Google Account Recovery Vulnerability

Re:Google Account Recovery Vulnerability by oneeyedpigeon on Friday November 22, 2013 @04:08AM (#6779859)

Recently, I decided to follow-up one of the many emails I receive from a company I've never heard of, implying I have an account with them. I usually assume they are spam, but this looked like a genuine case of someone accidentally using my email address and the service not verifying it. Long story short: via their password recovery, I now have the user's plaintext password, and several personal details including address, age, phone number, and mother's maiden name.

I emailed the company (a US mobile phone company I haven't heard of; I'm based in the UK) and their response was along the lines of "call us (at your expense) and tell us your phone number and we'll sort it out". In the end, out of sheer frustration, I reset the account's email address to that of the company's WHOIS technical contact; that was the safest way I could think of getting my email address off the account.

Google, of course, handle this kind of thing properly. But for every google, there are thousands of companies who will give your personal data away without a care in the world.

[ Parent | on HN ]

Re:Google Account Recovery Vulnerability by tfgg on Friday November 22, 2013 @08:53AM (#6780666)

I once had someone sign up for an electronic voicemail service with my email address. I was getting all their voicemail, including once about 50 in the space of an afternoon from a clearly distressed client of theirs. It took a very long email chain with customer service explaining that I couldn't log in to the account to change the email address because I didn't have the password and the account wasn't mine. A similar thing happened with a Playstation Network account.

Web developers: Please make sure to include a "Didn't sign up for this? Click here to disable/unsubscribe" option in sign up emails, rather than assuming that the person receiving the email is the correct person who knows the password.

[ Parent | on HN ]

Re:Google Account Recovery Vulnerability by Pxtl on Friday November 22, 2013 @12:37PM (#6782277)

To be fair, I have accidentally clicked on the "oh yeah, confirm this email address" when I suddenly realize "no, wait, I created that account with my other email address... what the heck is this?"

More of a problem with common big-name services like Facebook and Apple ID and whatnot.

[ Parent | on HN ]

Re:Google Account Recovery Vulnerability by rallison on Friday November 22, 2013 @05:12AM (#6780047)

Thank you. This is what is frustrating. One of the worst offenders for me was reporting a vulnerability to http://www.gogvo.com/ - the vulnerability did end up getting patched (so, that, at least, was a plus), but..

Did I get any sort of response to the disclosure email? Nope. That said, if not getting a reply was the only issue, I really wouldn't care.

What did I get? Added to a spam newsletter from gogvo/Joel Therien:

"true 100% commissions for life!!"

"How To Take ACTION In Your Business LIVE tomorrow night!"

Thanks, gogvo, for that.

On the other hand, for every gogvo, I've had a handful of companies sincerely thank me for my reports. It varies a lot.

[ Parent | on HN ]

Re:Google Account Recovery Vulnerability by aestra on Friday November 22, 2013 @10:22AM (#6781176)

I own an email account that people could put for their email when they don't want to give an email. Something like [email protected]. I have gotten emails that indicate people (not me) have signed up for services with it. I created it for throwaway accounts.

[ Parent | on HN ]

Re:Google Account Recovery Vulnerability by oneeyedpigeon on Friday November 22, 2013 @11:44AM (#6781851)

The funny thing about mine is that it's a pretty standard [name]@gmail.com, yet I get an awful lot of stuff claiming that my address has been signed up for various things - often in the 'youth social media' vein. I'm never sure whether people are just entering a random email address, or if this is spam.

[ Parent | on HN ]