3 ms·

> "Asked to provide my country of residence and to prove my account ownership by send an email from the address associated with my BSky account." Hey, when som

> "Asked to provide my country of residence and to prove my account ownership by send an email from the address associated with my BSky account." Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. Is the email "From" field safe to trust? Can it be spoofed? Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services?

shakna 1y ago
It's usually only reasonable to ask for a government ID, where you have already verified that in the past. Asking for it is discouraged - as that's you now handling sensitive information you should not store. You can only use what you know of the client, to verify their request. Proof of control of the only identity you have, tends to be "fair and reasonable".
mschuster91 1y ago
> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. By the time someone has access to an email account, they could just reset the password and access the data anyway, no loss of trust. > Is the email "From" field safe to trust? Can it be spoofed? If it matches the account email address, send the response to that email. A simple spoof will only lead to the user getting a "your gdpr export is ready" but the attacker can't get to the data.
torben-friis 1y ago
>Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? Isn’t that the general practice? Maybe with extra steps, but most services allow the “I just forgot my password -> I get a recovery email” flow, which trusts that the email from which the account was created is proof of identity. Then you get access to everything else with the password.
edent 1y ago
> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. You send a message to the email address listed on the account. You don't reply to the initial email. To clarify what happened to me. I emailed them from an account which was not the same as the one used to sign up. (I emailed from admin@example, but the BSky address was 1234@example.com) They replied saying that they required me to email from the address associated with the account. I logged into BSky, changed the email address (to admin@), then replied to their message. They then replied to the account's email. I had successfully demonstrated that I was the person in control of the account. > Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? The law is about proportionality. Would a reasonable person / process assume that only the user controls their email? For a social network, probably. If this were a medical service, it might require passing 2FA. > If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services? Yes. But they could also do a password reset. Having MFA helps here.

shakna 1y ago

It's usually only reasonable to ask for a government ID, where you have already verified that in the past. Asking for it is discouraged - as that's you now handling sensitive information you should not store. You can only use what you know of the client, to verify their request. Proof of control of the only identity you have, tends to be "fair and reasonable".

mschuster91 1y ago

> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. By the time someone has access to an email account, they could just reset the password and access the data anyway, no loss of trust. > Is the email "From" field safe to trust? Can it be spoofed? If it matches the account email address, send the response to that email. A simple spoof will only lead to the user getting a "your gdpr export is ready" but the attacker can't get to the data.

torben-friis 1y ago

>Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? Isn’t that the general practice? Maybe with extra steps, but most services allow the “I just forgot my password -> I get a recovery email” flow, which trusts that the email from which the account was created is proof of identity. Then you get access to everything else with the password.

edent 1y ago

> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. You send a message to the email address listed on the account. You don't reply to the initial email. To clarify what happened to me. I emailed them from an account which was not the same as the one used to sign up. (I emailed from admin@example, but the BSky address was 1234@example.com) They replied saying that they required me to email from the address associated with the account. I logged into BSky, changed the email address (to admin@), then replied to their message. They then replied to the account's email. I had successfully demonstrated that I was the person in control of the account. > Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? The law is about proportionality. Would a reasonable person / process assume that only the user controls their email? For a social network, probably. If this were a medical service, it might require passing 2FA. > If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services? Yes. But they could also do a password reset. Having MFA helps here.