News for hackers. Stuff that matters.
Re:What kind of password reset scam is going on at Facebook? by chriscjcj on Thursday September 07, 2023 @09:58AM (#37419011)
I used to use an e-mail address a terrific domain name that I own. Without publicly disclosing specifics, it was like this:

<common_name>@<common_name>.com

Thousands of people with this name, who didn't want to give out their real e-mail address, used this e-mail address when signing up for things online. They probably never thought it would be someone's actual address. I finally had to quit using it because of the tremendous amount of e-mail that wasn't directed at me. Most of it looked legit enough to the spam filters to allow through.

I temporarily turned that account on about 5 years ago and it was getting about 3,000 garbage messages per day.

I thought having a cool e-mail address would be great, but not any more. I switched to an address that, while easy to say and tell people, it's very unusual and it's very unlikely someone else would ever come up with it.

Re:What kind of password reset scam is going on at Facebook? by kstrauser on Thursday September 07, 2023 @10:18AM (#37419246)
Way back when, I got a Yahoo email like <HN_username>@yahoo.com. My last name isn’t unique, but it’s not exactly Smith. It’s amazing how many other people have mistyped it. To this day, I still get emails meant for other people.

I keep that old account for 2 purposes:

1. It amuses me. I log in and clear it out once a year or so.

2. At various times I’ve had coworkers who didn’t believe it was common for people to enter someone else’s email address when registering for a sensitive system. When that happens, I’ve taken them to my old Yahoo webmail. Oh look, another kstrauser’s loan paperwork!

I can only imagine what that’d be like if it were at Gmail and not Yahoo.

Re:What kind of password reset scam is going on at Facebook? by ChildOfChaos on Thursday September 07, 2023 @10:00AM (#37419034)
I have a [email protected] address and I have this problem quite a lot, were i get a lot of random stuff.

Sometimes from the same person, there starbucks card seems to be linked to it for example. Annoying.

Re:What kind of password reset scam is going on at Facebook? by Johnny555 on Thursday September 07, 2023 @10:16AM (#37419218)
Same, I get a lot of sensitive correspondence, things like divorce settlements from lawyers, mortgage applications, correspondence with doctors with a lot of personal details (that the person cc’ed me on), airline reservations, etc.

Usually I’ll reply to the sender and tell them they have the wrong email address, some don’t believe me, sometimes they ask me if I know the person (out of a billion gmail users), some complain that I took to long to tell them about the wrong address, and sometimes a lawyer will direct me to delete all copies of the errant email…

I always reply back to tell them that the email lands on multiple devices and is downloaded and backed up automatically and to see if they want to pay me on a time and materials basis or if they want a project based fee. None have been willing to pay me to cleanup their mistake.

Way back when I signed up with gmail, I was happy to get a [email protected] address, now I wish I’d gone with something more obscure.

Re:What kind of password reset scam is going on at Facebook? by gsharma on Thursday September 07, 2023 @11:06AM (#37420005)
Same situation here! My HN Username @gmail and my last name is a very common last name in India.

I’ve received people’s tax returns (including their SSN), airline tickets and hotel reservations, matrimonial proposals, photographs, etc.

I often used to email back and let people know about the mistake, but rarely do it now unless there is sensitive/urgent information.

To deal with some of the repeated unwanted emails, I have rules created to label those emails with a specific label. I use Google scripts to auto-delete all emails from that label which are older than 365 days. It cleans up repeated transaction emails from Indian banks/credit cards, newsletters, etc. but also gives me a year to retrieve the email if it was actually meant for me.

Re:What kind of password reset scam is going on at Facebook? by pintxo on Thursday September 07, 2023 @10:20AM (#37419277)
Same, got me a free month of Disney+ once.
Re:What kind of password reset scam is going on at Facebook? by jcpham2 on Thursday September 07, 2023 @10:13AM (#37419181)
I took was an early adopter of gmail and I imagine a person could guess what my email address is, especially if I said I keep forgetting my HN passwords.

Misplaced periods give me all sorts of other people's emails - new cars, new mortgages, new bank accounts, new home purchases that are not in my name or identity (based on the names I understand the confusion) - all sorts of things that I'm not doing IRL. Sometimes I try to reach out to the sender and get them to correct the email address, sometimes I just unsubscribe

Re:What kind of password reset scam is going on at Facebook? by ActionHank on Thursday September 07, 2023 @10:22AM (#37419301)
Finally found the person behind [email protected]!
Re:What kind of password reset scam is going on at Facebook? by slowhand09 on Thursday September 07, 2023 @10:40PM (#37428572)
Re:What kind of password reset scam is going on at Facebook? by MarkSweep on Thursday September 07, 2023 @10:14AM (#37419190)
[email protected] can have similar problems. Somehow people miscommunicate or misremember their email address and I get a lot of misdirected messages.
Re:What kind of password reset scam is going on at Facebook? by MrMember on Thursday September 07, 2023 @10:55AM (#37419817)
I have [email protected] and I get a lot of stuff meant for other people. Someone even used it to sign up for their bank, and said bank apparently didn't require verifying the email address. I don't even have that common of a name.
Re:What kind of password reset scam is going on at Facebook? by HelloNurse on Thursday September 07, 2023 @10:57AM (#37419843)
I'm in the [email protected] club too (common first name and very common surname) and I receive so many mistaken emails that I like to collate them to guess which homonyms are the same person.

I often see repeated attempts to create accounts without reconsidering the email address, and sometimes they succeed (I received repeated invoices for Sky and for an insurance, not to mention occasional ones).

Re:What kind of password reset scam is going on at Facebook? by unregistereddev on Thursday September 07, 2023 @11:08AM (#37420036)
I have [email protected] and have occasional problems with this as well, despite having a very uncommon last name.
Re:What kind of password reset scam is going on at Facebook? by matthiaswh on Thursday September 07, 2023 @11:39AM (#37420583)
Now imagine how bad it is for the guy with the verbatim email address `[email protected]`.
Re:What kind of password reset scam is going on at Facebook? by Arrath on Thursday September 07, 2023 @02:34PM (#37423536)
Oh wow, I'd never even considered that.
Re:What kind of password reset scam is going on at Facebook? by ShellfishMeme on Thursday September 07, 2023 @12:59PM (#37421974)
Same thing here. The worst part is when websites don't actually require an email confirmation to keep using them. In the beginning I've tried to reach out to those companies to close the accounts without accessing them but by now I've started just resetting the password and then deleting them. It's just too difficult to do the right thing.
Re:What kind of password reset scam is going on at Facebook? by xpil on Thursday September 07, 2023 @03:35PM (#37424435)
Welcome to the club. My gmail address is [email protected] and I keep receiving occasional emails for [email protected] who is actually some kind of a senior manager in one of the major TV stations. It works the other way around as well (he receives my emails - extremely rarely, but still). We simply agreed to forward them to the right person and delete afterwards so there is no issue per se, but it's still kind of funny.

Also, my daughter has [email protected] and there is another lady with the address [email protected] (yes, a typo in her first name, duplicating one of the letters) and of course she keep receiving her emails and vice versa. Same solution - they mutually agreed to forward messages to the right person and delete them afterwards.

First world problems...

Re:What kind of password reset scam is going on at Facebook? by gigel82 on Thursday September 07, 2023 @10:13AM (#37419182)
I get the same with <common_name>@outlook.com ; managed to sign up right as the service was launched and thought I scored :)

After a couple of years gave up on that address as it was getting dozens of messages a day (a lot of them legit email, sent to the wrong address - including bank statements, shipping orders, etc.)

Re:What kind of password reset scam is going on at Facebook? by obscur on Thursday September 07, 2023 @10:18AM (#37419242)
How is this related to the topic?
Re:What kind of password reset scam is going on at Facebook? by chriscjcj on Thursday September 07, 2023 @10:25AM (#37419350)
While not entirely on topic, I am implying that the person who is getting the unremitting password reset requests may have an e-mail address with a similar problem.

My <common-name>@<common-name>.com address gets incessant password reset requests for every major online site in existence. (I should have been clearer about this; sorry.)

I am suggesting that, by having strange or very unique e-mail address, you can fairly effectively mitigate this phenomenon.

Re:What kind of password reset scam is going on at Facebook? by kentonv on Thursday September 07, 2023 @10:47AM (#37419682)
Mine is temporal at gmail. "Temporal" was my teenage gamer tag which I mostly stopped using decades ago, but it's been my gmail address for almost 20 years and changing it is not easy.

The problem is, "temporal" happens to mean "temporary" in Spanish. As soon as Gmail became popular in the Spanish-speaking world, people started using it as a placeholder address.

* Lots of people use it when creating throw-away accounts.

* Sometimes companies use it as a placeholder when they don't know a customer's address. Multiple telecom companies in various countries have done this to me, sometimes populating hundreds of customers' accounts with my email address, such that I receive all of their phone bills, sometimes even with detailed call logs.

* All kinds of students register for university classes using my address resulting in me getting tons of emails from professors. In many cases I could go drop their classes for them if I were evil enough.

* Once a Colombian school gave my address admin access on their school-wide Zoom organization. The really annoying part about this is that Zoom didn't give me any way in the UI to leave the organization, so my account was attached to this school until I complained on Twitter and someone silently fixed it.

* For the last couple months, someone has been scraping Shopify-backed web shops, entering my email address when prompted, putting things in their cart, and then abandoning it, such that I receive an email saying "Hey you left this thing in your cart! Do you still want to buy it?" The emails are always in Spanish, of course. I receive them from like 50 different web sites every day. (Luckily I was able to create a filter for certain Spanish words...)

None of this stuff gets filtered as spam because it does not look like spam to gmail's filters. I have learned it's more productive to block addresses than to mark spam, but this annoyingly takes four clicks per email. I have begged Google to give me a way to filter by language but of course no one is listening.

WIRED even wrote an article about it: https://www.wired.com/story/misplaced-emails-took-over-inbox...

I know, I know, I need to change my email address and probably get off Gmail altogether. It's difficult because I have 20 years of history built around this address.

Re:What kind of password reset scam is going on at Facebook? by k12sosse on Thursday September 07, 2023 @11:47AM (#37420731)
I'm sure having it spelled out verbatim in an article online helped cut the emails per second down ;)
Re:What kind of password reset scam is going on at Facebook? by kentonv on Thursday September 07, 2023 @12:07PM (#37421069)
Nah, I don't think saying my address publicly has any effect. AFAICT none of the problem comes from people who are actually aware that the address has an owner.
Re:What kind of password reset scam is going on at Facebook? by raybb on Thursday September 07, 2023 @03:23PM (#37424261)
Might wanna try gmailctl for making some filters. You could make it very fast to send certain domains to the trash
Re:What kind of password reset scam is going on at Facebook? by berdon on Friday September 08, 2023 @07:41AM (#37432269)
I’ve had a gmail account since their first beta. Switching to another provider (Fastmail) took about an hour to run through so my accounts and swap emails out. There was one or two that didn’t allow changing emails (steam is one) but other than that it was much easier then I assumed.

I still check the gmail account ever so often and it still receives spam. My Fastmail account is perfect even after a year.

Re:What kind of password reset scam is going on at Facebook? by Angostura on Thursday September 07, 2023 @10:57AM (#37419849)
Hi Bob
Re:What kind of password reset scam is going on at Facebook? by cryptoegorophy on Thursday September 07, 2023 @11:00AM (#37419892)
I treat giving out my email as giving out the social security number. I wish HideMyEmail feature from iOS came in 15 years ago.
Re:What kind of password reset scam is going on at Facebook? by thrill on Thursday September 07, 2023 @11:39AM (#37420588)
[email protected] was my go-to throwaway email address - sorry about that.
Re:What kind of password reset scam is going on at Facebook? by hellojesus on Thursday September 07, 2023 @12:06PM (#37421064)
Lol I always use [email protected], so to whomever owns that: you're welcome.
Re:What kind of password reset scam is going on at Facebook? by yencabulator on Thursday September 07, 2023 @12:14PM (#37421206)
There's an idiot sharing my first & last name who never remembers to put his middle initial in his email address, and as a result I see he's an alcoholic, has financial trouble, keeps applying for artist grants, has a social sciences degree of some sort, is involved in local politics, and so on.

I could also choose to pwn his online betting, games, dating, and porn accounts any moment I want. I may or may not have changed his gender preferences on a dating site...

Re:What kind of password reset scam is going on at Facebook? by JohnMakin on Thursday September 07, 2023 @03:39PM (#37424492)
How? If his email is something like [email protected] and he's accidentally entering [email protected] (you), how is he ever able to register? If he's sending password reset requests to the wrong address (yours) - wouldn't every site in existence realize that's not the registered account and the email would never end up in your inbox?
Re:What kind of password reset scam is going on at Facebook? by yencabulator on Thursday September 07, 2023 @03:43PM (#37424544)
He has john.w.smith and is repeatedly typing in john.smith, and also hands it out to humans who then want to contact me about his things.

Apparently for many sites, user retention & money are more important than verifying an email address up front. He visits the scummiest betting and dating sites, so I'm not very surprised.

Re:What kind of password reset scam is going on at Facebook? by worthless-trash on Friday September 08, 2023 @02:32AM (#37430186)
I'm getting similar behavior from another user with the same pattern.

I also get their college results, government assistance, a payday loan company, pinterest and subscriptions to newsletters sent to me for them.

Ive mailed them directly, multiple times but they dont seem to care. I'm now returning the favor, signing them up for all the crappy sites when i need a throwaway.

Re:What kind of password reset scam is going on at Facebook? by Tagbert on Thursday September 07, 2023 @05:43PM (#37426024)
A surprisingly large number of sites will let you register without requiring an email verification.

I continually get a lot of emails, sometimes with private information to first [email protected] where people with my same name just use that without caring that it is not their email address. You probably aren't getting that job offer and you probably aren't getting that bank load approved without being able to see the emails.

For a while I tried to notify the senders but they rarely reacted or even provided a way to contact them. Now I worry about it becoming a scam vector so I just delete them.

Re:What kind of password reset scam is going on at Facebook? by michaelmrose on Thursday September 07, 2023 @08:10PM (#37427509)
Once you leave sites actually created by tech companies many sites don't actually verify that you own an address you just input anything you please that looks like a valid email. The extra step as it were isn't included in all online tutorials on "how to manage implement login".

To deepen the problem gmail actually ignores periods in email so even if [email protected] already exists its possible create accounts for both [email protected] and [email protected] because although google will absolutely treat those 3 as the same thing and route all messages to any of the above to our first fellow randombob.com treats those as 3 unique email addresses.

This was actually exploited by the fellows that robbed Washington states unemployment system during the pandemic applying for unemployment for folks that didn't need it including humiliatingly enough actual workers who worked for the washington state employment security division. To make their robbery more ergonomic multiple fraudulent accounts were set up with email addresses that differed only by periods. In this instance it only worked of course because they were indeed able to verify their email accounts.

In other instances for example myFico has weak protections on signing up. You can use ANYONE's email address to sign up but strong protections on actually accessing information. This means in effect if someone signs up as you as actually happened to my wife you will never be able to get them to stop spamming you with that persons personal information nor make the person stop giving out your email.

I wasted 15 minutes of my life trying to explain that the address given actually was my wife's email address. Bitched to their credit union/other institutions about the persons financial data being leaked, created a complaint with the FCC. YADA YADA nobody cares about properly implementing email verification or leaking people's financial information.

Re:What kind of password reset scam is going on at Facebook? by flir on Thursday September 07, 2023 @04:34PM (#37425177)
I've got one who keeps forgetting he's got numbers on the end of his email address. He's a sheriff in a southern state. Also an idiot.

What's doubly annoying is the US gov is pretty lax at things like unsubscribe links, so I keep getting notifications about his Medicare account that I can't unsubscribe from.

Re:What kind of password reset scam is going on at Facebook? by nitwit005 on Thursday September 07, 2023 @08:04PM (#37427452)
They exempted themselves from the spam rules.
Re:What kind of password reset scam is going on at Facebook? by justsomehnguy on Thursday September 07, 2023 @09:50PM (#37428286)
> so I keep getting notifications about his Medicare account that I can't unsubscribe from.

That's forwarding rules are for. Preferably to the email of some judge in his precinct.

Re:What kind of password reset scam is going on at Facebook? by radicalbyte on Friday September 08, 2023 @01:36AM (#37429780)
My wife has one of those, a rather stupid American who keeps using her gmail for things (and regularly tries to reset her password).
Re:What kind of password reset scam is going on at Facebook? by tetris11 on Friday September 08, 2023 @02:40AM (#37430255)
My friend gets one every month from a really ugly guy. Super illiterate, brings bendy-straws-to-bathrooms type, probably has grandkids.

(That's what we're doing here right? Bashing on the old and the tech-illiterate?)

Re:What kind of password reset scam is going on at Facebook? by nullindividual on Friday September 08, 2023 @01:05PM (#37436288)
The way your post is structured reads as if you have a stupid American wife (I can hear Vasily Borodin say this).
Re:What kind of password reset scam is going on at Facebook? by y-c-o-m-b on Thursday September 07, 2023 @12:19PM (#37421304)
If you are [email protected] or [email protected], I am sorry about the decades worth of product offers, porn subscription offers, forum or blog reply notifications, etc.
Re:What kind of password reset scam is going on at Facebook? by takinola on Thursday September 07, 2023 @01:12PM (#37422189)
I use [email protected] for any service that insists on an email address when they have no business doing so (eg public WiFi portals). I used to use [email protected] to avoid spamming poor Bob but many services now disallow example.com as a domain.

Sorry Bob!

Re:What kind of password reset scam is going on at Facebook? by znpy on Thursday September 07, 2023 @04:08PM (#37424873)
I usually use [email protected] when a website insists on an email address to let me download something. I also curse at the marketing team, just in case.
Re:What kind of password reset scam is going on at Facebook? by epiccoleman on Thursday September 07, 2023 @10:02PM (#37428361)
Oh my God, that's brilliant.
Re:What kind of password reset scam is going on at Facebook? by callalex on Friday September 08, 2023 @01:54AM (#37429904)
I guess I’m more evil, I use abuse@ whatever site because I know that’s guaranteed to be monitored.
Re:What kind of password reset scam is going on at Facebook? by epiccoleman on Thursday September 07, 2023 @10:03PM (#37428364)
I usually use [email protected], which usually works (some sites won't let you use a mailinator address).
Re:What kind of password reset scam is going on at Facebook? by secabeen on Friday September 08, 2023 @03:57AM (#37430813)
Gmail launched with a minimum username length of 6 characters, so no one has ever had [email protected].
Re:What kind of password reset scam is going on at Facebook? by drewg123 on Thursday September 07, 2023 @12:23PM (#37421364)
I'm [email protected], and I get tons of misdirected email. I've gotten peoples car registration / insurance information, an aarp membership, somebody else's Verizon cell phone acct, quotes meant for a city by the same name as my last name, etc.

I do think that it has gotten better over the years, as more and more places have at least added email verification to their signup flows.

Re:What kind of password reset scam is going on at Facebook? by qingcharles on Thursday September 07, 2023 @01:40PM (#37422650)
Reminds me of the time I changed my main cellphone number so the last digits were 69696969.

It was a really, really bad idea that sounded funny in my head. That number is scrawled on every toilet wall with "for a good time call: ..."

Every hour of the night...!

See also:

https://www.wired.com/1998/09/woz/

Re:What kind of password reset scam is going on at Facebook? by neuronflux on Thursday September 07, 2023 @01:43PM (#37422710)
My email is <first initial><last name>. I also have the same first initial as my father, sometimes I get email intended for him. Fortunately our last name is unusual so that's about the extent of it.
Re:What kind of password reset scam is going on at Facebook? by m463 on Thursday September 07, 2023 @03:21PM (#37424240)
sounds like the woz story, where he got a common phone number like 888-8888. but he would get calls all day from babies.

EDIT: https://www.wired.com/1998/09/woz/

(a large article, search for 888-8888)

Re:What kind of password reset scam is going on at Facebook? by znpy on Thursday September 07, 2023 @04:05PM (#37424849)
You don’t need a custom domain, a gmail address is enough.

I have [email protected] and I routinely used to receive emails for [email protected], because of some moron at google that though it was a good idea to ignore dots.

I haven’t checked that gmail account in a while (gmail is just trash at this point, beyond salvage) but I might still be receiving this guy’s loans solicitation or his car insurance certificates. Who knows.

Re:What kind of password reset scam is going on at Facebook? by rufus_foreman on Thursday September 07, 2023 @08:32PM (#37427695)
At least with email you can change your address. I once had a process server come to my door to serve a summons, it was my first and last and name with a different middle initial. When I pointed that out to the process server, he said "close enough" and walked away.

I had never been served a summons before so I was worried about it, I called a lawyer and the lawyer said to just throw the summons in the trash.

Although apparently the guy with the same name as me was going bankrupt or something, his bad debts started showing up on my credit report and I had to mail the reporting agencies to take them off, went on for a few years.

Re:What kind of password reset scam is going on at Facebook? by nikolay on Thursday September 07, 2023 @10:48PM (#37428622)
I often used [email protected]... but now you.com is active, so, sorry guys!
Re:What kind of password reset scam is going on at Facebook? by gorbypark on Friday September 08, 2023 @06:44AM (#37431958)
I have a decently common first name and last name and was eventually able to snag the domain of my name (firstnameLastname.ca) and switched over most of various online accounts to use it.

I'm not a big Twitter user, and when I went to log in Twitter for the first time in probably a year or two, I forgot that it was still using my gmail account. I couldn't remember my password, so I did a password reset, received the email, and reset my password.

After looking around a bit, I realized this was not my account. It turned out the previous owner of firstnameLastname.ca also used [email protected]

I ended up making a twitter post basically saying "Hello, I think I accidentally stole your account. If this used to be your account, email me.". A few weeks later I got an email from a fellow with the same name as me, who used to live in Canada but had moved back to England. I was able to change the email on the account and give him back access.

Re:What kind of password reset scam is going on at Facebook? by logbiscuitswave on Saturday September 09, 2023 @12:44AM (#37442371)
My Gmail account is the same way. I constantly get people using it as a throwaway email address for various dating sites, commerce sites, and porn sites. After enough annoying emails, I’ll typically change the account’s password or delete it if I can. (These sites usually aren’t the most reputable, so often times about the most I can do is change the password to lock them out.)

I don’t get why people do this. It’s not like it’s difficult to get a throwaway email account.