Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Microsoft Skype Security Is Flawed

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 43 posts

Tell HN: Microsoft Skype Security Is Flawed

#1

Post by samnwa »

I received an email today from Skype that someone had changed the email address on an old Skype account of mine. Presumably this means that they were able to gain access to a password. There was no mechanism in the email to block the action. Next, I received an email that said "Someone started a process to replace all of the security info for the Microsoft account." Again, there was no way to block this action.

Both emails encouraged me to contact customer support. I did so only to be met with a request to fill out an online form with an incredible amount of personal information to verify the account. Why would I provide 10X the personal info that might then be made accessible to a user whose email address was swapped into the account with no verification at all?

Does anyone have any advice on how to resolve or escalate to Microsoft? Ideally the original email address on the account would be restored and more broadly, Live / Skype should update their security procedures to avoid this type of "easy to steal accounts" security policy while hard to block the stealing of accounts.

Any help / suggestions appreciated.

Re: Tell HN: Microsoft Skype Security Is Flawed

#5

Post by samnwa »

buboard wrote: post #4

Thats how i lost my last account. They were asking me details like the account creation date which was > 15 years old

Were you worried at all about the culprit using the access to figure out other accounts? My account had a balance so I assume it had some old credit card info in it or something similar.

Re: Tell HN: Microsoft Skype Security Is Flawed

#6

Post by buboard »

samnwa wrote: post #5
buboard wrote: post #4

Thats how i lost my last account. They were asking me details like the account creation date which was > 15 years old

Were you worried at all about the culprit using the access to figure out other accounts? My account had a balance so I assume it had some old credit card info in it or something similar.

I did manage to get them to block the account because it was obviously stolen. But unable to reclaim it. I was more worried they d spam my friends.

Re: Tell HN: Microsoft Skype Security Is Flawed

#7

Post by samnwa »

buboard wrote: post #6
samnwa wrote: post #5

Earlier quoted context omitted.

Were you worried at all about the culprit using the access to figure out other accounts? My account had a balance so I assume it had some old credit card info in it or something similar.

I did manage to get them to block the account because it was obviously stolen. But unable to reclaim it. I was more worried they d spam my friends.

That's good news. I will reach out again and try to get it blocked at least but so far they have been unwilling to do so.

Re: Tell HN: Microsoft Skype Security Is Flawed

#8

Post by samnwa »

buboard wrote: post #6
samnwa wrote: post #5

Earlier quoted context omitted.

Were you worried at all about the culprit using the access to figure out other accounts? My account had a balance so I assume it had some old credit card info in it or something similar.

I did manage to get them to block the account because it was obviously stolen. But unable to reclaim it. I was more worried they d spam my friends.

In messaging with support, they advised that the system would 'automatically' identify the account as compromised and eventually block it. This doesn't seem that likely so I will ping them again in a few hours.

Re: Tell HN: Microsoft Skype Security Is Flawed

#9

Post by rodolphoarruda »

> Both emails encouraged me to contact customer support. I did so only to be met with a request to fill out an online form with an incredible amount of personal information to verify the account. Why would I provide 10X the personal info (...)?

This by itself looks like a phishing attack. Did you click a link to Skype support in the second email message or find it by yourself going to the Skype website and browsing around?

Post reply on HN