Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

191–200 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#191

Post by znpy »

takinola wrote: post #170
y-c-o-m-b wrote: post #163

Earlier quoted context omitted.

If you are bob@gmail.com or bob@yahoo.com, I am sorry about the decades worth of product offers, porn subscription offers, forum or blog reply notifications, etc.

I use bob@smith.com for any service that insists on an email address when they have no business doing so (eg public WiFi portals). I used to use bob@example.com to avoid spamming poor Bob but many services now disallow example.com as a domain. Sorry Bob!

I usually use marketin@domain-of-the-website.tld when a website insists on an email address to let me download something. I also curse at the marketing team, just in case.

Re: Someone keeps trying to reset my Facebook password

#192

Post by lelanthran »

ljm wrote: post #158
NoMoreNicksLeft wrote: post #153

Earlier quoted context omitted.

If websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good…

The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random output from a password manager. Either the database of special strings lives in your brain, a notebook, a bit of paper, or encrypted on disk somewhere, but it's still a database of special strings. Public key crypto never took off for account management and neithe…

> The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random output from a password manager.

I disagree.

Any system, whether computerised or not, needs to pieces of information to authenticate a person - something the person has (identification), and something the person knows (authentication).

You cannot simply rely on something the person has; that thing can be stolen and used by someone else.

If you have a reasonable replacement for "something the person knows", I'd love to hear it.

Re: Someone keeps trying to reset my Facebook password

#194

Post by flir »

yencabulator wrote: post #162
chriscjcj wrote: post #97

I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: @ .com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mai…

There's an idiot sharing my first & last name who never remembers to put his middle initial in his email address, and as a result I see he's an alcoholic, has financial trouble, keeps applying for artist grants, has a social sciences degree of some sort, is involved in local politics, and so on. I could also choose to pwn his online betting, games, dating, and porn accounts any moment I want. I may or may not have ch…

I've got one who keeps forgetting he's got numbers on the end of his email address. He's a sheriff in a southern state. Also an idiot.

What's doubly annoying is the US gov is pretty lax at things like unsubscribe links, so I keep getting notifications about his Medicare account that I can't unsubscribe from.

Re: Someone keeps trying to reset my Facebook password

#195

Post by Phrenzy »

TowerTall wrote: post #143
bhartzer wrote: post #129

I own the domain of my last name. Several family members use (firstname@lastname.com). I once went to get a new phone at Best Buy, and the employee needed my email address. I gave it to here (firstname@lastname.com) and she insisted that it was NOT my email address. She insisted that it MUST end in @gmail.com or @yahoo.com, something like that. We frequently sign up for stuff online, and when we enter our email addre…

I have never had this problem and I have been using firstname@lastname.com for 20+ years

Whatever, Tim Apple...

Re: Someone keeps trying to reset my Facebook password

#196

Post by WarOnPrivacy »

willcipriano wrote: post #178
obblekk wrote: post #136

I was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at…

Set a limit, you get one password reset email per day/successful password reset. If you try to do it again you are instructed to look for the email that had already been sent.

> Set a limit, you get one password reset email per day/successful password reset.

I routinely see password reset emails get caught by greylisting. Most are released by the 2nd email but sometimes it takes more.

Re: Someone keeps trying to reset my Facebook password

#197

Post by misterben »

I use a @gmail.com and have been getting Facebook resets every week or two for years. But I know at least two people in two countries with a similar name keep giving out the wrong address from all the crap I get confirming their hair appointments and organising their BBQs, so it seems benign rather than a hacking attempt.

I take it as karma for all the junk hotmail.com must get whenever I use a public wifi network. Sorry verycommonname!

Re: Someone keeps trying to reset my Facebook password

#199

Post by WarOnPrivacy »

teddyh wrote: post #123
thunfisch wrote: post #115

Our company owns a one letter domain (e.g. "x.tld"), that follows a quite common sequence. A few months ago we've enabled receiving e-mails for all local parts on that domain. We've received hundreds of notification mails, newsletter subscriptions, alerts (from internal systems disclosing details about infrastructure of giant corporations), etc. It was quite fun, but became annoying quickly. We've then reduced recept…

> We've then reduced reception to the common hostmaster@, ... mailboxes Just FYI: For a more-or-less authoritative list of what aliases you ought to consider having, see RFC 2142: https://www.rfc-editor.org/rfc/rfc2142 >

> For a more-or-less authoritative list of what aliases you ought to consider having, see RFC 2142:

Nothing for DMARC - not even notice@?

Re: Someone keeps trying to reset my Facebook password

#200

Post by willcipriano »

WarOnPrivacy wrote: post #196
willcipriano wrote: post #178

Earlier quoted context omitted.

Set a limit, you get one password reset email per day/successful password reset. If you try to do it again you are instructed to look for the email that had already been sent.

> Set a limit, you get one password reset email per day/successful password reset. I routinely see password reset emails get caught by greylisting. Most are released by the 2nd email but sometimes it takes more.

Greylisting is really a rare configuration choice in modern times and has always been a "results may vary" sort of deal. Personally I wouldn't factor those users into my considerations.
Post reply on HN