The dots do matter: how to scam a Gmail user
&gt; The dots do matter: how to scam a Gmail user<p>The dots do not matter, this does not enable a scam, and 99% of people replying to this seem to have utterly missed the point.<p>First off, let&#x27;s be clear:  The story is about someone who entered the <i>wrong</i> email.  They should have entered &quot;eve@foo.com&quot; but actually entered (or later changed it to) &quot;james@foo.com&quot;, which means that James got some emails from Netflix about Eve&#x27;s account, incorrectly assumed they were about <i>his</i> account, reset the password on Eve&#x27;s account, and came close to entering payment information into it.<p>All of which is fine; this is how email works, and how modern services (correctly) use email:  By identifying an account with an email address, and assuming that if you have control of the email address you should have control of the associated accounts.<p>The author is weirdly focused on the fact that gmail allows some flexibility in how the local part of the address is interpreted, but this is a feature of most email providers (yahoo, outlook.com, protonmail, and fastmail all do it), and is a feature offered by qmail, courier, and postix as well.  It&#x27;s also explicitly required by the relevant RFCs.  And...<p>...it&#x27;s utterly unrelated to the issue at hand.  This isn&#x27;t <i>about</i> how the local part is interpreted; it&#x27;s about someone typing the wrong address that they don&#x27;t control when they sign up for an account.  Sub-addressing and the details of how some random mail server normalises the local part is <i>not what this is about</i>.  If gmail bounces all emails with &quot;incorrect&quot; periods, it might have stopped this particular incident, but it doesn&#x27;t solve the issue which is about people giving out your address instead of their own when creating an account, which is the actual issue here.<p>Further, the proposed scam, if it works, only works because (allegedly) Netflix lets you change an account email without verifying that you know the current password.  This violates every tenant of account security; because email is used to prove you control an account (allowing, eg, password resets), <i>changing</i> the email obviously requires you to prove you control the account.  You have to ask for the password!  I rather suspect Netflix does, but if not, this is the core issue.