16 ms·
Someone keeps trying to reset my Facebook password
- dawnfinancials 3y ago[flagged]
- davidpfarrell 3y agoWhen you have ${firstName}${middileInitial}${lastName}@${popularProvider}.com, you end up learning there are a LOT of people with your name who: 1) either themselves don't remember their ${hadToSettleFor} email address, i.e I get their billing reminders and medical statement emails, or 2) their loved ones/close friends don't, ie. I get party invites and group emails, etc. Separately, but related, I remember getting a spam email back in the late 90's where the spammer CC'd instead BCC'd, and it was sent to over 100 addresses who were all clearly variations of my first and last name ... It was a fun when there were multiple reply-alls with "Are we ALL $firstName $lastNames's on this list?" --- Surreal
- aendruk 3y agoI also received several of these emails over the last few days, but I closed my Facebook account years ago. Fortunately they include a feedback mechanism for this situation: If you didn't request a new password, [let us know](https://www.facebook.com/login/recover/cancel/…).
- johngladtj 3y agoFunny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.
- owlboy 3y agoI’ve seen that and the FB one in recent months.
- joezydeco 3y agoSame here. At first it was just my account but now family members are getting it too. Microsoft doesn't show you login attempt IP addresses like Google does?
- johngladtj 3y agoIt does, but only when they use the password login...
- flangola7 3y agoYour org's admin can see it in the Azure portal.
- tuhriel 3y agoIt's like the google 2FA where you can accept the login on ANY android device where you are logged in. and you can't disable the feature and the only way to remove the option from a device is to logout your account on the device... I have an tabled and an phone which is used by other people in my family and I definitely don't want the 2FA requests on these devices...
- laurencei 3y agoYeah - and what is crazy is when you think about it - Microsoft generates a 6 digit code. So it is a "one in a million" to randomly guess what the code is on any given login. But it is "one in a million" for each Microsoft account you know about - and if they have millions of email addresses, and automate it each day (I also get attempts 1-2 times per day). Yes - the odds are small - but there is a greater than 0% chance someone can randomly get into your Microsoft account - and there is no way to stop it - even with 2FA etc - this bypasses all of that!!! Crazy...
- joezydeco 3y agoI'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery? Because I'm a bit concerned if Microsoft passwords are leaking.
- laurencei 3y agoWhen attempting to login to your Microsoft account, instead of typing your password you can do an optional "one time password" generation thing from Microsoft. So instead of typing your password +2FA - they email you a 6 digit "one time password" that you can use instead. You cant disable this. So all Microsoft accounts could have a daily 1 in 1 million chance of been overtaken. Odds are low - but if you then spam this across thousands of attempts per day - they would statisically "get lucky" from time to time...
- joezydeco 3y agoThat makes much more sense, thanks. I'm guilty of using this from time to time as well.
- firebat45 3y agoOne would think Microsoft wouldn't be stupid enough to provide endless amounts of one time codes for a single account. I would guess they provide 5-10 codes before escalating the login.
- SeasonalEnnui 3y agoHave you got an exchange email or Teams set up on a mobile device? These will generate 2FA requests (but not make any kind of notification on the device).
- alaxapta7 3y agoI thought this was the Passwordless account they implemented (EDIT: didn't realize you weren't talking about the Authenticator app), but I had it turned off. I somehow managed to make it stop by re-enabling/re-disabling both Passwordless and 2FA. So now they always ask me for a password and then I get the challenge. To this day, I can't comprehend how this is supposed to be safe. So someone can just type in my username and wait until i eventually misclick in the Authenticator app? If it was from a browser I have used before at least, but I was getting these challenges from around the globe.
- trevyn 3y agoAt this point, I would not be at all surprised if this is a guerrilla tactic for accounts that have not logged in in a while to create engagement/MAU.
- simplyskeptic 3y agoI would believe it. I recently logged out of facebook on each device and took a month long timeout. After a couple of weeks, I started getting facebook email notifications of things they figured I'd want to see. With the impossible to remove/hide facebook reels nonsense they force on users, I'm about to take a much longer facebook timeout.
- owlboy 3y agoI just assumed someone was going through a database of known FB accounts and triggering the reset looking for people who accept. It is strange that they appear to be able to avoid being blocked for bulk/frequent requests though. Seems like a big flaw.
- codemiscreant 3y agoMy assumption is that it is engagement juicing. These seem to go out to seldom/casual users a lot of the time, and people respond by logging in and checking things out. Easy way to pump the MAUs
- input_sh 3y agoAh yes, Facebook, famously known for not having enough active users.
- benterix 3y agoIt's not that they don't have enough, it's that they try to always get more. If they no longer have anything to engage you with as you turned it all off, you will get a notification for some random post "we thought this might be interesting to you". And even if you always manually disable all possible options related to this particular notification, they will always find a way to nag you more.
- zug_zug 3y agoYou know it's not outlandish that either an engineer or a team a) did this intentionally to improve their KPI numbers b) did this accidentally-ish but won't roll it back because it's making their team's KPIs look good and is playing dumb
- benterix 3y agoYeah, this is not far fetched as I noticed this only on an account I haven't been using for a long time, and in the past FB engaged in a ton of scummy tactics to force me to log in again.
- 3y ago
- siwakotisaurav 3y agoGetting this on my second fb account, good to know it’s not just me
- Traubenfuchs 3y agoI think the better question is why facebook sends mails from facebookmail.com and metamail.com? Any sensible person would expect those to be scams, but they are real. https://www.facebook.com/help/1634546593478660 https://www.facebook.com/help/1634546593478660
- tmpX7dMeXU 3y agoIf you ask a Meta employee this you’ll no doubt get some internal structural / political justification, and they’ll say it to you with a straight face. Let’s also all think back to 2011 or so when Facebook thought it’d be a good idea to try to vacuum up all its users’ emails by giving us all @facebook.com email addresses, buying fb.com in the process. As I recall they killed it after a couple few years.
- mschuster91 3y agoCommon tactic to make sure that delivery of notifications is isolated in reputation from the main domains. That way, if notifications are be reported as spam and thus land in a number of distributed blacklists, at least corporate communication still works.
- hathchip 3y agoWhy don't they use a more obscure domain for internal corporate communication and keep the widely recognized one for messages to end users? Is it just the vanity that people who work there like to be mark.zuckerberg@facebook.com?
- larschdk 3y agoWhy does any company needs more than one 2nd level domain? Microsoft, I'm looking at you (https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/enterprise/u...). It nerve-wrecking trying to figure out if some login box or link is legit. They claim to be transitioning to cloud.microsoft, but if you go there, you are redirected to yet another new domain (microsoft365.com) which looks like a scam site, which doesn't render properly in Firefox. Why do we allow this?
- tmpX7dMeXU 3y agoI’ve accumulated, what, 3 Facebook accounts over the years? Many mornings I wake up to see that recovery codes have been requested for all of them, at a similar time. Surely this is enough of a signal to act on!? It really speaks to the fact that Meta really just doesn’t give a rats.
- cinntaile 3y agoI have never had anyone request my Facebook password. Your email addresses were likely compromised from somewhere else.
- Cthulhu_ 3y agoI mean a single attempt is always possible, even a number of attempts. But consistent attempts affecting what is probably millions of users over the span of years is a Facebook problem, clearly any measures they have to avoid repeated login attempts aren't working.
- renewiltord 3y agoHappened the other way to me once. When I made my Gmail account I had a . in it. Emails sent from me go from this email address. My Facebook email for ages was my school email (as is tradition, right?) and one day someone registered as my actual email around the time I was doing a bunch of address consolidation because my school was moving all historical accounts to a separate subdomain. I clicked to confirm foolishly (should not have done that) and it became associated with someone else's Facebook account. Facebook has a process for this. You request an email to your address and it sends you one and you reply and it removes the email from the other guy. Well, I did that except he set it without the '.' and when I replied from mine it wouldn't accept it. I tried again as it was and only realized after three tries what the problem was. Facebook's difference in verification processes (click to confirm / reply to dissociate) meant that I was not doing the right thing. Repeating the action means I looked like a fraudster so that must have been why even though I added the dot version as an email to send as it would no longer accept me. To make matters worse, I decided I'd just fix it by resetting my password and logging in and removing my email. Well, I succeeded in the password reset but Facebook protects you here by requiring friends to verify it's you. Well, I didn't know his friends so I just let it go: he could no longer log in except via phone number (I hope, or he was locked out) and I couldn't associate my email correctly. Then one random day I tried again and it worked.
- kkwtflz 3y agoFun fact: https://support.google.com/mail/answer/7436150 https://support.google.com/mail/answer/7436150
- SargeDebian 3y agoAm I missing what you are referring to?
- jackbrookes 3y agoMaybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see We sent an email to bo****@gm***.com Which gives you a hint
- dist-epoch 3y agoInteresting hack, but it wouldn't explain the case where you receive multiple such resets emails.
- sammy2255 3y agoCould be multiple different actors doing it
- amelius 3y agoOr some runaway script.
- batch12 3y agoWell.. I have a theory. Maybe the threat actors are sending the recovery email with the hopes that the target does not engage. Then, the threat actor can indicate that they "no longer have access to this email address" to force recovery to an alternate address. Then, perhaps they have gained access to some people's old alternate email addresses either through credential stuffing or recreating deleted email accounts. If so, the TA can finish the reset and take over the account.
- larschdk 3y agoBest practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.
- bananapub 3y ago? the comment you're replying to is talking about resetting by *account name*, not email address.
- codaphiliac 3y agoEmail security scanner following links?
- borbulon 3y agoIt’s a satiation attack (my term). The hope is you’ll get so frustrated at the frequency of the emails that you’ll eventually just press yes or ok or whatever it is that allows the reset.
- xenophonf 3y agoThis is how I'm going to describe that attack where you get a zillion authenticator push notifications because Microsoft has designed the damn thing to authenticate you to them but not them to you. Like, how freaking difficult would it be to put a transaction code in there like Apple so that you can match the notification on your phone with the session you're starting on some other device or service?!
- TheFreim 3y agoI thought they already have that? When trying to sign in to a Microsoft service it displays a number which I have to type in to the Microsoft Authenticator before I am able to confirm the sign in attempt.
- xenophonf 3y agoYou only get the push notification, no session binding, when using Microsoft Authenticator in other scenarios. That's if you get the push notification. It's variable in my experience. (I use it as a backup MFA method when I don't have my badge reader handy.)
- will4274 3y ago> It's variable in my experience It shows you a code when the initiator is an unfamiliar device, but doesn't show you the code when the initiator is a familiar device. You can reproduce this fairly easily - open a private tab and try to login - you'll see the code in your app. Then logout and login again without closing the tab - you won't see the code. Which actually makes sense, if not well-explained to users.
- 3y ago
- samjohnation111 3y ago[dead]
- felipemaciel 3y agoBecause of the username. Many people forget their own username, for example: my username is pineapple and someone else's is pineapple2. And they end up using their username to recover their password. If your username is a common namesake, word or homonym, this makes the situation worse.
- transcriptase 3y agoI have a friend with a firstname.lastname@gmail.com account. Someone out there apparently doesn’t realize that address doesn’t belong to them, because for 10 years he has been getting signup confirmations, appointment reminders, and very personal correspondence meant for the confused individual.
- k12sosse 3y agoOver the years I have and continue to receive emails destined for other people. After years of trying to help people realize the errors of their ways (sometimes you just can't find the destined people). Some of my favourites are the tax information (and other common business related correspondence) on their Disney songwriting royalties (I make more before my first coffee break than they do all year on streaming revenue, but they've got a fair number of songs), there is also a bank account tied it in Peru (CFO doesn't care but I'm not locking her out - I do have some compassion.. not much but it's there), but OTOH I've permanently locked people out of their brand new iPhones because they all choose to use my email address, or the person on the other end types it in wrong for them. I also think people don't read what their browser saves and later populates for them. People will also just randomly give out fake addresses (that are real) when signing up to just to get a discount. It's a single word that was popularized through pop culture years after I created it, and one letter away from being a traditional western name (and also one character toggled from a popular Hispanic one). Also a very wealthy PTA mom in Mountain View uses my email address all the time. Our children are doing very well. Sites should always confirm an address by having you authenticate a link before permanently using it in perpetuity. It would stop a lot of bad actions.
- 3y ago
- ebfe1 3y agoAnother theory is they have an efficient way and or bypass facebook ratelimit to bruteforce reset victim's password token ... regardless, i would make sure 2fa is enabled for extra precaution... or maybe just take a break from facebook :)
- tallanvor 3y agoI suspect someone might have noticed a flaw and is trying to take advantage of it. I've seen two reset emails this past week - one on Sunday and one on Tuesday, and they both had the same recovery code. Others in the Reddit thread noticed the same thing, so it's possible that someone is trying to exploit this some way.
- brcping 3y agoNoticed this as well. You can report the attempt to fb with a link in the e-mail and then the next recovery code is different. However, I hope they have some brute-force protection in place for the codes.
- unsupp0rted 3y agoI have an alias that is a vaguely common name, which is firstname.lastname@gmail.com Once a year or so somebody tries to get into that gmail or associated social media account with a bunch of password-reset emails. I'm pretty sure it's someone with a similar name who is slightly misspelling their email, messing up the dot (gmail ignores dots but other systems don't), etc.
- worklaptopacct 3y agoI have an old email with my (common) first name and a low number. Every now and then I get registration emails from various children's online games.
- yomlica8 3y agoThe ones that get me are the recovery login emails for services I never used. Some of them might be shotgun phishing attempts but some look like they actually were allowed to sign up without ever verifying their email.
- kmfrk 3y agoThis is very common with short or otherwise valuable usernames on social media platforms. Initials and so on. That's what 2FA is there for, but you still get the annoying e-mail notifications for attempted sign-ins. Make sure to weigh the pros and cons when you pick your username on the internet. A dedicated e-mail filter to limit the mental attrition might not be the worst idea.
- jareds 3y agoSeveral years ago I was getting multiple password reset attempts per day from my bank because I picked an easy username to remember 20 years ago. Luckily my bank allowed me to change my user name so I used my password manager to generate a password and used that as my username.
- Cthulhu_ 3y agoOne trick I've applied with a wordpress environment is to change the default 'admin' password to something longer / more complicated, change the default location of the admin panel to something else (only works if the admin environment is set up for that), and change the default SSH port. This already defeats 99% of 'low hanging fruit' attempted login attempts.
- dpkirchner 3y agoI had a six character username at Fidelity. Every few weeks I'd get a few password reset emails (or something similar, it was a while ago) and my account would get locked. It was a real pain to deal with but I didn't have a choice, such is the suck of a 401k. Eventually I went with a much longer username and the problem went away. I don't know if this is related (probably not), but fun fact: Fidelity lets you log in to your account over the phone using numbers[0] -- one per character. Yep, passwords too. > Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example: > To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3 > To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3 My 6 letter username mapped to numbers that corresponded to up to 4^6 accounts. That's really bad but not nearly as bad as what they're doing to passwords. The longer username is both worse and better. Worse because it matches way way more possible accounts and better because (I presume) it matches fewer actual accounts so it gets fewer failed attempts. That's my guess, anyway. Edit: it is possible that they only allow one account per "folded" username. That increasing the username length resolved the problem immediately suggests otherwise, but like I said, I dunno. I have no insight into their systems. 0: https://www.fidelity.com/customer-service/faqs-managing-your-profile https://www.fidelity.com/customer-service/faqs-managing-your... look for "telephone services"
- vdfs 3y agoI'm more impressed by the fact that HN didn't convert this linked to old.reddit.com
- babuskov 3y agoFWIW, I posted it as old.reddit.com initially because I have the extension that redirects everything. It somehow got reverted to regular reddit.com.
- Kalanos 3y agomaybe they are just trolling you.
- mkmk 3y agoI'm close with someone whose FB account was compromised due to a shared password, and then didn't see the 'an email has been added/removed from your account' emails until after the revert link expired a few weeks later. The recovery process is totally broken for them now. We eventually managed to revert back to the original email address by visiting facebook.com/hacked (not without the help of a weird youtube video to make sure we were selecting the right options, though), and we lost a ton of time on a weird issue where emails or recovery options were deeplinking to the app, which was opening but didn't know what to show us. After deleting the app, we managed to start generating 2-factor email codes, but the same prompts that generate them don't accept them. And the 'send in an ID to verify your identity' feature just doesn't load at all. I'm chipping away at it when I see them, but I give recovery a low probability of success. Understandable that this is probably not very fair to those who can't afford it, but I wish there was a 'pay $100 to speak with a rep who can fix this now' feature.
- hairofadog 3y agoMy sister had her Facebook account taken over by a bot of some sort some years ago. It was odd – they changed her profile photo over time, so at first it was just the regular profile photo, then it was the regular profile photo with a little bit of a different profile photo sort of creeping in on top of it, like if they had pasted the new one into a photoshop layer. Over a few weeks the new profile photo crept up until it was the only one, and then it became a sort of "call me for hot fun" spam account. I assume they were sidestepping some sort of detection algorithm, but it happened during a time when she was losing her mind in real life so it was a strange kind of metaphor.
- joshka 3y agofairly simply fixed by making publicly available information (email address) not part of the process: - create an email address alias (random, unguessable) - change your login to use that email address - remove your phone number from Facebook There are many ways to do this (plus addressing, apple hide my email, account aliases, etc.) Pick your own approach.
- SirMaster 3y agoFacebook is almost un-usable for me. Every week or so they lock my account due to "suspicious activity" even though I haven't used my account. I have all the security features and such turned on like MFA and a strong password (that I have to change like every week after every time my account gets locked). There is no useful info in the security logs. I have no idea what to do to stop this from happening.
- Zambyte 3y ago> I have no idea what to do to stop this from happening. I think deleting the account would stop it :P
- Atotalnoob 3y agoThe suspicious activity is you not using your account :p
- nkotov 3y agoBeen getting these on two of my accounts for the last couple of weeks.
- chriscjcj 3y agoI used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this: <common_name>@<common_name>.com Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mail that wasn't directed at me. Most of it looked legit enough to the spam filters to allow through. I temporarily turned that account on about 5 years ago and it was getting about 3,000 garbage messages per day. I thought having a cool e-mail address would be great, but not any more. I switched to an address that, while easy to say and tell people, it's very unusual and it's very unlikely someone else would ever come up with it.
- logbiscuitswave 3y agoMy Gmail account is the same way. I constantly get people using it as a throwaway email address for various dating sites, commerce sites, and porn sites. After enough annoying emails, I’ll typically change the account’s password or delete it if I can. (These sites usually aren’t the most reputable, so often times about the most I can do is change the password to lock them out.) I don’t get why people do this. It’s not like it’s difficult to get a throwaway email account.
- ChildOfChaos 3y agoI have a simple@Gmail.com address and I have this problem quite a lot, were i get a lot of random stuff. Sometimes from the same person, there starbucks card seems to be linked to it for example. Annoying.
- jcpham2 3y agoI took was an early adopter of gmail and I imagine a person could guess what my email address is, especially if I said I keep forgetting my HN passwords. Misplaced periods give me all sorts of other people's emails - new cars, new mortgages, new bank accounts, new home purchases that are not in my name or identity (based on the names I understand the confusion) - all sorts of things that I'm not doing IRL. Sometimes I try to reach out to the sender and get them to correct the email address, sometimes I just unsubscribe
- Etrnl_President 3y agoSecurity is the reason all my personal info on social media is lies. They take your account, and can now use it to unlock other accounts, like at your bank, etc.
- framtidsljus 3y agoI keep getting password reset emails from Spotify, from 0 to 10 times a day. Having a two character username seemed like a good idea when signing up.. Really annoying.
- grecy 3y agoMy FB username is not common, my email is not common. I run an FB page with ~60k followers. Since about a month now, I'm getting these password reset emails in batches.. some day none, other days 10-20.
- thunfisch 3y agoOur company owns a one letter domain (e.g. "x.tld"), that follows a quite common sequence. A few months ago we've enabled receiving e-mails for all local parts on that domain. We've received hundreds of notification mails, newsletter subscriptions, alerts (from internal systems disclosing details about infrastructure of giant corporations), etc. It was quite fun, but became annoying quickly. We've then reduced reception to the common hostmaster@, ... mailboxes and for all other mailboxes we are now rejecting the mails with a nice reminder message in our Sieve filters.
- teddyh 3y ago> We've then reduced reception to the common hostmaster@, ... mailboxes Just FYI: For a more-or-less authoritative list of what aliases you ought to consider having, see RFC 2142: <https://www.rfc-editor.org/rfc/rfc2142 https://www.rfc-editor.org/rfc/rfc2142>
- thunfisch 3y agoThat's exactly the one we picked. I've even commented it in our Sieve script. Funnily enough some spammers have picked up on this and send their spam even to those mailboxes.
- WarOnPrivacy 3y ago> For a more-or-less authoritative list of what aliases you ought to consider having, see RFC 2142: Nothing for DMARC - not even notice@?
- bhartzer 3y agoI own the domain of my last name. Several family members use (firstname@lastname.com). I once went to get a new phone at Best Buy, and the employee needed my email address. I gave it to here (firstname@lastname.com) and she insisted that it was NOT my email address. She insisted that it MUST end in @gmail.com or @yahoo.com, something like that. We frequently sign up for stuff online, and when we enter our email address it won't let us sign up... we figured it is because the email address is too similar to our actual name, the name we've entered in the 'first name' and 'last name' fields (it happens to both me and my wife at least 2-3 times a year).
- happymellon 3y agoWhen I first got a dot UK address a lot of forms refused to accept it, demanding that I use org.uk or co.uk instead. It was really annoying, luckily it doesn't happen as much anymore.
- sdflhasjd 3y agoWhereas I made the opposite mistake of having firstname@outlook.com I get ungodly amounts of spam, relentlessly, from everyone. Because anyone over the age of 50 seems to give it as their email to companies like Target.
- TowerTall 3y agoI have never had this problem and I have been using firstname@lastname.com for 20+ years
- jcomis 3y agoSame thing happening to me with my microsoft account. I get several one time code requests per day. I can log in and toggle some setting that disables this for a couple weeks, but then it's back again. Been going on for almost a year.
- n0t3ths81 3y ago[dead]
- eamann 3y agoI've been getting a couple of these each day for the past few days. It's always a bit entertaining. Partly because my email address is my name (so I know it's not likely a typo when folks enter the email address). Partly because I leverage GPG from the Facebook side so the messages are encrypted. Meaning, even if they somehow had access to my email (they don't - strong, unique password and separate MFA) they wouldn't be able to get the reset code as it's encrypted by a key stored in secure physical hardware. Still, kudos to the hackers for trying. Getting these emails means _someone_ cares enough about my account to want access. Even if I rarely use it for anything other than checking in on distant relatives ...
- obblekk 3y agoI was a PM at instagram in 2016 when we got a lot of these complaints from celebrities and short usernames. Some users were getting hundreds of reset emails/day triggered by random people in the world trying to reset their password. It's a really hard problem to solve because if these users actually forgot their password someday, they would really want those emails. We ended up creating a snooze for 30 days button at the bottom of the email as an imperfect solution to balance short-term spam and long-term lockout (with an override if the device id requesting the reset had recently been logged-in to the account). Idk if that still exists on IG but doubt it was ever ported to FB.
- NoMoreNicksLeft 3y agoIf websites made a concerted effort to train their users to not "remember passwords", this could eventually be solved. Human brains are not designed to remember: * Passwords that aren't reused across the many dozens/hundreds of logins a person typically has * Passwords that aren't easily guessed phrases including substrings of personal information (birthdays, children's names, etc) * Long and strongly random Yet good passwords need to be all of those. Christ, if websites just included a little "have you considered using a password manager?" link on the registration page. Tragedy of the commons I guess... everyone wants other companies to do the hard work of convincing a few percent per year to use them. We'll still be dicking around with this bullshit 30 years from now though. The problem is easy. The work of implementing it is difficult and slow. Let someone else do it.
- jlokier 3y agoI got one of these "someone request a password reset" mails from Facebook yesterday. I don't think I've had one before, and my email on its own domain I've had for ~20 years doesn't seem to be one people type by mistake. I thought it was probably phishing, yet the links all looked legitimate, including the one for password reset and the one to tell Facebook I didn't request the reset. So I thought it might be a homoglyph attack (a URL that looks legitimate but isn't because it's using alternate characters that look the same or similar), and rather than click the link saying I didn't request the password reset, I logged into Facebook hoping to find a notification or something in the account settings logging that it was a genuine request. I was surprised to see no notifcation, nor anything in the account settings and security area. I was also surprised to see I needed to login again, as I thought Facebook kept a long term session open for longer than the 2 weeks since I'd visited it previously. If it was a tricky method to get me to login to Facebook again, it worked! But I didn't stay long after I didn't find what I was looking for.
- ShowalkKama 3y agojust to be sure if you use firefox you can set network.IDN_show_punycode to false in about:config this will make the url bar display the encoded version instead (xn--wikipedi-86g.org)
- thrusong 3y agoThis was exactly my experience yesterday— on a firstnamelastname.tld email address for the first time, sort of phishing looking but with legitimate-looking URLs. Even the email headers looked legit but there was something so weird feeling about it I figured it was a sophisticated phishing attempt. I also found it odd there was no notification or anything inside Facebook.
- e40 3y agoI got one for an email that I didn't think had a FB account, and when I tried to reset the password I get: You’re Temporarily Blocked It looks like you were misusing this feature by going too fast. You’ve been temporarily blocked from using it. If you think this doesn't go against our Community Standards let us know. Got that on the first time I tried it. What a joke.
- bluepod4 3y agoI get shipping and delivery notifications from Zara because someone (accidentally I believe) entered my number when ordering. It’s sort of creepy because it shows me their address and I see a photo of the package on their doorstep.
- misterben 3y agoI use a <firstinitial><secondinitial><surname>@gmail.com and have been getting Facebook resets every week or two for years. But I know at least two people in two countries with a similar name keep giving out the wrong address from all the crap I get confirming their hair appointments and organising their BBQs, so it seems benign rather than a hacking attempt. I take it as karma for all the junk <verycommonname@>hotmail.com must get whenever I use a public wifi network. Sorry verycommonname!
- stillbourne 3y agonot only that but fb wont reset my password unless i upload a pic of my face
- mkoryak 3y agoa while ago I was messaged on Facebook by a nice Russian fellow who wanted me to _give_ him my Facebook username and domain name because he owns a dog wash in Moscow called dogself. He seemed to imply that if I was located in Russia I would not refuse him "for reasons". He didn't really strike me as being connected, but maybe he washes Putin's dog.. Anyway I got a lot of password reset emails too until I set up 2fa with a yubikey. I really need to remember to put something on dogself.com that will piss off the .ru but I haven't thought of anything good and legal (or at least ethical).