News for hackers. Stuff that matters.

A comment on Skype vulnerability allowing hijacking of an account if you know just the email.

Re:Skype vulnerability allowing hijacking of an account if y... by lucian1900 on Wednesday November 14, 2012 @04:58AM (#4782734)
It's even worse! Their website is so broken you can't change your password (new password fields are disabled) and you can't set a new email address as primary (the "make primary" button only appears when the new email address field is empty). Also, if you first add a new email address, save, then set it to primary, it disappears. Wtf.

I see no recourse other than closing my account, if that's still possible. [edit] No, not even that is possible.

[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by frontsideair on Wednesday November 14, 2012 @05:01AM (#4782740)
I'm having the exactly same problem, and I can't believe they're doing it. They won't even let us protect ourselves. Could they botch worse than that?
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by jtraub on Wednesday November 14, 2012 @05:02AM (#4782741)
I guess it was done to prevent account stealing while Microsoft works on appropriate fix
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by anonymoushn on Wednesday November 14, 2012 @05:14AM (#4782762)
This appears to be a bug.

After adding the email address and clicking save, logging out, and logging in, I found the email address was successfully added. At this point I could change it to the primary one, click save, paste my password, and click the button on the password prompt to successfully change my primary email address. If I tried to add the email and make it primary in one session, it would not work. If I entered my password and hit enter, it would not work.

[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by jrabone on Wednesday November 14, 2012 @05:38AM (#4782818)
Doesn't work for me - I can add a new email address, but when I sign out and back in it's vanished. Feels like they might have disabled parts of the account management system.
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by zamryok on Wednesday November 14, 2012 @09:01AM (#4783305)
The site is very buggy indeed. But it is possible to change the primary email adress if, when you are prompted to retype your password, you "type password and click button by mouse, not by "Enter" key" (as the post says). Maybe that would work for you...
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by loboman on Wednesday November 14, 2012 @10:13AM (#4783640)
The solution is here: http://www.reddit.com/r/netsec/comments/13664q/skype_vulnera...
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by TobbenTM on Wednesday November 14, 2012 @05:03AM (#4782743)
Never use enter to complete forms, use the mouse. That works for me.
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by pawelwentpawel on Wednesday November 14, 2012 @07:28AM (#4783057)
On top of that a lot of people have their Skype accounts integrated with facebook having their one and only email accounts published over there.
[ Parent | on HN ]
Re:Skype vulnerability allowing hijacking of an account if y... by davedx on Wednesday November 14, 2012 @05:21AM (#4782777)
And when you try to change your password:

Character not recognized. Please choose a mix of letters and numbers.

...

[ Parent | on HN ]