Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

131–140 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#131

Post by unregistereddev »

MarkSweep wrote: post #106
chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

firstname.lastname@gmail.com can have similar problems. Somehow people miscommunicate or misremember their email address and I get a lot of misdirected messages.

I have firstInitial.lastName@gmail.com and have occasional problems with this as well, despite having a very uncommon last name.

Re: Someone keeps trying to reset my Facebook password

#134

Post by eamann »

I've been getting a couple of these each day for the past few days. It's always a bit entertaining. Partly because my email address is my name (so I know it's not likely a typo when folks enter the email address). Partly because I leverage GPG from the Facebook side so the messages are encrypted.

Meaning, even if they somehow had access to my email (they don't - strong, unique password and separate MFA) they wouldn't be able to get the reset code as it's encrypted by a key stored in secure physical hardware.

Still, kudos to the hackers for trying. Getting these emails means _someone_ cares enough about my account to want access. Even if I rarely use it for anything other than checking in on distant relatives ...

Re: Someone keeps trying to reset my Facebook password

#135

Post by q1w2 »

borbulon wrote: post #22

It’s a satiation attack (my term). The hope is you’ll get so frustrated at the frequency of the emails that you’ll eventually just press yes or ok or whatever it is that allows the reset.

No, because the attacker needs to enter the recovery code sent by email.

My assumption is that they're just guessing over millions of accounts and are expect 1-2 to hit so they can take over those accounts.

Re: Someone keeps trying to reset my Facebook password

#136

Post by obblekk »

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames.

Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password.

It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at the bottom of the email as an imperfect solution to balance short-term spam and long-term lockout (with an override if the device id requesting the reset had recently been logged-in to the account).

Idk if that still exists on IG but doubt it was ever ported to FB.

Re: Someone keeps trying to reset my Facebook password

#137

Post by happymellon »

bhartzer wrote: post #129

I own the domain of my last name. Several family members use (firstname@lastname.com). I once went to get a new phone at Best Buy, and the employee needed my email address. I gave it to here (firstname@lastname.com) and she insisted that it was NOT my email address. She insisted that it MUST end in @gmail.com or @yahoo.com, something like that. We frequently sign up for stuff online, and when we enter our email addre…

When I first got a dot UK address a lot of forms refused to accept it, demanding that I use org.uk or co.uk instead.

It was really annoying, luckily it doesn't happen as much anymore.

Re: Someone keeps trying to reset my Facebook password

#138

Post by sdflhasjd »

bhartzer wrote: post #129

I own the domain of my last name. Several family members use (firstname@lastname.com). I once went to get a new phone at Best Buy, and the employee needed my email address. I gave it to here (firstname@lastname.com) and she insisted that it was NOT my email address. She insisted that it MUST end in @gmail.com or @yahoo.com, something like that. We frequently sign up for stuff online, and when we enter our email addre…

Whereas I made the opposite mistake of having firstname@outlook.com

I get ungodly amounts of spam, relentlessly, from everyone. Because anyone over the age of 50 seems to give it as their email to companies like Target.

Re: Someone keeps trying to reset my Facebook password

#139

Post by jlokier »

I got one of these "someone request a password reset" mails from Facebook yesterday. I don't think I've had one before, and my email on its own domain I've had for ~20 years doesn't seem to be one people type by mistake.

I thought it was probably phishing, yet the links all looked legitimate, including the one for password reset and the one to tell Facebook I didn't request the reset.

So I thought it might be a homoglyph attack (a URL that looks legitimate but isn't because it's using alternate characters that look the same or similar), and rather than click the link saying I didn't request the password reset, I logged into Facebook hoping to find a notification or something in the account settings logging that it was a genuine request.

I was surprised to see no notifcation, nor anything in the account settings and security area.

I was also surprised to see I needed to login again, as I thought Facebook kept a long term session open for longer than the 2 weeks since I'd visited it previously.

If it was a tricky method to get me to login to Facebook again, it worked! But I didn't stay long after I didn't find what I was looking for.

Re: Someone keeps trying to reset my Facebook password

#140

Post by e40 »

I got one for an email that I didn't think had a FB account, and when I tried to reset the password I get:

  You’re Temporarily Blocked
  
  It looks like you were misusing this feature by going too fast. You’ve been 
  temporarily blocked from using it.
  If you think this doesn't go against our Community Standards let us know.
Got that on the first time I tried it. What a joke.
Post reply on HN