Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupid Patterns

darshit.dev

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Stupid Patterns

#41

Post by tomrod »

OisinMoran wrote: post #4
HelloNurse wrote: post #2

This is nothing. I have a very common name and a very common surname and people have used my email (name.surname at gmail.com plus the infamous GMail variants such as namesurname or NameSurname) for purposes like accounts on dating sites, Spotify, Instagram etc.; invoices; banks and insurances; resumes and job applications; medical test results; newsletters and all kinds of personal communications. "I" am a local pol…

> In most cases there is no practical way to verify email addresses What's wrong with "Click the link in the email we just sent to x@x.com to verify your email"?

Needs a follow up of "re-enter password" I think?

Re: Stupid Patterns

#42

Post by shkkmo »

jonathanlydall wrote: post #40
shkkmo wrote: post #33

Earlier quoted context omitted.

This doesn't seem stupid at all. BestBuy is considering two different scenarios and trying to handle both: BestBuy is avoiding leaking account status on their password reset page. This is done precisely so that people who don't have access to the email account can't figure out where you have accounts registered. This is a pretty standard approach. BestBuy is providing visibility to people who can't remember if they h…

It's very normal for password reset pages to say something to the effect of "if this email address is registered with us, you will receive an email..." and they can could also add something like "you can also try create an account here". Instead they opted for the option where every time a "hacker" is trying to use the form to compromise an account, it spams the victim with this email. As most of the world is not Nor…

I still see no problem with this implementation. If someone is trying to compromise or even locate accounts tied to your email, wouldn't you want to know?

Re: Stupid Patterns

#43

Post by kingcharles »

tangoalpha wrote: post #14

So, some random person had subscribed to Tata Sky (television set-top box channels subscription in India) with my mobile number. He wouldn't pay his dues on time, and Tata sky would call me every month multiple times. Their customer service would take down my request to change the number, but they never changed it. I was able to track down his actual phone number and on Facebook. Messaged him and explained to him. He…

This was my conversation with a guy last night whose phone number I now own. I guess he let his mobile plan expire or something. I can log into a bunch of his accounts around the Web because the OTPs come to me. I found him on Facebook because I have all the details of his life, but I couldn't get any reply. So last night I logged into his account on TikTok and followed my own account so we could message each other:

https://kingcharles.one/all-your-phones-belong-to-us.jpg

Re: Stupid Patterns

#44

Post by 123pie123 »

DenisM wrote: post #28
mikro2nd wrote: post #23

Earlier quoted context omitted.

And then are at a loss when you demand that they identify themselves to you. After all, all you've got is a voice at the end of the phone. Seriously I'm sure there's good ways to solve this using some simple crypto(graphy, not currency). We ought to be able to mutually authenticate without resorting to stupid questions about things we were doing 25 years ago and no longer remember.

We are able, I think. Say, my bank calls me and ask to call back with an extension#. I look up their phone # on their website, call that number, and provide the extension. They know who I am via The extension # I gave back to them, I know who they are via their phone # confirmed by their website SSL certificate. Alternatively, I call them back on the phone number at the back of the credit card.

nice idea, that should be easy(ish) to implement

Re: Stupid Patterns

#45

Post by michaelcampbell »

I have a very common name, and was lucky(?) enough to have gotten a gmail account with it back in the days you had to have an invite from a Google employee to get a gmail account.

I get misdirected emails like this at least multiple times a week.

Re: Stupid Patterns

#46

Post by ncmncm »

The Stupid Pattern I encounter most is getting e-mail about some account, with a link in it to some completely-other domain that looks most like a phishing site.

Often these e-mails are not actual phishing attempts, they are just things made by absolutely phenomenally clueless hacks.

So there is this company that does e-mail list services called mailchimp. Apparently, by default all e-mail from their customers comes with links to a site something like "mandrill.com".

If mailchimp is that clueless about security, do you really want to let them manage your password login setups?

There is a stock-market accounts company, Carta, that uses mailchimp.

Do you really want your stock market holdings managed by a company clueless enough to let someone as clueless as mailchimp to manage their password login setup?

Re: Stupid Patterns

#47

Post by fragmede »

dmurray wrote: post #16
rerx wrote: post #7

Earlier quoted context omitted.

A malicious recipient can click the link and exploit that their email is now associated to the account of some other person.

This seems like a relatively small vulnerability in practice. But it could be mitigated by "click the link and enter the one time code we gave you at sign-up time". Too much friction? How about "click the link on the same browser you used to sign up, and we'll verify that using a cookie we just set" - functionally equivalent and probably works for 90% of users while the rest can fall back to the one time code. I've s…

or just make a verified email address part of the required sign-up flow. No click on registration link, no further access to account.

Re: Stupid Patterns

#48

Post by fragmede »

jerrre wrote: post #31
jonathanlydall wrote: post #21

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to create an account. > We received a request to reset your password on BestBuy.com. > However, we don't have an account associated with this email address. You can try to sign in with a different email address. > You can also create a new account using any email…

> there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to. I think you overestimate your less computer savvy fellow humans :) Also it could be phishing?

I once got a series of password reset emails, and 6 of the 7 were genuine. The 7th was an obvious phishing attempt that seemed more genuine given that the first 6 were genuine. Had I clicked on the 'report phishing attempt' on the last email, it would have been game over.

Re: Stupid Patterns

#49

Post by fragmede »

HelloNurse wrote: post #2

This is nothing. I have a very common name and a very common surname and people have used my email (name.surname at gmail.com plus the infamous GMail variants such as namesurname or NameSurname) for purposes like accounts on dating sites, Spotify, Instagram etc.; invoices; banks and insurances; resumes and job applications; medical test results; newsletters and all kinds of personal communications. "I" am a local pol…

At least Google Workspaces now shows the profile pic for the recipient. I can forget the exact right permutation of firstname.middleinitial.lastname@gmail.com, but when the profile pic is wrong, I can be sure I've mistyped something.

Re: Stupid Patterns

#50

Post by zargon »

rerx wrote: post #7
OisinMoran wrote: post #4

Earlier quoted context omitted.

> In most cases there is no practical way to verify email addresses What's wrong with "Click the link in the email we just sent to x@x.com to verify your email"?

A malicious recipient can click the link and exploit that their email is now associated to the account of some other person.

It's not the account of some other person. They can't use it because they can't verify the email to create a password.
Post reply on HN