Sites Leaking Users' Email Addresses 194
Pisang writes "CNet is running a story about
how spammers and phishers can learn about our surfing habits to better target their attacks. According to the article, web sites that use e-mail addresses as IDs are vulnerable to attacks that could leak their users' email addresses. These attacks are performed by requesting a password reminder for an address or trying to register with it."
Re:register with (Score:3, Insightful)
Re:register with (Score:3, Insightful)
Re:Password reminders (Score:3, Insightful)
Like "What is my favorite movie?" then the person lists her favorite movie in her profile.
What they need to do is require four secret questions, all needing to be answered correctly to go on.
A good reminder is not to have a secret question that a background search or a Google search will turn up.
Re:Another problem (Score:3, Insightful)
This is the reason that most ISPs and web mail providers don't allow anybody to register an email that's been registered at any time in the past.
Re:Another problem (Score:3, Insightful)
I can't believe that's true, even of MSFT -- email addresses should NEVER be reused. Even at my old company where we used "bad" email addresses like "dan@mycompany.com," even if dan left, we'd never reissue that email address, even if it was the new CEO. you just can't do that!
I would however be somewhat concerned about expiring DOMAINS. For example, if I let the mycompany.com domain slip/expire, then someone definitely could set that up, and get ALL the email sent to anyone at mydomain.com. But that's a different problem I think.
Re:Add your pros and cons here (Score:4, Insightful)
Here's another one, and it ties into the original posting: it's the same problem as using biometrics for identification: using an ID or password that's hard to change. You don't want to use that kind of ID casually, because you want to make sure that people who have your ID have an incentive to be at least as careful with it as you would be.
If you use your thumbprint to pay for a drink at a bar, how good a job do you think the bar is going to do about making sure someone else doesn't game their sensor with a bit of latex on their fingertip? If someone steals your credit card, you can cancel it and get a new credit card. If someone steals your thumbprint you're hosed.
This is the same kind of thing. If someone finds out that there's someone with the handle "fishdan" on slashdot, they don't have anything useful. If they have your email address, they have something useful that's hard to change (look at me, I'm using year-tagged email addresses and I'm thinking of going to month tags). Plus, if you DO change your email address you have to change it EVERYWHERE (which is why I've got spam filters that reject entire countries for my main email address... because I've had it for about as long as personal domains have been available and I'm really loath to dump it).
And because of all this, what this means is that all email addresses have to be treated as disposable, even the supposedly private ones you use for account registration only. Which means that now your email address has the same problem as any other name: you have to remember a bunch of them, you have to remember where you used them, and if you only keep 'em long enough for the verification you can't relogin with the old address.
Don't PATCH it, FIX it. (Score:5, Insightful)
I've got a better idea. Don't require the user to give you their email address EXCEPT for initial registration. Don't use their email address as their ID. Don't ask for email address for password reset*. Just take the user ID, send the message, and have done with it.
This is a case where there's really no good and easy way to fix the security problem except by backing up and not doing the thing that causes the problem. This is like someone's saying "I want to leave my front door open while I'm not at home, so my cat can get in and out." and then coming up with "Well, you can set up a webcam to close the door when something bigger than a car comes up" instead of "Don't DO that, use a cat-flap".
----
* Why sites do that, I don't know... there's no extra security from having a login name AND and email address typed in by the user, since the verification mail won't go to anyone but the real user... all it does for me is make me generate a new account 'cos I don't know what email address I used to sign up with because of exactly this kind of problem.
Re:Got a Wikipedia Account? Vandals Got Your Passw (Score:1, Insightful)
It disgusts me that this is modded down and that page is still up. You, parent Anonymous "Coward," are now dubbed an Anonymous Hero.
Re: Vandals Got Your Password --- DUH (Score:3, Insightful)