Hacker News Reader

Comment by awinter-py | Hacker News Reader

password reset flows are generally a privacy leak

if you use email as some kind of account key, you can generally find out whether that email has signed up (if not the username)

automatic password reset and email verification are good for businesses and users in a lot of ways so this is a tradeoff

if FB is showing the specific account linked to an SMS that's IMO negligent but shrug, they employ more lawyers than I do and they've never been investigated by the FTC for privacy issues

View on HN

Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this.

Whether or not you have an account, the system says a reset email has been sent.

Yes this is the correct answer. I've seen some systems respond with "if there's an account registered to this email address you will receive a password reset email" whether or not the address is registered

In most cases you can find out whether an account with a specific email address exists by trying to sign up with it, though.

Fair. We didn't have that issue because you don't sign up for bank accounts online.

But then you confuse legitimate users that don't remember what email they signed up with.

I why not actually always send an email to that address? If the email isn't registered, change the message to suggest that perhaps they signed up with a different email, or they'd like to sign up instead?

I’ve seen this obfuscated by some systems by always just throwing the user a message saying the reset email has been sent so that there’s no indication whether or not the email is associated with an account or not.

Of course, that doesn’t help someone who can’t remember if they’d signed up or not but it’s probably the safer way to go in general.

There's typically a system that forbids you from adding an additional account with the same email though.

yup, need to do it in the signup case as well but it solves the problem

In most cases attackers can use the signup flow to see if an email is registered so as long as it isn’t less protected (with a captcha etc) it isn’t any more of a privacy leak in that regard.

Are you being sarcastic about the FTC?

https://www.ftc.gov/news-events/press-releases/2019/07/ftc-i...

oh yeah other than the one time. but if they had done anything really bad there would have been some kind of 5 billion dollar for the deceptive disclosure and settings and some kind of toothless compliance council involving the board of directors

It's hard for me to understand what you're saying. I can't tell whether you're saying the FTC has investigated facebook a ton and that means facebook is bad, or that the FTC hasn't investigated facebook enough and that means the FTC is bad.

Reply on news.ycombinator.com