Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

161–170 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#161

Post by gnabgib »

joshka wrote: post #86

fairly simply fixed by making publicly available information (email address) not part of the process: - create an email address alias (random, unguessable) - change your login to use that email address - remove your phone number from Facebook There are many ways to do this (plus addressing, apple hide my email, account aliases, etc.) Pick your own approach.

I'm afraid this won't help. My closed FB account hits all three of these (unguessable local part, obscure domain, no other attached metadata) and I still get these reset emails. Seems like there's been an account-data leak.

Re: Someone keeps trying to reset my Facebook password

#162

Post by yencabulator »

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

There's an idiot sharing my first & last name who never remembers to put his middle initial in his email address, and as a result I see he's an alcoholic, has financial trouble, keeps applying for artist grants, has a social sciences degree of some sort, is involved in local politics, and so on.

I could also choose to pwn his online betting, games, dating, and porn accounts any moment I want. I may or may not have changed his gender preferences on a dating site...

Re: Someone keeps trying to reset my Facebook password

#163

Post by y-c-o-m-b »

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

If you are bob@gmail.com or bob@yahoo.com, I am sorry about the decades worth of product offers, porn subscription offers, forum or blog reply notifications, etc.

Re: Someone keeps trying to reset my Facebook password

#164

Post by [deleted] »

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

[deleted]

Re: Someone keeps trying to reset my Facebook password

#165

Post by will4274 »

xenophonf wrote: post #55
TheFreim wrote: post #38

Earlier quoted context omitted.

I thought they already have that? When trying to sign in to a Microsoft service it displays a number which I have to type in to the Microsoft Authenticator before I am able to confirm the sign in attempt.

You only get the push notification, no session binding, when using Microsoft Authenticator in other scenarios. That's if you get the push notification. It's variable in my experience. (I use it as a backup MFA method when I don't have my badge reader handy.)

> It's variable in my experience

It shows you a code when the initiator is an unfamiliar device, but doesn't show you the code when the initiator is a familiar device. You can reproduce this fairly easily - open a private tab and try to login - you'll see the code in your app. Then logout and login again without closing the tab - you won't see the code.

Which actually makes sense, if not well-explained to users.

Re: Someone keeps trying to reset my Facebook password

#166

Post by contravariant »

NoMoreNicksLeft wrote: post #153
obblekk wrote: post #136

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at…

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

> Long and strongly random

You can choose to substitute length for randomness. A long enough random sentence works quite well.

The hard bit is generating random sentences. I suppose you could use GPT to generate a sensible but random sentence, or just go old school and pick words from a large list and make a sentence with them.

Re: Someone keeps trying to reset my Facebook password

#167

Post by UncleMeat »

NoMoreNicksLeft wrote: post #153
obblekk wrote: post #136

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at…

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

People still can lose access to their password manager. Getting everybody on password managers won't prevent all reset requests.

Re: Someone keeps trying to reset my Facebook password

#168

Post by bmitc »

j-bos wrote: post #154
NoMoreNicksLeft wrote: post #153

Earlier quoted context omitted.

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

I personally feel password managers are convenience that bundles separate risks into a single point of failure.

The points of failure are either a single person manually remembering unsecure passwords or a password manager storing highly secure passwords in encrypted storage with multiple factors of authentication. There is no increase or decrease in points of failure, and in both cases, the password reset mechanism still exists.

Re: Someone keeps trying to reset my Facebook password

#169

Post by ShellfishMeme »

MarkSweep wrote: post #106
chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

firstname.lastname@gmail.com can have similar problems. Somehow people miscommunicate or misremember their email address and I get a lot of misdirected messages.

Same thing here. The worst part is when websites don't actually require an email confirmation to keep using them. In the beginning I've tried to reach out to those companies to close the accounts without accessing them but by now I've started just resetting the password and then deleting them. It's just too difficult to do the right thing.

Re: Someone keeps trying to reset my Facebook password

#170

Post by takinola »

y-c-o-m-b wrote: post #163
chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

If you are bob@gmail.com or bob@yahoo.com, I am sorry about the decades worth of product offers, porn subscription offers, forum or blog reply notifications, etc.

I use bob@smith.com for any service that insists on an email address when they have no business doing so (eg public WiFi portals). I used to use bob@example.com to avoid spamming poor Bob but many services now disallow example.com as a domain.

Sorry Bob!

Post reply on HN