Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

171–180 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#171

Post by qingcharles »

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

Reminds me of the time I changed my main cellphone number so the last digits were 69696969.

It was a really, really bad idea that sounded funny in my head. That number is scrawled on every toilet wall with "for a good time call: ..."

Every hour of the night...!

See also:

https://www.wired.com/1998/09/woz/

Re: Someone keeps trying to reset my Facebook password

#172

Post by thrusong »

jlokier wrote: post #139

I got one of these "someone request a password reset" mails from Facebook yesterday. I don't think I've had one before, and my email on its own domain I've had for ~20 years doesn't seem to be one people type by mistake. I thought it was probably phishing, yet the links all looked legitimate, including the one for password reset and the one to tell Facebook I didn't request the reset. So I thought it might be a homog…

This was exactly my experience yesterday— on a firstnamelastname.tld email address for the first time, sort of phishing looking but with legitimate-looking URLs.

Even the email headers looked legit but there was something so weird feeling about it I figured it was a sophisticated phishing attempt.

I also found it odd there was no notification or anything inside Facebook.

Re: Someone keeps trying to reset my Facebook password

#173

Post by qingcharles »

yosito wrote: post #149
bhartzer wrote: post #129

I own the domain of my last name. Several family members use (firstname@lastname.com). I once went to get a new phone at Best Buy, and the employee needed my email address. I gave it to here (firstname@lastname.com) and she insisted that it was NOT my email address. She insisted that it MUST end in @gmail.com or @yahoo.com, something like that. We frequently sign up for stuff online, and when we enter our email addre…

I use bestbuy@lastname.com with no issues. I often get customer service people who think I work for their company.

Lots of sites don't let you put their business name in the username. For instance, Samsung won't let you register with "samsung" in it.

Re: Someone keeps trying to reset my Facebook password

#174

Post by neuronflux »

chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

My email is . I also have the same first initial as my father, sometimes I get email intended for him. Fortunately our last name is unusual so that's about the extent of it.

Re: Someone keeps trying to reset my Facebook password

#175

Post by fragmede »

j-bos wrote: post #154
NoMoreNicksLeft wrote: post #153

Earlier quoted context omitted.

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

I personally feel password managers are convenience that bundles separate risks into a single point of failure.

It might have been a convenience thing back when there were only a few sites on the Internet but it's unreasonable, and just not practical to expect users to memorize several hundred, good, unique passwords for all the websites and apps they'll use in their modern digital life. Login with Google/Facebook/Apple/auth0 help mitigate the number of passwords to remember, but then you are beholden to that company.

Not all single points of failure are made equal, and password reuse is a much bigger problem than the possibility of your password manager getting hacked, assuming you choose a good one.

Re: Someone keeps trying to reset my Facebook password

#176

Post by fragmede »

contravariant wrote: post #166
NoMoreNicksLeft wrote: post #153

Earlier quoted context omitted.

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

> Long and strongly random You can choose to substitute length for randomness. A long enough random sentence works quite well. The hard bit is generating random sentences. I suppose you could use GPT to generate a sensible but random sentence, or just go old school and pick words from a large list and make a sentence with them.

Just battery horse staple it.

https://xkcd.com/936/

Re: Someone keeps trying to reset my Facebook password

#177

Post by fragmede »

NoMoreNicksLeft wrote: post #153
obblekk wrote: post #136

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at…

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

The association is email address to user, so some services don't even use passwords anymore. Create the user session for that current browser, and then email a time-limited login link to login.

Re: Someone keeps trying to reset my Facebook password

#178

Post by willcipriano »

obblekk wrote: post #136

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at…

Set a limit, you get one password reset email per day/successful password reset. If you try to do it again you are instructed to look for the email that had already been sent.

Re: Someone keeps trying to reset my Facebook password

#179

Post by xg15 »

fragmede wrote: post #175
j-bos wrote: post #154

Earlier quoted context omitted.

I personally feel password managers are convenience that bundles separate risks into a single point of failure.

It might have been a convenience thing back when there were only a few sites on the Internet but it's unreasonable, and just not practical to expect users to memorize several hundred, good, unique passwords for all the websites and apps they'll use in their modern digital life. Login with Google/Facebook/Apple/auth0 help mitigate the number of passwords to remember, but then you are beholden to that company. Not all…

My bigger worry is less getting hacked and more losing access to the password manager: If I use an online one, I'm once again dependant on a third party that can change their terms (or have an outage or get hacked) tomorrow; if I use an offline one, I have to manage a password database which has to be backed up, synchronized across devices, etc. If I use a new device, I cannot log into any account if I don't have an old device at hand from which to copy the password file.

All that seems a lot more risk and hassle than choosing 2 or 3 good passwords (correct horse etc), then making variants that you can remember for each site.

Re: Someone keeps trying to reset my Facebook password

#180

Post by xg15 »

fragmede wrote: post #177
NoMoreNicksLeft wrote: post #153

Earlier quoted context omitted.

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

The association is email address to user, so some services don't even use passwords anymore. Create the user session for that current browser, and then email a time-limited login link to login.

That's just shifting the auth burden to the email provider though.
Post reply on HN