Someone keeps trying to reset my Facebook password • Hacker News Board

Re: Someone keeps trying to reset my Facebook password

#101

Post by Zambyte » Thu, Sep 07, 2023, 2:10 PM UTC

kevincox wrote: post #87

em-bee wrote: post #49

Earlier quoted context omitted.

on the systems where i had to do this for my account i usually get a message like: "an email has been sent to the address registered with this account" there is no benefit to reveal any details.

The benefit is that people often don't remember which email they used for a service. They check their "main" email inbox but don't remember that they used their student email address 8 years ago when they signed up. By providing a hint they know which inbox to check and don't get frustrated because the email isn't coming. So it is a privacy tradeoff for better UX. If it is a good tradeoff will depend on how much you…

Why not just login to all of your email accounts in your email client?

Re: Someone keeps trying to reset my Facebook password

#102

Post by Zambyte » Thu, Sep 07, 2023, 2:13 PM UTC

SirMaster wrote: post #91

Facebook is almost un-usable for me. Every week or so they lock my account due to "suspicious activity" even though I haven't used my account. I have all the security features and such turned on like MFA and a strong password (that I have to change like every week after every time my account gets locked). There is no useful info in the security logs. I have no idea what to do to stop this from happening.

> I have no idea what to do to stop this from happening.

I think deleting the account would stop it :P

Re: Someone keeps trying to reset my Facebook password

#103

Post by framtidsljus » Thu, Sep 07, 2023, 2:13 PM UTC

I keep getting password reset emails from Spotify, from 0 to 10 times a day. Having a two character username seemed like a good idea when signing up.. Really annoying.

Re: Someone keeps trying to reset my Facebook password

#104

Post by jcpham2 » Thu, Sep 07, 2023, 2:13 PM UTC

ChildOfChaos wrote: post #99

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

I have a simple@Gmail.com address and I have this problem quite a lot, were i get a lot of random stuff. Sometimes from the same person, there starbucks card seems to be linked to it for example. Annoying.

I took was an early adopter of gmail and I imagine a person could guess what my email address is, especially if I said I keep forgetting my HN passwords.

Misplaced periods give me all sorts of other people's emails - new cars, new mortgages, new bank accounts, new home purchases that are not in my name or identity (based on the names I understand the confusion) - all sorts of things that I'm not doing IRL. Sometimes I try to reach out to the sender and get them to correct the email address, sometimes I just unsubscribe

Re: Someone keeps trying to reset my Facebook password

#105

Post by gigel82 » Thu, Sep 07, 2023, 2:13 PM UTC

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

I get the same with @outlook.com ; managed to sign up right as the service was launched and thought I scored :)

After a couple of years gave up on that address as it was getting dozens of messages a day (a lot of them legit email, sent to the wrong address - including bank statements, shipping orders, etc.)

Re: Someone keeps trying to reset my Facebook password

#106

Post by MarkSweep » Thu, Sep 07, 2023, 2:14 PM UTC

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

firstname.lastname@gmail.com can have similar problems. Somehow people miscommunicate or misremember their email address and I get a lot of misdirected messages.

Re: Someone keeps trying to reset my Facebook password

#107

Post by jcpham2 » Thu, Sep 07, 2023, 2:14 PM UTC

tomhoward wrote: post #59

luma wrote: post #56

Earlier quoted context omitted.

Folks in the thread noted that the recovery code sent was the same each time, which leads me to think it might have been a phishing attack. Send email that looks like FB recovery, but have the links go to some domain you own and snarf up creds, including MFA etc.

Not in my case; I've had two password reset emails in the past 3 days (having had none since February) and both have gone simultaneously to the different email addresses I have on the account, with different codes on all the emails (even the ones sent at the same time), and the click-through URL is certainly on the legit Facebook domain.

I got one yesterday I ignored

Re: Someone keeps trying to reset my Facebook password

#108

Post by qwerty456127 » Thu, Sep 07, 2023, 2:16 PM UTC

hathchip wrote: post #70

qwerty456127 wrote: post #57

Earlier quoted context omitted.

They will just wait for you to get used to this, then stop triggering Facebook to send you legitimate emails and start sending you similarly-looking phishing emails similarly often. It may happen to be enough to view a phishing email, let alone click anything in it to get pwned.

surely the more of these they send, the less likely you are to click on them

Very questionable. Some people will come to completely ingoring them (which isn't good either), some will click anything out of being too annoyed. Whatever, people can be manipulated into doing some statistically predictable actions with decreased awareness this way and this is a vulnerability.

Re: Someone keeps trying to reset my Facebook password

#109

Post by Johnny555 » Thu, Sep 07, 2023, 2:16 PM UTC

ChildOfChaos wrote: post #99

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

I have a simple@Gmail.com address and I have this problem quite a lot, were i get a lot of random stuff. Sometimes from the same person, there starbucks card seems to be linked to it for example. Annoying.

Same, I get a lot of sensitive correspondence, things like divorce settlements from lawyers, mortgage applications, correspondence with doctors with a lot of personal details (that the person cc’ed me on), airline reservations, etc.

Usually I’ll reply to the sender and tell them they have the wrong email address, some don’t believe me, sometimes they ask me if I know the person (out of a billion gmail users), some complain that I took to long to tell them about the wrong address, and sometimes a lawyer will direct me to delete all copies of the errant email…

I always reply back to tell them that the email lands on multiple devices and is downloaded and backed up automatically and to see if they want to pay me on a time and materials basis or if they want a project based fee. None have been willing to pay me to cleanup their mistake.

Way back when I signed up with gmail, I was happy to get a first-initial.lastname@gmail.com address, now I wish I’d gone with something more obscure.

Re: Someone keeps trying to reset my Facebook password

#110

Post by joezydeco » Thu, Sep 07, 2023, 2:16 PM UTC

laurencei wrote: post #93

johngladtj wrote: post #2

Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.

Yeah - and what is crazy is when you think about it - Microsoft generates a 6 digit code. So it is a "one in a million" to randomly guess what the code is on any given login. But it is "one in a million" for each Microsoft account you know about - and if they have millions of email addresses, and automate it each day (I also get attempts 1-2 times per day). Yes - the odds are small - but there is a greater than 0% ch…

I'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery?

Because I'm a bit concerned if Microsoft passwords are leaking.