News for hackers. Stuff that matters.

A comment on Finding vulnerable Twitter accounts with expired domains. Parent comment

Re:Finding vulnerable Twitter accounts with expired domains by est31 on Sunday August 23, 2020 @01:39PM (#24253657)
cronjob to regularly check if the domain is expired/up for sale? The service "has this domain changed owners in a way it's relevant for logins" could even be turned into a SAAS startup... later to be extended to individual accounts (someone deletes e-mail acct, cancels phone plan, etc. then a new person creates a new one with just that name) One could strike contracts with all the e-mail providers and phone networks to tell via API when this happens and then send the info to services that use those accounts.
[ Parent | on HN ]
Re:Finding vulnerable Twitter accounts with expired domains by JoshTriplett on Sunday August 23, 2020 @02:22PM (#24254011)
What would you do in this situation though? People still need to be able to reset their own passwords. And some accounts don't have any other means of contact. It's extremely common to only have an email address and a password.
[ Parent | on HN ]
Re:Finding vulnerable Twitter accounts with expired domains by est31 on Sunday August 23, 2020 @03:37PM (#24254639)
If there is an alternative way available to reset passwords, support that one. If there is none, either lock the account, or give access to the handle but "delete" its contents.
[ Parent | on HN ]