Hacker News Reader

This does sound like a reasonable feature request to me: the "contact information" and "account recovery" use cases are different, and it's not obvious that an email listed for one should be automatically used for the other. They could have you choose for each email whether it's allowed to be used for account recovery.

As an analogous example, what if you did the "forgot my password" flow and they sent a recovery code over SMS to any listed phone number on your profile, sent a twitter DM to your listed twitter account, and sent postal mail to any postal address on your profile? (All at once, without waiting or confirmation.) That would expand the attack surface significantly, and it would be pretty easy to steal someone's account by stealing their postal mail. This case is similar: a secure email for account recovery and a less secure email for contact info, but Facebook forces you to use both for account recovery.

On the other hand, some people intentionally want multiple account recovery emails so they're less likely to lose access to their account. I imagine Facebook's hesitation with this feature is that it's hard to clearly communicate the distinction between the two use cases, and they want to bias toward simplicity.

I tend to agree w/ the FB security team here. Don't list email addresses owned by an adversary in your account. :-/

> Don't list email addresses owned by an adversary in your account.

I mean if you're delegating your email address, your staff aren't adversaries. But they shouldn't be able to, say, drain all your retirement accounts either.

Just because I want people who search for alex.krupp@gmail.com to be able to find my Facebook account doesn't mean I want password reset requests sent there. It wouldn't be at all unreasonable to send them there if that was explained in the UI, but just immediately sending a password reset pin to a non-primary email address without any warning is crazy. At least wait a few days if the user doesn't take any action after it's sent to their primary address.

Even if they changed it so that you could select where to send the password reset, rather than having it go by default to all accounts, that still means anyone with delegate access to the email address could go and request a reset on your behalf.

> that still means anyone with delegate access to the email address could go and request a reset on your behalf.

That's how it should work. You shouldn't have to remember which email address you signed up with in order to request a password reset. But that's fine as long as the pin number only gets sent to an account that's locked down to a degree that's appropriate relative to the assets under protection.

I would agree with Facebook's assessment that this isn't a vulnerability. If a user intentionally adds an untrusted email address as an official email address for their account, Facebook can't really detect or prevent that.

Using a delegated email address to sign up for things sounds like the vulnerability then, not Facebook's handling of it.

That scenario obviously wouldn't be Facebook's fault, because any email address you sign up with is always going to be your primary email address unless you change it later. What I'm talking about is signing up with a non-delegated email address, and then adding a secondary email address for the purpose of either displaying publicly on my profile or so that my friends can find me via email in search.

In other words, cases where I had no intention of ever allowing a password reset request to be sent there, knew fully well that it wouldn't be safe, but did so anyway because Facebook provided zero indication that they would do this and it's not at all intuitive that they would.

I side with facebook on this one. It isn't like anyone can arbitrarily enter an email address association, or re-enter an associated email during the reset process.

So, in order to get in there, you would need to know the account you're trying to get into, and have access to an associated account in order to lift the PIN from there.

It isn't to say that it cannot be done, but it does sound like a reasonable action.

It does emphasize how your (Facebook account's) security is only as strong as the weakest link - there was a story not too long ago about someone's accounts getting hacked because they had an old college e-mail address still set as recovery e-mail address, allowing an attacker to circumvent gmail's 2FA and everything.

If you have two factor authentication enabled, this will allow you to reset the password, but won't they still need the other factor? SMS? Presuming the other factor is not also an email. So the primary exploit might be stolen phone where the sms and email go to same device?