4 ms·
But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the
by theclaw 9y ago
But if you have to reset the password to update the credit card details, then surely the scam won't work because the scammer would no longer be able to use the account.
For this scam to work the "Update your credit card" mail must contain a credential that allows you to update the scammer's card without changing or being challenged for their password. That doesn't seem great.
- giomasce 9y agoFully agree. All authentication operations should always be completely explicit and clearly display the identity you are authenticating to. An email link implicitly logging you in looks like completely unacceptable. The email to recover your password can be excepted, because it is clearly an authentication-related thing and maintain the invariant that at most one person is actually able to log in.
- rickycook 9y agoyou still have session cookies, because AFAIK netflix doesn’t log out all your devices when you reset your password (though i think there’s an option for that?) so you can still set the password and email back if you have the session cookie maybe?
- Cyberspy 9y agoIn that case, he must have been logged into Eve's account before he received the email. How did that happen?
- LeonidasXIV 9y agoThe parent comment means the scammer case who can set the password back because they are still logged in. Which might be feasible. But I don't think a scam that relies on you resetting the password and not becoming suspicious is a bit of a stretch.