the account now points to his inbox, then how would the scammer get back into the account?

The two security issues are user phishing and Netflix not performing canonicalization of email addresses. he signup process itself is not a security issue.

The issue from the perspective of the user should be that the author clicked on a link in an html email, when he should have instead gone to Netflix.com. He clicked first and only then checked. Gmail even warned him of the phishing possibility, and he still clicked on the link! He is the vulnerability that was almost exploited.

It is true that there are other issues with user interactions, such as Netflix allowing signups without email verification, however those were purposefully designed that way by Netflix. They are features not bugs.

> Gmail even warned him of the phishing possibility

Where are you seeing this? I see no warning in the screen shot.

> Netflix not performing canonicalization of email addresses

AFAICT, Netflix CAN'T canonicalise the email address (unless they start making assumptions about specific providers) -- according to the RFCs, they can be different email addresses.

I appreciate the "dots don't matter" feature, but have always felt it required an API for external developers to canonize gmail addresses for this precise reason.

I wish the plus trick in Gmail would work with others... But most websites either think the address is badly formed or, in some cases, strip it out. Poor form if you ask me...

This happens when some company makes own sub-standard over existing. To follow their standard about dots, all programmers should hardcoode gmail.com domain check about dots.

In my college days I used for feature for ' refer your friend' promotions like uber, doordash etc. I still believe it works but haven't tried it recently.

It sounds like there are two security flaws: 1. No email verification upon account creation. 2. No sign in requirement when updating payment info (which seems absurd)

I don't agree with "It's gmail fault" and also I don't think Netflix should validate the e-mails. Why?

Most of the startups I work for don't require a valid e-mail when you enter your payment information. Reasons are multiple - conversion drop, "we took your money, we don't care", the e-mail is anyway entered with the payment provider, etc.

Also what comes to your e-mail and you act on is your responsibility. I don't know about you, but I don't pay for more than a dozen services with my card and I usually am aware when / what is being paid, so a scam like this would be easy to detect.

Exactly why I don't use a gmail email address for anything important (like my user accounts). Instead, logins for important accounts use my own domain name.

I guess this phishing attack is unfortunate but the dot thing is handy and, perhaps more importantly, people will stop getting their e-mail if they break it now.

>But firstly, no one wants this infinite set of email addresses

Weird, I've been using this feature for a decade. It's one of the features that keeps me on Gmail.

I don't get most people in this discussion... google is implementing something NOT standard, but the fault is Netflix?

That's not the internet is supposed to work.

I get it, but I absolutely use that gmail feature to give out different versions of my address to see where things come from. I'd hate to see it go.

So the dotless version is essentially the catch all, and anyone using a dotted version is at risk of losing some email to the dotless account holder?

So don’t click through from the link in the email. Just go to the website manually, like you should already be doing. Problem solved.

I think he missed one detail...

Eve in this scenario wouldn't be able to get back into the account once James had reset the password.

IIRC Netflix accounts stay logged in over password changes, but there would be no way to change the email back.

I really don't see how this could be an effective scam.

Netflix probably deliberately ignores this loophole because it boosts subscribers and revenue.

I'd guess 25 million Netflix users use gmail accounts (~20% of 120M).

I'd guess 1 in 100 of those have been victims of this scam.

This would mean 250,000 victims are overpaying a cumulative $30M per year.

Given how popular gmail is, Netflix and others should disallow duplicate account where the only distinction is the dots. They should also force email verification within 30 days of signup.

Get your own domain, problem solved. Hanging out where the rest of the world are is bound to cause problems.

That's why I use normalization for gmail addresses that my users use. It solves the problem completely.

It also doesn't help that ymail.com is a valid domain for yahoos email service. That is ripe for typos

Seems like a classic case of standardizing interpreting email moniker. Need an RFC for this

Reset that password and change all the contact info, now you have two netflix accounts!

A large portion of my gmails are incorrectly sent. I have a standard response ready.

Netflix deliberately doesn't verify sign-up email addresses. They are to blame.

I agree with the conclusion because for years I’ve gotten bills for this guy who has a middle initial different from me. Sometimes people put in the wrong email. For him it still works but I get all of his billing etc. Turning off dots would make their emails go away and his account more secured.

THere is SO much more to worry about than 'dots': https://www.youtube.com/watch?v=xxX81WmXjPg&ab_channel=FOSDE...

Pretty straightforward.

Using email for 30 years and TIL that dot's don't matter.

That's not a feature of e-mail. That's a feature of gmail. The dots do matter for many other e-mail providers.

I frequently use the dots-dont-matter feature as a substitute for plus-labeling when dealing with sites that prohibit pluses in their email addresses (which is painfully common).

That said, I have a firstname.lastname Gmail account and I get a lot of email following this problem:

https://xkcd.com/1279/

And some have the dot, and some don't. Piles of services. Sometimes I get confused for a second because they're services I use.... but maybe registered under a different account.

The number of emails that don't include a "this is not me" link in them is pathetic. Or that require you to sign in with a username and password to contact support.

You write very well, this post was good to read

this is nothing new. people used to do this in maplestory a long time ago for multi accounts under one email

Just test dots sont matter, And really they don't matter

workaround: define a filter

Something very similar happened to me because of the whole dot issue and Netflix not verifying their customer's email addresses (double opt-in). Someone created a Netflix account using a dot-variant of my Gmail and at some point, I received a similar email asking me to update my payment info. Right from the email, I saw it wasn't my account and thought someone else used my email by mistake (this happens a lot to me because I have a common name and a short email address).

What I usually do is request a password reset and delete the account or just remove my email address from the account. But in the Netflix case, the "update payment" button on the email log you to the account without asking for the password or anything. For the most part, people sign up to junk services/games or is just creating a throwaway account. But this was looking like a legit mistake. This person was actually using the Netflix account and had the payment info there and everything. I tried to just change the email address to something else but it required to confirm the password to change the email. I could just request a new password and change the email, but I was trying to be careful here because I didn't want to screw this person. I started to investigate a little bit more. Maybe this person had the account connected to Facebook, so it would be okay to change the password and remove my email and the account owner would still be able to log in. But it wasn't the case. I checked the watch history, just Peppa Pig and movies for kids. The name in the account was a female name. Probably a mom that created a Netflix account for her child. At this point, I was feeling super guilt to remove my email address and lock this person out of the account. All I could think of was a monday morning, the password not working, the kid crying out loud, the mom trying to figure it out. Anyway, I was just trying to not cause someone trouble.

So I thought about trying to find this person on Facebook or something. She had a not very common name so it shouldn't be hard. The payment method on Netflix was direct debit, so I had her bank account number. From the bank account number, I got the number of the bank's agency, and a quick google I discovered in which city her bank's agency was located, so it made the Facebook search very precise. There I was looking at her Facebook page. The profile picture it was a happy family of three: mom, dad, and the little child. Browsing a little bit her public feed I learned that her kid had my name (Vitor) and that explained why the account name had her name and the email address was a different name (her kid). So, either she created an email address for a 1-2 years old and mistyped it, or she just typed whatever email and created the account. The second option seemed more plausible. In any case, she seemed pretty much clueless and I thought about how to approach this and explain to her what was going on. So, I started to write a message... but it sort of started to sound weird/creepy, like how I got her contacts, and I was worried that she was going to think I was trying to scam her or something, so I gave up and said whatever. I still receive her (I mean, her kid's) movies recommendations.

Am I the only one who thinks this is a total non-issue? Neither Google, nor Netflix screwed up. Only the guy who wrote this ridiculous blog post.

This is very difficult to exploit and the most you could gain is a Netflix subscription. This is an incredibly complicated form of phishing which is entirely mitigated by the fact that it is difficult to execute for essentially zero return.

You have to be truly delusional to think that someone would waste their time trying to perform this attack when they could instead download a public sentryMBA profile and get hundreds of working accounts in seconds.

Oh my god. This is quite a hurried at conclusion that the "dots-do-not-matter" is a misfeature of Gmail. This feature has prevented so many instances of spam that I cannot count them. Of course, I love the "+spam@gmail.com" feature as well, but I can't use that as often because most email field validations prevent the "+" character in email addresses.

It's a Netflix issue. They let people register email addresses which they haven't proved to be in possession of.

Takeaway for developers: no email should be sent to unverified addresses, except the verification emails. An "I didn't register for this" link is also a must have in these letters.

Reply on news.ycombinator.com