4 ms·
So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'. Turns out it's not as bad as
by rikkus 14y ago
So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'.
Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link.
http://appcenter.html5tools-software.intel.com/csd/ForgotPassword.aspx?e=rik@hemsley.cc&v=EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= http://appcenter.html5tools-software.intel.com/csd/ForgotPas...
That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token...
EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI
So does this mean I could reset anyone's password, given their email address?
Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'.
Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic]
Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were.
Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.
- facorreia 14y agoI just did. For your convenience, your new password is IDisposable#1.
- rikkus 14y agoThanks for that. From now on, I'm keeping my passwords in plain text on public websites and having other people set them for me.
- hmottestad 14y agoThis was the best discussion I've read on hackernews in a long time. So I made a screen shot and put it on my blog :) http://fluffyelephant.com/ http://fluffyelephant.com/
- caw 14y agoI got a different token when I tried it. pa1Wndjk+Ly3KAYrvpJghEFQUE1PQkk= It looks like it always ends in APPMOBI, but the first part can be different.
- imaffett 14y agoThanks for pointing this out. We have changed token schema and validation process.