5 ms·
Not only that, but apparently he was able to change Eve's account details without having to enter a password. If instead Netflix had prompted him before allowi
by tbabb 9y ago
Not only that, but apparently he was able to change Eve's account details without having to enter a password.
If instead Netflix had prompted him before allowing him to change the credit card, it would not have worked, because he wouldn't have known Eve's password and Eve wouldn't have known his.
All around very bad security design on Netflix's part.
- kbsletten 9y agoHe said in the post that he was able to reset the password because the account was linked to "his" email.
- theclaw 9y agoBut if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account. For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.
- giomasce 9y agoFully agree. All authentication operations should always be completely explicit and clearly display the identity you are authenticating to. An email link implicitly logging you in looks like completely unacceptable. The email to recover your password can be excepted, because it is clearly an authentication-related thing and maintain the invariant that at most one person is actually able to log in.
- rickycook 9y agoyou still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?
- Cyberspy 9y agoIn that case, he must have been logged into Eve's account before he received the email. How did that happen?
- LeonidasXIV 9y agoThe parent comment means the scammer case who can set the password back because they are still logged in. Which might be feasible. But I don't think a scam that relies on you resetting the password and not becoming suspicious is a bit of a stretch.
- fphhotchips 9y agoI think this is the bingo. The scam doesn't work if you don't treat "access to email" as the sole authentication mechanism.
- hatsunearu 9y agoThis gives the excuse for companies to request phone numbers. What if I don't have a phone (I am frequently without mobile phone access due to some personal circumstances recently, and it's a massive butt pain).