Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid Patterns

darshit.dev

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Stupid Patterns

#21

Post by jonathanlydall »

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of:

> You may need to create an account.

> We received a request to reset your password on BestBuy.com.

> However, we don't have an account associated with this email address. You can try to sign in with a different email address.

> You can also create a new account using any email you choose.

> Happy Shopping!

My guess is that it's a bad actor doing something like password stuffing to try see if my email address has an account there that they can try compromise. It's also possible someone thinks my email address is their email address, I doubt it though because in the 16 years I've had the Gmail address I've never received an email intended for someone else.

Regardless, I've never lived in a country in which Best Buy operates, but some "genius" at Best Buy thought it would be a brilliant idea to email people who they know don't have an account with them, because there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to.

After getting these annoying emails a few times I landed up making a Gmail rule to always report them as spam, then delete them.

Re: Stupid Patterns

#22

Post by iamstupidsimple »

> I never received any further emails because the user probably never recharged his internet subscription.

> This wasn’t even a spam email!

I disagree, if it's not intended for you, then it's spam. Marking these emails as spam might affect the company's delivery rates and get them to actually fix the broken process that allowed this to happen.

Re: Stupid Patterns

#23

Post by mikro2nd »

spzb wrote: post #13
123pie123 wrote: post #12

does this describe the various companies that phone me and then ask me to prove my identity to them?

Pet peeve of mine. Especially when it’s a bank or other finance company that really ought to know better.

And then are at a loss when you demand that they identify themselves to you. After all, all you've got is a voice at the end of the phone. Seriously I'm sure there's good ways to solve this using some simple crypto(graphy, not currency). We ought to be able to mutually authenticate without resorting to stupid questions about things we were doing 25 years ago and no longer remember.

Re: Stupid Patterns

#24

Post by Macha »

HelloNurse wrote: post #2

This is nothing. I have a very common name and a very common surname and people have used my email (name.surname at gmail.com plus the infamous GMail variants such as namesurname or NameSurname) for purposes like accounts on dating sites, Spotify, Instagram etc.; invoices; banks and insurances; resumes and job applications; medical test results; newsletters and all kinds of personal communications. "I" am a local pol…

Yeah, I have firstnamel@gmail.com for my actual name. I get this from time to time, but 90% of the mixups are actually down to one guy, an older latino guy (judging by the surname used) with interests in car rentals, ford trucks on second hand sites, and dating sites. He's given my email so many times, I'm convinced he thinks it's actually his email.

Re: Stupid Patterns

#25

Post by Macha »

rerx wrote: post #7
OisinMoran wrote: post #4

Earlier quoted context omitted.

> In most cases there is no practical way to verify email addresses What's wrong with "Click the link in the email we just sent to x@x.com to verify your email"?

A malicious recipient can click the link and exploit that their email is now associated to the account of some other person.

Compared to the current status of doing nothing, where the malicious recipient has their email associated to the account of some other person without even having to click a link?

Re: Stupid Patterns

#26

Post by cebert »

I have a very short gmail email address which I’ve noticed intersects with several common names. I had not idea how rampant this issue is. I get a woman’s Victoria Secret orders and address, school progress reports for a child that is not mine, worship team updates for a Mormon church, a Snapchat account, vet updates, German emails I don’t even know how to read, and many more unusual emails for people who aren’t me. What’s worse is for group emails (e.g worship emails) I try to reply all and inform them of the mistake and only get more emails for the wrong person.

Re: Stupid Patterns

#27

Post by bserge »

tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

They didn't verify the phone number when he signed up (with a simple OTP)? Wow

Re: Stupid Patterns

#28

Post by DenisM »

mikro2nd wrote: post #23
spzb wrote: post #13

Earlier quoted context omitted.

Pet peeve of mine. Especially when it’s a bank or other finance company that really ought to know better.

And then are at a loss when you demand that they identify themselves to you. After all, all you've got is a voice at the end of the phone. Seriously I'm sure there's good ways to solve this using some simple crypto(graphy, not currency). We ought to be able to mutually authenticate without resorting to stupid questions about things we were doing 25 years ago and no longer remember.

We are able, I think.

Say, my bank calls me and ask to call back with an extension#. I look up their phone # on their website, call that number, and provide the extension.

They know who I am via The extension # I gave back to them, I know who they are via their phone # confirmed by their website SSL certificate.

Alternatively, I call them back on the phone number at the back of the credit card.

Re: Stupid Patterns

#29

Post by Khaine »

It not just emails where this happens. Some idiot has been giving out my work mobile number as his own. I got a call from his aunt to wish him happy birthday (she was incredulous when I explained that no, this isn't X's phone, and I don't know x). I get random texts from I assume his friends, and calls from collection agencies.

Re: Stupid Patterns

#30

Post by tsycho »

tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

A bunch of people use my email address for signing up to all sorts of websites (I have a common name, and my email is basically my name @ popular email provider). It is annoying to receive all this spam (usually I can unsubscribe), but the worst ones are people using my email for their bank accounts.

So now I get multiple password-protected monthly statements every month, and there is no way to unsubscribe since it's a bank statement. And the email subject doesn't have the full account number, and the email is from a no-reply address. Contacting the bank has been useless even when I found a way to do so. The most annoying one is from a bank where I have an account of my own (they used a capitalized version of my email address, which the bank thinks is a separate email), and so I can't block them all emails from this bank either.

The one fun time was when someone (in Asia) would frequently place food delivery orders using my email, and this service would send multiple emails for each order. Frustrated, I canceled their order once directly from the email, after which this particular problem stopped.

Post reply on HN