Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding vulnerable Twitter accounts with expired domains

zainamro.com

Post reply on HN
Print view View original

21–30 of 128 posts

Re: Finding vulnerable Twitter accounts with expired domains

#21

Post by noinsight »

dewey wrote: post #19
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.

Unless Google arbitrarily decides to close your account (as has been known to happen) with no way to contact a human to correct things...

Re: Finding vulnerable Twitter accounts with expired domains

#22

Post by leonidasv »

dewey wrote: post #19
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.

You can get locked from Gmail if Google decides to suspend your Account. It has already happened to lots of users, even G Suite ones and good luck trying to get it back.

Examples on HN: https://news.ycombinator.com/item?id=22146082

https://news.ycombinator.com/item?id=22705122

https://news.ycombinator.com/item?id=4013799

Re: Finding vulnerable Twitter accounts with expired domains

#23

Post by pazu »

rickdeveloper wrote: post #2

What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.

Instead of blocking custom domain email addresses outright, the site could require a secondary recovery email address from an approved provider when an email with a custom domain is used to create the account. Then any security interaction like password reset, or 2fa would go to the primary address and would send an alert to the secondary email address about the nature of the communication. There could be a link in the email (sent to the secondary email address) that could allow the user access to instantly lock the account and/or disable access to the account from the primary email address until the user updates thier settings. The secondary recovery email address should not be able to be changed without an email confirmation (to the secondary email).

Good practice for users in general is to use email services like gmail as thier login/account email and add thier custom domain emails in thier bio.

Re: Finding vulnerable Twitter accounts with expired domains

#25

Post by leonidasv »

pazu wrote: post #23
rickdeveloper wrote: post #2

What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.

Instead of blocking custom domain email addresses outright, the site could require a secondary recovery email address from an approved provider when an email with a custom domain is used to create the account. Then any security interaction like password reset, or 2fa would go to the primary address and would send an alert to the secondary email address about the nature of the communication. There could be a link in t…

But what if the provider takes your account down? You end up with an unrecoverable account.

Re: Finding vulnerable Twitter accounts with expired domains

#26

Post by wutwutwutwut »

asciident wrote: post #15
Taek wrote: post #12

At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with th…

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

This is a solved problem in many other countries. Instead of proposing some new solution maybe it would be better to copy an existing which has already proven to work.

Re: Finding vulnerable Twitter accounts with expired domains

#27

Post by iotku »

ErikAugust wrote: post #20

Anyone else have people sign up for accounts with your email address? I had one recently where I could access a working GrubHub account for a while. And in the spirit of lame on-boarding optimization and “churn” prevention, while I could have used it - I couldn’t cancel the account. That required the phone number associated.

I had someone create a spotify account on one of my emails with an old (clearly burnt) password as the the username.

Why? I figure that's generally either for spamming or viewbotting (Re: likes, stars, etc) purposes especially on sites that don't require email verification to do things.

Re: Finding vulnerable Twitter accounts with expired domains

#28

Post by rgovostes »

dewey wrote: post #19
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

There's a difference between an email address and a social security number in a way that the latter will still be around if you stop paying for it or something happens to you. In some way (at least for this threat model) a gmail address is better than one on your own domain as it's unlikely to go away or get taken over.

Until Google decides to recycle unused account names: https://www.wired.com/2013/06/yahoos-very-bad-idea/

Re: Finding vulnerable Twitter accounts with expired domains

#29

Post by riffic »

wutwutwutwut wrote: post #26
asciident wrote: post #15

Earlier quoted context omitted.

You point out some problems, but how do we actually do these? Without emails as the keys to the kingdom, what would you use? Without a global identifier for a human person (like social security in the US), how would we declare that an identity is compromised? While I believe your ideals are well-intentioned, I think they're impractical in our current society. I would propose that an email is the key to the kingdom, t…

This is a solved problem in many other countries. Instead of proposing some new solution maybe it would be better to copy an existing which has already proven to work.

Without sharing examples, this is effectively a non-answer. Thanks for the comment.

Re: Finding vulnerable Twitter accounts with expired domains

#30

Post by est31 »

JoshTriplett wrote: post #8
est31 wrote: post #6

Earlier quoted context omitted.

cronjob to regularly check if the domain is expired/up for sale? The service "has this domain changed owners in a way it's relevant for logins" could even be turned into a SAAS startup... later to be extended to individual accounts (someone deletes e-mail acct, cancels phone plan, etc. then a new person creates a new one with just that name) One could strike contracts with all the e-mail providers and phone networks…

What would you do in this situation though? People still need to be able to reset their own passwords. And some accounts don't have any other means of contact. It's extremely common to only have an email address and a password.

If there is an alternative way available to reset passwords, support that one. If there is none, either lock the account, or give access to the handle but "delete" its contents.
Post reply on HN