Hacker News Reader

Comment by jackbrookes | Hacker News Reader

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see

    We sent an email to bo****@gm***.com

Which gives you a hint

View on HN

Folks in the thread noted that the recovery code sent was the same each time, which leads me to think it might have been a phishing attack. Send email that looks like FB recovery, but have the links go to some domain you own and snarf up creds, including MFA etc.

Not in my case; I've had two password reset emails in the past 3 days (having had none since February) and both have gone simultaneously to the different email addresses I have on the account, with different codes on all the emails (even the ones sent at the same time), and the click-through URL is certainly on the legit Facebook domain.

I got one yesterday I ignored

I've been getting a lot of those lately. They were easy to spot as I don't have a Facebook account.

A variant I've seen was "We've sent you a recovery code to your email at gmail.com". I think it's useful for login name based authentication, since people will have multiple email addresses and may forget which one they used for that account.

(we have a 15 year old who's made at least four, probably more different gmail addresses for different purposes. Ironically, the one he used to sign up for porn includes his real first/lastname)

Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.

? the comment you're replying to is talking about resetting by *account name*, not email address.

Ah, sorry, I see now, but the underlying point is the same. You should not reveal any information. A "We have sent an email to the address associated with the account" would be sufficient.

Not if you have multiple email accounts. Many times these codes reset in just a few minutes, you should try to avoid forcing users to spend time logging into every single email they can remember just to wait for an email to pop into one of them. You can show a few characters of an email or the first character of the domain to give a lot of info out in relative safety.

Everything is about tradeoffs, and the only objectively wrong answer is this dogmatic "never do $X" nonsense.

It is not sufficient.

The amount of disclosed information, and it's utility, is non-zero, but simply weighs less than the amount of damage from not hinting which account to check.

Accounts can grow to be 20 years old and even a "normal" person who is not actively using lots of addresses for security, will still end up having used several in the fullness of time and completely forgotten about some, yet, may still have or can regain access to them if only they knew to go look.

You don't see how that can happen or really be a problem? Oh well, consider yourself informed that it does happen and is a problem.

The GP is talking about a situation where you are not asked for an email address. You ask for a password reset for the username @coolanonguy. The website tells you that the reset email was sent to an obscured email address. The obscured email allows you to confirm (with high likelihood) or deny (with certainty) that @coolanonguy is your friend whose email address you know.

on the systems where i had to do this for my account i usually get a message like: "an email has been sent to the address registered with this account"

there is no benefit to reveal any details.

I have many email addresses. I don't necessarily know which email address is associated with my account. Therefore, the user benefits from knowing which email inbox they should check.

That said, it could be that the security risk outweighs that convenience.

The benefit is that people often don't remember which email they used for a service. They check their "main" email inbox but don't remember that they used their student email address 8 years ago when they signed up. By providing a hint they know which inbox to check and don't get frustrated because the email isn't coming.

So it is a privacy tradeoff for better UX. If it is a good tradeoff will depend on how much you value each.

Why not just login to all of your email accounts in your email client?

probably because fewer and fewer people are using a (non-web based) email client.

Isn't a step in password reset a prompt asking you to enter the email address the account is tied to?

Sometimes, not always.

That is the security researcher perspective, but it’s a UX nightmare resulting in a lot of confusion for normal users, because they don’t get any info if they even have an account or are trying to use the correct email address.

Okay. Why not add a configuration option for this then so people who know what they are doing would be able to opt in for the more secure way?

I used to think info about whether an account exists should not be leaked in the password reset flow, and I designed sites this way, but then someone pointed out that in practice a hacker would then just move to the account sign up flow to check for the existence of an account. (If account exists, you cannot make another with that email on most sites.) I never had a good response for that. I now lean toward the idea that not providing info is just not worth the bad UX.

> If account exists, you cannot make another with that email on most sites.

Many sites require you to verify your email before you can use your account. If you wanted to avoid leaking whether an account existed, you could show them a message like "if this account doesn't already exist, a message has been sent to your email asking you to verify it". If the account did exist, you might send an email like "someone tried to create an account with your email".

Interesting hack, but it wouldn't explain the case where you receive multiple such resets emails.

Could be multiple different actors doing it

Or some runaway script.

Well.. I have a theory. Maybe the threat actors are sending the recovery email with the hopes that the target does not engage. Then, the threat actor can indicate that they "no longer have access to this email address" to force recovery to an alternate address. Then, perhaps they have gained access to some people's old alternate email addresses either through credential stuffing or recreating deleted email accounts. If so, the TA can finish the reset and take over the account.

Is that how it actually works on Instagram or was it just an example?

I actually lost my Instagram account because, I believe, it filled in my email field with a dummy one, user@example.com and then when I had to do verification, I could never recover the account. I believe it was in the very early days of Instagram although it's possible there was user error on my part in this case.

It is too bad because for symmetry I used the same use name in a number of places (not the one I have here).

I lost a yahoo account because I put in incorrect information (I claimed to be 99 year old female or some such thing) and then forgot the password. I never really did anything with my yahoo account though, so it doesn't matter other than I couldn't unsubscribe to some mailing list.

Lost my Yahoo account because it forwarded mail to another account and so I never logged in to it. Then Yahoo deleted it for inactivity ... No warning issued, just gone one day. So now I'm locked out of my YouTube account because it wants to send a verification code to the Yahoo address.

Fuck this bullshit.

You're in luck. Email forwarding with Yahoo is now a paid only feature.

Reply on news.ycombinator.com