4 ms·
> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change i
by jcoffland 10y ago
> This pattern seems like something security software should be able to detect: a password reset with incomplete information, followed immediately by a change in recovery email, name, and two-factor-auth settings, coupled with a “my account has been compromised” help request is highly suspicious.
This series of events could easily occur in legitimate cases. Say you lose or destroy your cellphone. Since you only ever logged in via your phone you don't know the password. Your recovery email was attached to a service you don't use because you normally use gmail. I'm not saying this scenario is a good idea just that it's probably quite common.
As a software developer I often hear from well meaning users that are appalled that software didn't do-the-right-thing in some complex scenario that appears to have an obvious solution because the desired outcome in obvious. In reality, handling the corner cases is complex. Adding these obvious solutions to the code easily leads to even worse situations.
- vijayp 10y agoYeah, I could believe that it would create too many false positives and in retrospect things do often seem easy. Google and other service providers do have data to evaluate the benefit and cost of making decisions based on patterns, and they probably do.
- x0x0 10y agoBut the benefits are to them and the costs are to us =P That said, I have no idea how to do account recovery if you cannot trust the phone number.
- jandrese 10y agoAt the very least, any change to the email address should send out an email to the old address stating "If you didn't make this change, click on this link to have your account frozen until you do a password reset." It's silly to depend on an email for authentication, then allow the hacker to just delete the email address before they change the password. Giving the old address the right of first refusal defeats that kind of attack and should be dead simple to implement since the framework was already laid down for the "verify your email" step during setup.
- reitanqild 10y agoNot sure but I think I have seen hotmail/live do this?
- ScottBurson 10y ago> This series of events could easily occur in legitimate cases. I don't think so. Why, in your scenario, would they file a help request saying the account had been compromised? They might file a request with some other content, but not that. Your general point is valid, but I think the OP has probably figured out a set of features from which one could pretty reliably tell that something was amiss. And all he's suggesting is that such cases get bounced up to a human.
- jcoffland 10y agoIf you lock the account because someone filled a help request claiming the account was compromised, then hackers could use this as a DOS.
- 7Z7 10y ago..received a help request, along with all the other events (changed password, changed recovery email, changed phone number). Not just the help request.