News for hackers. Stuff that matters.
Re:Finding vulnerable Twitter accounts with expired domains by ugexe on Sunday August 23, 2020 @02:45PM (#24254230)
I don’t think you having to either A) remember what email you used or B) creating a new account is a big ask when the alternative is leaking your account presence on a given system. Not everyone wants other people to be able to essentially query a given app for an email account.
Re:Finding vulnerable Twitter accounts with expired domains by reaperducer on Sunday August 23, 2020 @06:29PM (#24255844)
The vast majority of people don't use the same e-mail address for their entire lives.
Re:Finding vulnerable Twitter accounts with expired domains by superasn on Monday August 24, 2020 @04:32AM (#24258555)
You're right. An example use case.

Monitor having issues. Google solution. Land on a forum, but to see the full post / solution it requires email registration. I register with a junk yahoo type email address. Complete the long form, solve all the traffic lights, etc. Then get the solution, make a few posts and probably forget about it.

Monitor having problem again after 2 years same forum but it says my very unique username is taken. Now, I vaguely remember creating an account but don't remember what email I used. I try to reset my password but dang, each time it says "If that email was in our db you'll get it". If I get a hint I used yahoo maybe I can resume and hopefully use my old account and some post count than starting a 1 day old account with 0 post.

Re:Finding vulnerable Twitter accounts with expired domains by ugexe on Monday August 24, 2020 @06:58AM (#24259427)
So your idea is to always gives malicious actors additional information for account take overs so you can use an account with a non zero post count (not just non-zero, but only 1 or 2 as you insinuated)? Do you not see how naive that is?
Re:Finding vulnerable Twitter accounts with expired domains by ugexe on Sunday August 23, 2020 @06:59PM (#24256004)
Those users are already creating new email accounts, so creating a new e.g. FooApp account shouldn’t seem unreasonable to those users.
Re:Finding vulnerable Twitter accounts with expired domains by cortesoft on Sunday August 23, 2020 @07:41PM (#24256255)
I think the vast majority of people use two... a personal one and a work one. Someone could easily check both for a person.
Re:Finding vulnerable Twitter accounts with expired domains by popotamonga on Sunday August 23, 2020 @08:00PM (#24256360)
Amazon leaks iirc