Instead of deleting account, NYT appends ‘1000’ to username and email address • Hacker News Board

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#21

Post by thanksforfish » Tue, Apr 28, 2020, 1:01 PM UTC

yaur wrote: post #16

diggan wrote: post #11

Earlier quoted context omitted.

Most likely the 1000 is appended to the local-part of the email address, not the domain, as any tool they are using for changing details most likely validates emails somehow.

The email address doesn’t really need to be valid though. I have an old client that appended ‘|disabled’ after the email address (and torched the password) when “deleting” accounts because they needed them in the DB for audit logging. Unless someone figures out how to register a domain ending in ‘.com|disabled’ I’m not sure how someone would be able to access those accounts.

Every week we see multiple articles about security researchers who abuses some part of the tech stack to do something weird that shows the danger in this sort of thinking.

I believe it's easy to spoof emails from the .com|disabled domain. Receiving messages, I agree, seems harder. Maybe spoof an unencrypted DNS response at the right moment? No need to actually register a domain when DNS is spoofable.[1]

If you really need to use a hack like that to disable an email, consider adding some code to your email sending logic that skips such email addresses (and always use that logic). Otherwise clever hackers have a foothold to try their tricks against.

[1] https://en.m.wikipedia.org/wiki/DNS_spoofing

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#22

Post by thanksforfish » Tue, Apr 28, 2020, 1:02 PM UTC

gruez wrote: post #20

hobs wrote: post #18

Earlier quoted context omitted.

Completely wrong, dont just munge someone's email and hope it wont work, we literally have domains for this kind of stuff. https://www.iana.org/domains/reserved

Chances of com1000 being delegated is low.

Why would it need to be designed? Email delivery depends on DNS, which is unencrypted and spoofable. Spoofing emails is also doable.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#23

Post by OutsmartDan » Tue, Apr 28, 2020, 1:12 PM UTC

NYT is notoriously the worst at customer service and account handling. I tried to get a previous invoice from them previously and after 1 week of calling customer support and being passed around, I still wasn't able to get it.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#24

Post by jbverschoor » Tue, Apr 28, 2020, 1:13 PM UTC

Many companies do this

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#25

Post by inopinatus » Tue, Apr 28, 2020, 1:16 PM UTC

I’d bet (a small amount of) money they have no ability to delete accounts at all, and it goes all the way down to foreign key constraints introduced by a well-meaning but inexperienced developer that unnecessarily couple the accounts table to many other records.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#26

Post by yepthatsreality » Tue, Apr 28, 2020, 1:21 PM UTC

jbverschoor wrote: post #24

Many companies do this

Yes especially in New York. I once asked the Curb cab app to delete my account. They replied with an email that they did and I checked the app. My session was still valid and I could see my account details. All they changed my email address domain to @aol.com and 555’d my phone number.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#27

Post by lubblig » Tue, Apr 28, 2020, 1:22 PM UTC

tobr wrote: post #8

No information on how they found out? Did the service rep tell them?

From the Twitter replies: "the number was appended to local-part, not the domain. I found out by going back to a tab where my session was still valid but the account dropdown had updated with the new name. Profile settings revealed the email." https://twitter.com/bicycult/status/1255122953798328320

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#28

Post by londt8 » Tue, Apr 28, 2020, 1:23 PM UTC

inopinatus wrote: post #25

I’d bet (a small amount of) money they have no ability to delete accounts at all, and it goes all the way down to foreign key constraints introduced by a well-meaning but inexperienced developer that unnecessarily couple the accounts table to many other records.

Why not just anonymize the data instead? Not using foreign key constraint just for the sake of GDPR sounds weird.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#29

Post by loopdoend » Tue, Apr 28, 2020, 1:24 PM UTC

thanksforfish wrote: post #22

gruez wrote: post #20

Earlier quoted context omitted.

Chances of com1000 being delegated is low.

Why would it need to be designed? Email delivery depends on DNS, which is unencrypted and spoofable. Spoofing emails is also doable.

If the dns lookup on a com1000 domain fails, the email won’t go anywhere.

Re: Instead of deleting account, NYT appends ‘1000’ to username and email address

#30

Post by thanksforfish » Tue, Apr 28, 2020, 1:37 PM UTC

loopdoend wrote: post #29

thanksforfish wrote: post #22

Earlier quoted context omitted.

Why would it need to be designed? Email delivery depends on DNS, which is unencrypted and spoofable. Spoofing emails is also doable.

If the dns lookup on a com1000 domain fails, the email won’t go anywhere.

Correct. But if a DNS response for that domain is spoofed. It will.

DNS is a very old protocol that still has lots of problems and mitigations like DNSSEC are only partially deployed.