Re:Finding vulnerable Twitter accounts with expired domains
by ugexe on Sunday August 23, 2020 @02:45PM
(#24254230)
I don’t think you having to either A) remember what email you used or B) creating a new account is a big ask when the alternative is leaking your account presence on a given system. Not everyone wants other people to be able to essentially query a given app for an email account.
[ Parent
| on HN ]
Re:Finding vulnerable Twitter accounts with expired domains
by reaperducer on Sunday August 23, 2020 @06:29PM
(#24255844)
The vast majority of people don't use the same e-mail address for their entire lives.
Re:Finding vulnerable Twitter accounts with expired domains
by superasn on Monday August 24, 2020 @04:32AM
(#24258555)
You're right. An example use case.
Monitor having issues. Google solution. Land on a forum, but to see the full post / solution it requires email registration. I register with a junk yahoo type email address. Complete the long form, solve all the traffic lights, etc. Then get the solution, make a few posts and probably forget about it.
Monitor having problem again after 2 years same forum but it says my very unique username is taken. Now, I vaguely remember creating an account but don't remember what email I used. I try to reset my password but dang, each time it says "If that email was in our db you'll get it". If I get a hint I used yahoo maybe I can resume and hopefully use my old account and some post count than starting a 1 day old account with 0 post.
Re:Finding vulnerable Twitter accounts with expired domains
by ugexe on Monday August 24, 2020 @06:58AM
(#24259427)
So your idea is to always gives malicious actors additional information for account take overs so you can use an account with a non zero post count (not just non-zero, but only 1 or 2 as you insinuated)? Do you not see how naive that is?
Re:Finding vulnerable Twitter accounts with expired domains
by ugexe on Sunday August 23, 2020 @06:59PM
(#24256004)
Those users are already creating new email accounts, so creating a new e.g. FooApp account shouldn’t seem unreasonable to those users.
Re:Finding vulnerable Twitter accounts with expired domains
by cortesoft on Sunday August 23, 2020 @07:41PM
(#24256255)
I think the vast majority of people use two... a personal one and a work one. Someone could easily check both for a person.
Re:Finding vulnerable Twitter accounts with expired domains
by popotamonga on Sunday August 23, 2020 @08:00PM
(#24256360)
Amazon leaks iirc