4 ms·
If you try to log in with a valid username, but no password, you'll get a link to email yourself a newly generated password. The text of the email is: New Hac
by Hannan 14y ago
If you try to log in with a valid username, but no password, you'll get a link to email yourself a newly generated password. The text of the email is:
New Hacker News pw: <new password>
So someone probably thinks they have your username and are wondering why they can't remember the password or receive an new password.
Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password generation algorithm.
- biot 14y agoIf HN replaces your password with a random one when requesting a forgot password, that's a great way to denial of service someone -- just keep requesting new passwords every 10 seconds and they'll never be able to login. The better approach is to generate a secure password change link with an expiring change request token. Upon clicking the link, the token is validated and you're allowed to set a new password (or have one randomly generated). However, until the link is clicked and the token validated your old password should remain the same.
- Splines 14y ago> Far less likely is that someone could be trying to discover/exploit a timing attack on the forgotten password generation algorithm. Didn't somebody do that already?
- eli 14y agoIt was the session cookie key not the password, and it wasn't really a timing attack in the sense the parent means. But yeah http://news.ycombinator.com/item?id=639976 http://news.ycombinator.com/item?id=639976