Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

51–60 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#51

Post by ldjb »

em-bee wrote: post #49
hathchip wrote: post #43

Earlier quoted context omitted.

The GP is talking about a situation where you are not asked for an email address. You ask for a password reset for the username @coolanonguy. The website tells you that the reset email was sent to an obscured email address. The obscured email allows you to confirm (with high likelihood) or deny (with certainty) that @coolanonguy is your friend whose email address you know.

on the systems where i had to do this for my account i usually get a message like: "an email has been sent to the address registered with this account" there is no benefit to reveal any details.

I have many email addresses. I don't necessarily know which email address is associated with my account. Therefore, the user benefits from knowing which email inbox they should check.

That said, it could be that the security risk outweighs that convenience.

Re: Someone keeps trying to reset my Facebook password

#52

Post by WA »

larschdk wrote: post #36
jackbrookes wrote: post #12

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint

Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.

That is the security researcher perspective, but it’s a UX nightmare resulting in a lot of confusion for normal users, because they don’t get any info if they even have an account or are trying to use the correct email address.

Re: Someone keeps trying to reset my Facebook password

#53

Post by worklaptopacct »

unsupp0rted wrote: post #42

I have an alias that is a vaguely common name, which is firstname.lastname@gmail.com Once a year or so somebody tries to get into that gmail or associated social media account with a bunch of password-reset emails. I'm pretty sure it's someone with a similar name who is slightly misspelling their email, messing up the dot (gmail ignores dots but other systems don't), etc.

I have an old email with my (common) first name and a low number. Every now and then I get registration emails from various children's online games.

Re: Someone keeps trying to reset my Facebook password

#54

Post by qwerty456127 »

WA wrote: post #52
larschdk wrote: post #36

Earlier quoted context omitted.

Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.

That is the security researcher perspective, but it’s a UX nightmare resulting in a lot of confusion for normal users, because they don’t get any info if they even have an account or are trying to use the correct email address.

Okay. Why not add a configuration option for this then so people who know what they are doing would be able to opt in for the more secure way?

Re: Someone keeps trying to reset my Facebook password

#55

Post by xenophonf »

TheFreim wrote: post #38
xenophonf wrote: post #26

Earlier quoted context omitted.

This is how I'm going to describe that attack where you get a zillion authenticator push notifications because Microsoft has designed the damn thing to authenticate you to them but not them to you. Like, how freaking difficult would it be to put a transaction code in there like Apple so that you can match the notification on your phone with the session you're starting on some other device or service?!

I thought they already have that? When trying to sign in to a Microsoft service it displays a number which I have to type in to the Microsoft Authenticator before I am able to confirm the sign in attempt.

You only get the push notification, no session binding, when using Microsoft Authenticator in other scenarios. That's if you get the push notification. It's variable in my experience. (I use it as a backup MFA method when I don't have my badge reader handy.)

Re: Someone keeps trying to reset my Facebook password

#56

Post by luma »

jackbrookes wrote: post #12

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint

Folks in the thread noted that the recovery code sent was the same each time, which leads me to think it might have been a phishing attack. Send email that looks like FB recovery, but have the links go to some domain you own and snarf up creds, including MFA etc.

Re: Someone keeps trying to reset my Facebook password

#57

Post by qwerty456127 »

hathchip wrote: post #45
borbulon wrote: post #22

It’s a satiation attack (my term). The hope is you’ll get so frustrated at the frequency of the emails that you’ll eventually just press yes or ok or whatever it is that allows the reset.

The email allows you to enter a new password, it doesn't validate some other access to your account by clicking yes.

They will just wait for you to get used to this, then stop triggering Facebook to send you legitimate emails and start sending you similarly-looking phishing emails similarly often. It may happen to be enough to view a phishing email, let alone click anything in it to get pwned.

Re: Someone keeps trying to reset my Facebook password

#58

Post by mariusor »

k12sosse wrote: post #50
transcriptase wrote: post #33

Earlier quoted context omitted.

I have a friend with a firstname.lastname@gmail.com account. Someone out there apparently doesn’t realize that address doesn’t belong to them, because for 10 years he has been getting signup confirmations, appointment reminders, and very personal correspondence meant for the confused individual.

Over the years I have and continue to receive emails destined for other people. After years of trying to help people realize the errors of their ways (sometimes you just can't find the destined people). Some of my favourites are the tax information (and other common business related correspondence) on their Disney songwriting royalties (I make more before my first coffee break than they do all year on streaming reven…

I mark as spam all emails coming from companies that don't have a link to remove the email from the account that triggered it because someone added it by mistake or maliciously.

Re: Someone keeps trying to reset my Facebook password

#59

Post by tomhoward »

luma wrote: post #56
jackbrookes wrote: post #12

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint

Folks in the thread noted that the recovery code sent was the same each time, which leads me to think it might have been a phishing attack. Send email that looks like FB recovery, but have the links go to some domain you own and snarf up creds, including MFA etc.

Not in my case; I've had two password reset emails in the past 3 days (having had none since February) and both have gone simultaneously to the different email addresses I have on the account, with different codes on all the emails (even the ones sent at the same time), and the click-through URL is certainly on the legit Facebook domain.

Re: Someone keeps trying to reset my Facebook password

#60

Post by Kiro »

jackbrookes wrote: post #12

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint

Is that how it actually works on Instagram or was it just an example?
Post reply on HN