Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid Patterns

darshit.dev

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Stupid Patterns

#31

Post by jerrre »

jonathanlydall wrote: post #21

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to create an account. > We received a request to reset your password on BestBuy.com. > However, we don't have an account associated with this email address. You can try to sign in with a different email address. > You can also create a new account using any email…

> there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to.

I think you overestimate your less computer savvy fellow humans :) Also it could be phishing?

Re: Stupid Patterns

#33

Post by shkkmo »

jonathanlydall wrote: post #21

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to create an account. > We received a request to reset your password on BestBuy.com. > However, we don't have an account associated with this email address. You can try to sign in with a different email address. > You can also create a new account using any email…

This doesn't seem stupid at all.

BestBuy is considering two different scenarios and trying to handle both:

BestBuy is avoiding leaking account status on their password reset page. This is done precisely so that people who don't have access to the email account can't figure out where you have accounts registered. This is a pretty standard approach.

BestBuy is providing visibility to people who can't remember if they have accounts or which email they signed up with. Simply trying to reset your password and never getting an email leaves you in a situation where you are unsure if you waited long enough, missed the email, the business is having deliverability issues, or if you have an account. Having worked with businesses around reports of password reset email deliverability issues, it makes complete sense to me.

This all seems like a perfectly reasonable approach.

Re: Stupid Patterns

#34

Post by lokar »

tsycho wrote: post #30
tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

A bunch of people use my email address for signing up to all sorts of websites (I have a common name, and my email is basically my name @ popular email provider). It is annoying to receive all this spam (usually I can unsubscribe), but the worst ones are people using my email for their bank accounts. So now I get multiple password-protected monthly statements every month, and there is no way to unsubscribe since it's…

I have a 3 letter Gmail account. This is all I get.

Re: Stupid Patterns

#35

Post by tombrossman »

tsycho wrote: post #30
tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

A bunch of people use my email address for signing up to all sorts of websites (I have a common name, and my email is basically my name @ popular email provider). It is annoying to receive all this spam (usually I can unsubscribe), but the worst ones are people using my email for their bank accounts. So now I get multiple password-protected monthly statements every month, and there is no way to unsubscribe since it's…

Try switching to an email service that supports custom Sieve scripts, which you can use to permanently reject messages based on variables you configure.

These are handled differently than message user agent filtering. Incoming messages are immediately rejected and the sending server is notified.

It's much easier than trying to contact some company that doesn't bother validating email addresses. You already know they are technically deficient so just bounce everything. Problem's at their end, let them work it out.

Fastmail do this, as do a few other hosted email providers. Highly recommended. I also use Sieve filters to reject attachment types beyond the default set, such as Microsoft Office files (.docx, .doc, etc.).

Here's some documentation to get started. No affiliation, just a happy customer. https://www.fastmail.help/hc/en-us/articles/1500000280481-Si...

Re: Stupid Patterns

#36

Post by feupan »

dmurray wrote: post #16
rerx wrote: post #7

Earlier quoted context omitted.

A malicious recipient can click the link and exploit that their email is now associated to the account of some other person.

This seems like a relatively small vulnerability in practice. But it could be mitigated by "click the link and enter the one time code we gave you at sign-up time". Too much friction? How about "click the link on the same browser you used to sign up, and we'll verify that using a cookie we just set" - functionally equivalent and probably works for 90% of users while the rest can fall back to the one time code. I've s…

> presumably most people don't roll their own verification process

Oh boy. Auth is that thing that looks so easy because you just need to store an md5 password to feel like hackerman. If people actually used existing solutions, web logins wouldn’t be in such dire conditions.

Re: Stupid Patterns

#37

Post by feupan »

cebert wrote: post #26

I have a very short gmail email address which I’ve noticed intersects with several common names. I had not idea how rampant this issue is. I get a woman’s Victoria Secret orders and address, school progress reports for a child that is not mine, worship team updates for a Mormon church, a Snapchat account, vet updates, German emails I don’t even know how to read, and many more unusual emails for people who aren’t me.…

Every time I get a second message after my “wrong number” text I lose a little more faith in humanity. I regularly get voicemails and calls on my Google Voice number and people reply with stuff like “oh then tell him blah blah”.. sigh

Re: Stupid Patterns

#38

Post by MaxBarraclough »

tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

> Finding no other option, I used Tata sky IVRS service calling from my mobile number(linked to his account) to subscribe to a bunch of expensive channels, totalling the monthly subscription fee to 10x of what his usual fee was.

This is, presumably, a crime.

Re: Stupid Patterns

#39

Post by HelloNurse »

dmurray wrote: post #16
rerx wrote: post #7

Earlier quoted context omitted.

A malicious recipient can click the link and exploit that their email is now associated to the account of some other person.

This seems like a relatively small vulnerability in practice. But it could be mitigated by "click the link and enter the one time code we gave you at sign-up time". Too much friction? How about "click the link on the same browser you used to sign up, and we'll verify that using a cookie we just set" - functionally equivalent and probably works for 90% of users while the rest can fall back to the one time code. I've s…

Allowing password reset requests (or activating the account in full) before the email is verified, so that I can reset the password and take over the account, means that the holder of the email prevails over the password holder: a severe protocol design error, which can be made even worse by accepting payments before the email is verified or by restricting account creations attempts.

Not all careless stupidity should be attributed to the website admin, however: assholes using random email addresses and phone numbers deserve to be punished, and knowing one's own email addresses is a basic literacy requirement.

Re: Stupid Patterns

#40

Post by jonathanlydall »

shkkmo wrote: post #33
jonathanlydall wrote: post #21

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to create an account. > We received a request to reset your password on BestBuy.com. > However, we don't have an account associated with this email address. You can try to sign in with a different email address. > You can also create a new account using any email…

This doesn't seem stupid at all. BestBuy is considering two different scenarios and trying to handle both: BestBuy is avoiding leaking account status on their password reset page. This is done precisely so that people who don't have access to the email account can't figure out where you have accounts registered. This is a pretty standard approach. BestBuy is providing visibility to people who can't remember if they h…

It's very normal for password reset pages to say something to the effect of "if this email address is registered with us, you will receive an email..." and they can could also add something like "you can also try create an account here".

Instead they opted for the option where every time a "hacker" is trying to use the form to compromise an account, it spams the victim with this email. As most of the world is not North America, it is statistically most likely that the email recipient is someone who's most assuredly never going to be a Best Buy customer.

Post reply on HN