Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to send password reset notification email

scriptogr.am

Post reply on HN
Print view View original

21–30 of 44 posts

Re: How not to send password reset notification email

#21

Post by DocG »

worst cases of emails I have gotten are from Sony. For example, Planetside 2 beta acceptance letter came from info@e-sonyonline.com and without ANY personal information. It was the most generic official letter I have received. Link to download PS2 was also from link.e-sonyonline.com. I disregarded it first, only after a while, discovering it was genuine. And a lot of people are having doubts about this aadress, just google it.

Also, their password reset letter comes from something like contact@p7s1games.net. I usually disregard everything like this automatically. Luckily reset link is planetside2.eu.

Re: How not to send password reset notification email

#22

Post by jere »

Three years ago, 37signals wrote an email saying all users would have to pick new user names and passwords (I guess changing to a single sign in across all apps).

It was fairly well written, but I swore it was an elaborate phishing scheme. Here is an example of one of the URLs they used: http://37signals.cmail4.com/t/y/l/uiulli/kkulljtjr/d

Now looking back, it's clear they were simply using a redirect URL to track clicks, but I had no clue. You can't even go to cmail4.com without getting an error and no description about what the service is.

Re: How not to send password reset notification email

#23

Post by kybernetikos »

Offical email should never include links (unless it's signed, but what is?), the potential for trouble is just too great. I had this exact same problem back in 2003 from a financial company. I wrote them a serious email telling them just how dangerous it is to teach your users that it's OK to click on links that don't even go to your domain in random emails. I even showed them how easily I could create a phishing site.

The person who organised the email drop clearly got some hassle over it and sent me a response personally, but clearly still did not understand the problem.

Re: How not to send password reset notification email

#25

Post by unclebucknasty »

kybernetikos wrote: post #23

Offical email should never include links (unless it's signed, but what is?), the potential for trouble is just too great. I had this exact same problem back in 2003 from a financial company. I wrote them a serious email telling them just how dangerous it is to teach your users that it's OK to click on links that don't even go to your domain in random emails. I even showed them how easily I could create a phishing sit…

I guess here Evernote figured any instructions they sent would have resulted in a link being sent anyway, so why not just send the link and ensure a higher shot off compliance.

They seemed to have forgotten about phishing.

Some sites have taken to including in such emails account information that presumably only the company would know (such as part of the account number) along with the name. I know of at least one bank that does this. The idea, of course, is that the user can then verify that it must be coming from the company.

This can be reassuring when the email is legit, but the problem is that it requires the user to remember for subsequent emails that such information should be present. So, if a phishing attack comes, will the user stop and think, "hey, where is the personal account info?" Some will, but many won't. I mean, if a user can't be trusted to follow a simple set of instructions (thus needing links), then how can he be expected to remember the security policies of every company for which he is a customer?

Re: How not to send password reset notification email

#26

Post by ringmaster »

I was disappointed by this headline. After resetting my Evernote password this morning, I was looking forward to reading about a new technique that would allow me to avoid password resets in the future. Oh, well.

Is anyone working on such a thing?

(While I'm thinking of it, wordpress.com's password reset should be shot. I get several emails a day because it allows resets by username instead of email or username+email. This whole password issue needs some better minds assigned to it.)

Re: How not to send password reset notification email

#27

Post by jlogsdon »

signed0 wrote: post #16
akaBruce wrote: post #14

Earlier quoted context omitted.

If the server running on links.example.com, wouldn't the 3rd party web server lose out on doing things like setting cookies in the client's browser or determining their rough location via IP address? Not that I'm particularly a fan of either practice, but there's probably some use cases there that would have to be accounted for in some way that the 3rd party service could accommodate.

If that were needed perhaps links.example.com could display an iframe containing the third party site. I agree that neither approach is ideal, but it would prevent users from receiving third party links in their emails.

Those cookies would be blocked for browsers with 3rd-party cookies disabled, and Firefox is making that option the default at some point in the near future.

Re: How not to send password reset notification email

#28

Post by PeterisP »

rorrr wrote: post #17
signed0 wrote: post #12

Earlier quoted context omitted.

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

You would have to know the URL on the third party server to redirect to. And usually, you don't, because they are generated internally by some pre-processor.

Why can't you automagically redirect from mkt5371.evernote.com/anything to links.evernote.mkt5371.com/anything ?

Better yet, simply point your DNS "passwordreset.evernote.com" to the same server.

Re: How not to send password reset notification email

#29

Post by jordanthoms »

signed0 wrote: post #12
rorrr wrote: post #10

Earlier quoted context omitted.

It's rarely up to a developer. For websites with large email campaigns there's usually a third party system, which has some link tracking feature. And guess what, your marketing department is using it, and they don't want to switch to your custom one (which will take a few months to code, debug, implement all kinds of reporting compatible with what they do now).

In this case one could simply write a script that forwards the request from your own domain to the third party system. It could be done on the server in such a way that the user would never leave your own domain: 1. User clicks http://links.example.com/?redirect=example.com/reset_passwor... 2. The server running on links.example.com makes a request to the third party web server 3. The server redirects the user to htt…

If doing this, it'd be critical to ensure the redirection script only redirects to example.com, otherwise a phisher could use it. Probably safer to have it only take a path actually

Re: How not to send password reset notification email

#30

Post by nonamegiven »

I got a reset message from Evernote, and I didn't even remember that I had an account. I must have tried it for my typical 30 seconds to conclude "meh" and moved on, then forgot it. I'm still not 100% sure what they do beyond ... note taking?

But I initially assumed it to be ballsy phishing, a brazen attempt to capitalize on Evernote's current trouble. Why? BECAUSE IT HAS A FUCKING LINK TO THE SERVICE IN THE EMAIL! That's the very minimum definition of phishing. Sheesh!

I hovered over it, saw that it was to evernote, but hovers can be faked, and my intuition and experience told me that this smells like phishing no matter what. Sheesh.

Post reply on HN