11–20 of 167 posts
"instead of actually deleting it, they simply appended '1000' to both the username and the email address. anyone could thus create an email address with that suffix and request a password request to access my info."
not an issue as long as there is no tld which ends with 1000 though
No information on how they found out? Did the service rep tell them?
With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evident directly from the mail, or it was a trivial guess.
Why 1000? Probably arbitrary but I can't help but wonder why 1000 instead of the faster 1111 or 1234, perhaps someone using NumPad?
Because the change was done manually. Their system probably doesn't implement a function to delete account, or it is not easily discoverable in the UI, or it is known to be bugged. So the employee who did that thought that renaming an account was a good idea to make it appear "missing". A big numeric suffix is an obvious idea to avoid collisions with the existing and future accounts. But when people are asked to choo…
No information on how they found out? Did the service rep tell them?
Earlier quoted context omitted.
not an issue as long as there is no tld which ends with 1000 though
Most likely the 1000 is appended to the local-part of the email address, not the domain, as any tool they are using for changing details most likely validates emails somehow.
Unless someone figures out how to register a domain ending in ‘.com|disabled’ I’m not sure how someone would be able to access those accounts.
No information on how they found out? Did the service rep tell them?
One possible way I can think of is they're hosting their own mail server and route messages for all unknown addresses to some mailbox (not that uncommon as far as I know - people do that to avoid bouncing mails with a typo in the address). With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evi…
/edit I was wrong. It’s the user and email. Your theory would work
"instead of actually deleting it, they simply appended '1000' to both the username and the email address. anyone could thus create an email address with that suffix and request a password request to access my info."
not an issue as long as there is no tld which ends with 1000 though
Earlier quoted context omitted.
One possible way I can think of is they're hosting their own mail server and route messages for all unknown addresses to some mailbox (not that uncommon as far as I know - people do that to avoid bouncing mails with a typo in the address). With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evi…
He’s saying they append 1000 to the user and domain. /edit I was wrong. It’s the user and email. Your theory would work
Why? My interpretation of "append 1000 to email" is that 1000 gets added to the very end, not the local part.
Earlier quoted context omitted.
not an issue as long as there is no tld which ends with 1000 though
Completely wrong, dont just munge someone's email and hope it wont work, we literally have domains for this kind of stuff. https://www.iana.org/domains/reserved