3 ms·
I get password reset emails on my account weekly too. What’s strange is it’s not a common email either, but one I use under my own domain. Not sure what the an
by relm777 7y ago
I get password reset emails on my account weekly too. What’s strange is it’s not a common email either, but one I use under my own domain.
Not sure what the angle is? Like, I don’t see how requesting a password reset would help them exploit the account. Maybe they are just testing for flaws in FB’s system, still weird though.
- maxheadroom 7y ago>Not sure what the angle is? Maybe a new version of the directory harvest attack[0]? For example, if someone has an email address (or list of email addresses) from somewhere else, one can easily tell if you (or they) have a Facebook account by simply requesting a password reset against it (them). If there's no throttling on password reset requests, one could process a large list rather quickly. [0] - https://docs.microsoft.com/en-us/exchange/recipient-filtering-on-edge-transport-servers-exchange-2013-help#tarpitting-functionality https://docs.microsoft.com/en-us/exchange/recipient-filterin...
- callumprentice 7y agoOh - that sounds entirely likely. I'd be surprised if Facebook allowed unthrottled password resets but the bad people are so clever these day, who knows. Thanks for insight.
- callumprentice 7y ago> I get password reset emails on my account weekly too. What’s strange is it’s not a common email either, but one I use under my own domain. Interesting, thanks for letting me know - I'd assumed the same - hoping I'd click on the reset link perhaps and that would help them access my account.