4 ms·

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to

A very stupid pattern I've come across recently is Best Buy sending me an email with the subject "Password reset didn't work" and a body of: > You may need to create an account. > We received a request to reset your password on BestBuy.com. > However, we don't have an account associated with this email address. You can try to sign in with a different email address. > You can also create a new account using any email you choose. > Happy Shopping! My guess is that it's a bad actor doing something like password stuffing to try see if my email address has an account there that they can try compromise. It's also possible someone thinks my email address is their email address, I doubt it though because in the 16 years I've had the Gmail address I've never received an email intended for someone else. Regardless, I've never lived in a country in which Best Buy operates, but some "genius" at Best Buy thought it would be a brilliant idea to email people who they know don't have an account with them, because there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to. After getting these annoying emails a few times I landed up making a Gmail rule to always report them as spam, then delete them.

jerrre 5y ago
> there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to. I think you overestimate your less computer savvy fellow humans :) Also it could be phishing?
- fragmede 5y ago
  I once got a series of password reset emails, and 6 of the 7 were genuine. The 7th was an obvious phishing attempt that seemed more genuine given that the first 6 were genuine. Had I clicked on the 'report phishing attempt' on the last email, it would have been game over.
shkkmo 5y ago
This doesn't seem stupid at all. BestBuy is considering two different scenarios and trying to handle both: BestBuy is avoiding leaking account status on their password reset page. This is done precisely so that people who don't have access to the email account can't figure out where you have accounts registered. This is a pretty standard approach. BestBuy is providing visibility to people who can't remember if they have accounts or which email they signed up with. Simply trying to reset your password and never getting an email leaves you in a situation where you are unsure if you waited long enough, missed the email, the business is having deliverability issues, or if you have an account. Having worked with businesses around reports of password reset email deliverability issues, it makes complete sense to me. This all seems like a perfectly reasonable approach.
- jonathanlydall 5y ago
  It's very normal for password reset pages to say something to the effect of "if this email address is registered with us, you will receive an email..." and they can could also add something like "you can also try create an account here". Instead they opted for the option where every time a "hacker" is trying to use the form to compromise an account, it spams the victim with this email. As most of the world is not North America, it is statistically most likely that the email recipient is someone who's most assuredly never going to be a Best Buy customer.
  - shkkmo 5y ago
    I still see no problem with this implementation. If someone is trying to compromise or even locate accounts tied to your email, wouldn't you want to know?
    - jonathanlydall 5y ago
      > If someone is trying to compromise or even locate accounts tied to your email, wouldn't you want to know? What course of action could be taken when you get an email like this indicating a "hacker" is trying their luck to see if your email address has an account on BestBuy.com even though you don't have an account there (and probably never will)? I've had my email address for 16 years, lots of "hackers" are aware of it due to account list leaks from various services I have used over that time and there is an entire industry which tries to compromise accounts from these lists. If I got notified of every automated script's failed attempt to do something malicious involving my email address, I would probably get several notifications a week, possibly per day, all of which are probably unactionable. So to answer your question, no, I most definitely wouldn't want to know about someone trying see if my email address was used for an account on some random website I'll never use. On the the other hand, if a password of mine was being used by a "hacker", that I would want to know about.

jerrre 5y ago

> there is no way anyone would ever try reset a password for an account on an email address which they don't actually have access to. I think you overestimate your less computer savvy fellow humans :) Also it could be phishing?

fragmede 5y ago
I once got a series of password reset emails, and 6 of the 7 were genuine. The 7th was an obvious phishing attempt that seemed more genuine given that the first 6 were genuine. Had I clicked on the 'report phishing attempt' on the last email, it would have been game over.

shkkmo 5y ago

This doesn't seem stupid at all. BestBuy is considering two different scenarios and trying to handle both: BestBuy is avoiding leaking account status on their password reset page. This is done precisely so that people who don't have access to the email account can't figure out where you have accounts registered. This is a pretty standard approach. BestBuy is providing visibility to people who can't remember if they have accounts or which email they signed up with. Simply trying to reset your password and never getting an email leaves you in a situation where you are unsure if you waited long enough, missed the email, the business is having deliverability issues, or if you have an account. Having worked with businesses around reports of password reset email deliverability issues, it makes complete sense to me. This all seems like a perfectly reasonable approach.

jonathanlydall 5y ago
It's very normal for password reset pages to say something to the effect of "if this email address is registered with us, you will receive an email..." and they can could also add something like "you can also try create an account here". Instead they opted for the option where every time a "hacker" is trying to use the form to compromise an account, it spams the victim with this email. As most of the world is not North America, it is statistically most likely that the email recipient is someone who's most assuredly never going to be a Best Buy customer.
- shkkmo 5y ago
  I still see no problem with this implementation. If someone is trying to compromise or even locate accounts tied to your email, wouldn't you want to know?
  - jonathanlydall 5y ago
    > If someone is trying to compromise or even locate accounts tied to your email, wouldn't you want to know? What course of action could be taken when you get an email like this indicating a "hacker" is trying their luck to see if your email address has an account on BestBuy.com even though you don't have an account there (and probably never will)? I've had my email address for 16 years, lots of "hackers" are aware of it due to account list leaks from various services I have used over that time and there is an entire industry which tries to compromise accounts from these lists. If I got notified of every automated script's failed attempt to do something malicious involving my email address, I would probably get several notifications a week, possibly per day, all of which are probably unactionable. So to answer your question, no, I most definitely wouldn't want to know about someone trying see if my email address was used for an account on some random website I'll never use. On the the other hand, if a password of mine was being used by a "hacker", that I would want to know about.