Another theory is they have an efficient way and or bypass facebook ratelimit to bruteforce reset victim's password token ... regardless, i would make sure 2fa is enabled for extra precaution... or maybe just take a break from facebook :)
Someone keeps trying to reset my Facebook password
31–40 of 246 posts
Re: Someone keeps trying to reset my Facebook password
#32I suspect someone might have noticed a flaw and is trying to take advantage of it. I've seen two reset emails this past week - one on Sunday and one on Tuesday, and they both had the same recovery code. Others in the Reddit thread noticed the same thing, so it's possible that someone is trying to exploit this some way.
Re: Someone keeps trying to reset my Facebook password
#33Because of the username. Many people forget their own username, for example: my username is pineapple and someone else's is pineapple2. And they end up using their username to recover their password. If your username is a common namesake, word or homonym, this makes the situation worse.
I have a friend with a firstname.lastname@gmail.com account.
Someone out there apparently doesn’t realize that address doesn’t belong to them, because for 10 years he has been getting signup confirmations, appointment reminders, and very personal correspondence meant for the confused individual.
Re: Someone keeps trying to reset my Facebook password
#34I think the better question is why facebook sends mails from facebookmail.com and metamail.com? Any sensible person would expect those to be scams, but they are real. https://www.facebook.com/help/1634546593478660
Why does any company needs more than one 2nd level domain?
Microsoft, I'm looking at you (https://learn.microsoft.com/en-us/microsoft-365/enterprise/u...). It nerve-wrecking trying to figure out if some login box or link is legit. They claim to be transitioning to cloud.microsoft, but if you go there, you are redirected to yet another new domain (microsoft365.com) which looks like a scam site, which doesn't render properly in Firefox.
Why do we allow this?
Re: Someone keeps trying to reset my Facebook password
#35Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.
Same here. At first it was just my account but now family members are getting it too.
Microsoft doesn't show you login attempt IP addresses like Google does?
Re: Someone keeps trying to reset my Facebook password
#36Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint
Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.
Re: Someone keeps trying to reset my Facebook password
#37Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.
Same here. At first it was just my account but now family members are getting it too. Microsoft doesn't show you login attempt IP addresses like Google does?
It does, but only when they use the password login...
Re: Someone keeps trying to reset my Facebook password
#38It’s a satiation attack (my term). The hope is you’ll get so frustrated at the frequency of the emails that you’ll eventually just press yes or ok or whatever it is that allows the reset.
This is how I'm going to describe that attack where you get a zillion authenticator push notifications because Microsoft has designed the damn thing to authenticate you to them but not them to you. Like, how freaking difficult would it be to put a transaction code in there like Apple so that you can match the notification on your phone with the session you're starting on some other device or service?!
I thought they already have that? When trying to sign in to a Microsoft service it displays a number which I have to type in to the Microsoft Authenticator before I am able to confirm the sign in attempt.
Re: Someone keeps trying to reset my Facebook password
#39I think the better question is why facebook sends mails from facebookmail.com and metamail.com? Any sensible person would expect those to be scams, but they are real. https://www.facebook.com/help/1634546593478660
Why does any company needs more than one 2nd level domain? Microsoft, I'm looking at you ( https://learn.microsoft.com/en-us/microsoft-365/enterprise/u... ). It nerve-wrecking trying to figure out if some login box or link is legit. They claim to be transitioning to cloud.microsoft, but if you go there, you are redirected to yet another new domain (microsoft365.com) which looks like a scam site, which doesn't render…
Domains used for bulk outbound email are typically separated from the normal corporate email domain to prevent employee emails getting blocked at customer mail gateways by anti-spam heuristics. Practically every large org gets burnt by this once, learns their lesson, and then splits their domains.
Microsoft has something like a hundred domains, including purposefully misspelled ones like "microsft.com", which is real, owned by them, and regularly used to bypass "security filtering" by paranoid admins.
Re: Someone keeps trying to reset my Facebook password
#40Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint
Interesting hack, but it wouldn't explain the case where you receive multiple such resets emails.
Well.. I have a theory. Maybe the threat actors are sending the recovery email with the hopes that the target does not engage. Then, the threat actor can indicate that they "no longer have access to this email address" to force recovery to an alternate address. Then, perhaps they have gained access to some people's old alternate email addresses either through credential stuffing or recreating deleted email accounts. If so, the TA can finish the reset and take over the account.