Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone keeps trying to reset my Facebook password

reddit.com

Post reply on HN
Print view View original

61–70 of 246 posts

Re: Someone keeps trying to reset my Facebook password

#61

Post by jsjohnst »

jiggawatts wrote: post #39
larschdk wrote: post #34

Earlier quoted context omitted.

Why does any company needs more than one 2nd level domain? Microsoft, I'm looking at you ( https://learn.microsoft.com/en-us/microsoft-365/enterprise/u... ). It nerve-wrecking trying to figure out if some login box or link is legit. They claim to be transitioning to cloud.microsoft, but if you go there, you are redirected to yet another new domain (microsoft365.com) which looks like a scam site, which doesn't render…

Domains used for bulk outbound email are typically separated from the normal corporate email domain to prevent employee emails getting blocked at customer mail gateways by anti-spam heuristics. Practically every large org gets burnt by this once, learns their lesson, and then splits their domains. Microsoft has something like a hundred domains, including purposefully misspelled ones like "microsft.com", which is real…

> Microsoft has something like a hundred domains, including purposefully misspelled ones like "microsft.com", which is real, owned by them, and regularly used to bypass "security filtering" by paranoid admins.

You are off by orders of magnitude there on that number.

Re: Someone keeps trying to reset my Facebook password

#62

Post by glenstein »

Kiro wrote: post #60
jackbrookes wrote: post #12

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint

Is that how it actually works on Instagram or was it just an example?

I actually lost my Instagram account because, I believe, it filled in my email field with a dummy one, user@example.com and then when I had to do verification, I could never recover the account. I believe it was in the very early days of Instagram although it's possible there was user error on my part in this case.

It is too bad because for symmetry I used the same use name in a number of places (not the one I have here).

Re: Someone keeps trying to reset my Facebook password

#63

Post by flangola7 »

johngladtj wrote: post #2

Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.

Your org's admin can see it in the Azure portal.

Re: Someone keeps trying to reset my Facebook password

#64

Post by kmfrk »

This is very common with short or otherwise valuable usernames on social media platforms. Initials and so on.

That's what 2FA is there for, but you still get the annoying e-mail notifications for attempted sign-ins.

Make sure to weigh the pros and cons when you pick your username on the internet.

A dedicated e-mail filter to limit the mental attrition might not be the worst idea.

Re: Someone keeps trying to reset my Facebook password

#66

Post by bluGill »

glenstein wrote: post #62
Kiro wrote: post #60

Earlier quoted context omitted.

Is that how it actually works on Instagram or was it just an example?

I actually lost my Instagram account because, I believe, it filled in my email field with a dummy one, user@example.com and then when I had to do verification, I could never recover the account. I believe it was in the very early days of Instagram although it's possible there was user error on my part in this case. It is too bad because for symmetry I used the same use name in a number of places (not the one I have h…

I lost a yahoo account because I put in incorrect information (I claimed to be 99 year old female or some such thing) and then forgot the password. I never really did anything with my yahoo account though, so it doesn't matter other than I couldn't unsubscribe to some mailing list.

Re: Someone keeps trying to reset my Facebook password

#67

Post by jareds »

kmfrk wrote: post #64

This is very common with short or otherwise valuable usernames on social media platforms. Initials and so on. That's what 2FA is there for, but you still get the annoying e-mail notifications for attempted sign-ins. Make sure to weigh the pros and cons when you pick your username on the internet. A dedicated e-mail filter to limit the mental attrition might not be the worst idea.

Several years ago I was getting multiple password reset attempts per day from my bank because I picked an easy username to remember 20 years ago. Luckily my bank allowed me to change my user name so I used my password manager to generate a password and used that as my username.

Re: Someone keeps trying to reset my Facebook password

#68

Post by brcping »

tallanvor wrote: post #32

I suspect someone might have noticed a flaw and is trying to take advantage of it. I've seen two reset emails this past week - one on Sunday and one on Tuesday, and they both had the same recovery code. Others in the Reddit thread noticed the same thing, so it's possible that someone is trying to exploit this some way.

Noticed this as well. You can report the attempt to fb with a link in the e-mail and then the next recovery code is different. However, I hope they have some brute-force protection in place for the codes.

Re: Someone keeps trying to reset my Facebook password

#69

Post by registeredcorn »

hathchip wrote: post #43
larschdk wrote: post #36

Earlier quoted context omitted.

Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.

The GP is talking about a situation where you are not asked for an email address. You ask for a password reset for the username @coolanonguy. The website tells you that the reset email was sent to an obscured email address. The obscured email allows you to confirm (with high likelihood) or deny (with certainty) that @coolanonguy is your friend whose email address you know.

Isn't a step in password reset a prompt asking you to enter the email address the account is tied to?

Re: Someone keeps trying to reset my Facebook password

#70

Post by hathchip »

qwerty456127 wrote: post #57
hathchip wrote: post #45

Earlier quoted context omitted.

The email allows you to enter a new password, it doesn't validate some other access to your account by clicking yes.

They will just wait for you to get used to this, then stop triggering Facebook to send you legitimate emails and start sending you similarly-looking phishing emails similarly often. It may happen to be enough to view a phishing email, let alone click anything in it to get pwned.

surely the more of these they send, the less likely you are to click on them
Post reply on HN