4 ms·
Not sure how useful that reset was. All I had to do was type in my old password and then choose a new one. No email verification, no reset token, nothing. So if
by nivla 14y ago
Not sure how useful that reset was. All I had to do was type in my old password and then choose a new one. No email verification, no reset token, nothing. So if the password was indeed compromised, couldn't the attacker do the same?
- ceejayoz 14y agoIt addresses the "attacker has a list of hashes that'll take him a while to compute matches for" aspect of things.
- marcosdumay 14y agoYes, he could. But he didn't. If he did that, the page would tell you that your password is wrong, and you'd contact support. The attacker probably didn't change any password, because it would be futile. Also, the attaker could also change the account email. Neither tokens nor email confirmation would help. The biggest problem is for people that used the same password on Linode and any other important service. (And, of course, all the CC stuff...)