Hacker News Reader

Comment by tbabb | Hacker News Reader

Not only that, but apparently he was able to change Eve's account details without having to enter a password.

If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his.

All around very bad security design on Netflix's part.

View on HN

He said in the post that he was able to reset the password because the account was linked to "his" email.

But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account.

For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.

you still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?

In that case, he must have been logged into Eve's account before he received the email. How did that happen?

The parent comment means the scammer case who can set the password back because they are still logged in. Which might be feasible.

But I don't think a scam that relies on you resetting the password and not becoming suspicious is a bit of a stretch.

Fully agree. All authentication operations should always be completely explicit and clearly display the identity you are authenticating to. An email link implicitly logging you in looks like completely unacceptable. The email to recover your password can be excepted, because it is clearly an authentication-related thing and maintain the invariant that at most one person is actually able to log in.

I think this is the bingo. The scam doesn't work if you don't treat "access to email" as the sole authentication mechanism.

This gives the excuse for companies to request phone numbers. What if I don't have a phone (I am frequently without mobile phone access due to some personal circumstances recently, and it's a massive butt pain).

Reply on news.ycombinator.com