8

This question already has an answer here:

My friend is receiving a lot of Stack Overflow account recovery emails. When I checked I came to know that for triggering account recovery only email id is needed. So anyone knows his email ID can send a recovery email to his inbox. Since email ID is something public should we ask some private info like date of birth before sending account recovery email?

Recovery Emails

marked as duplicate by Adam Lear Jan 20 '16 at 21:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    I'm not at all against requesting some verification for password recovery mail to be sent, but emails are not necessarily public. Also; what login provider are we talking about here? – Andrew Barber Feb 27 '14 at 15:49
  • 7
    Considering how many SO users lie about their date of birth, that would be a rather bad thing to require. – Wooble Feb 27 '14 at 15:52
  • He can contact the team via the "contact us" form (see footer) and ask them to look into it. They might be able to detect the IP used to do this and block it. – Shadow The Dragon Wizard Feb 27 '14 at 15:58
  • @ShadowWizard.Ok. But in India static IPs are very rare...If I disconnect & reconnect IP will be different. – Harikrishnan Feb 27 '14 at 16:02
  • 5
    If they know your email address, they can sign you up for SPAM lists, which would be much more annoying. While I wouldn't be "for" requiring more info, perhaps throttling could help. – MikeSmithDev Feb 27 '14 at 16:35
  • 2
    Stack Overflow is not inline code, please do not misuse the backticks. – Shadow The Dragon Wizard Mar 3 '14 at 10:36
  • @Adam Lear♦ Why did you mark the original question as duplicate instead the newly asked one? – Harikrishnan Jan 21 '16 at 3:22
  • @Harikrishnan Because I ended up answering that one first and the order of dupes doesn't really matter. – Adam Lear Jan 21 '16 at 3:23
7

I agree with this feature request. To test this, I just made four requests in quick succession. Sure enough, I got all four emails in my inbox. This way, if you know the email address of another user, you could spam them with 'Account Recovery' emails all day.

Considering there are a lot of people who has made their email public, this is a big problem. A possible solution would be to implement a captcha as you said in the question. Something similar to the one we already have when answering questions:

enter image description here

I think it'd be a good idea to also add some kind of throttling for the amount of requests that can be made in an hour (or day).

  • 2
    An interesting, related discussion: medium.com/cyber-security/24eb09e026dd – Amal Murali Mar 2 '14 at 7:56
  • 2
    @AmalMurali That's the most terrifying thing I've read in a long time. – michaelb958 Mar 2 '14 at 7:59
  • 1
    While I agree it'd be nice to fix this, if somebody has my email address, they can spam me easily enough themselves without this exploit. Perhaps I'm missing something, but why is it a 'big problem' that somebody who already has the ability to spam me can choose to use Stack Overflow as an intermediary? (Especially given that in doing so, they lose the ability to control the content of the message, so this isn't even useful for offering me those penis enlargement pills from Nigeria that I always buy when I'm emailed about them.) This entire exploit is only useful for pissing people off. – Mark Amery Mar 2 '14 at 11:52
  • @AmalMurali Ya I have read that article before...It was Social engineering attack... – Harikrishnan Mar 3 '14 at 10:30
  • @MarkAmery: most likely because SO's in their contacts list (and is generally "trusted"), unlike any random email account. – Qantas 94 Heavy Mar 3 '14 at 10:49
10

Asking for additional information to request a password reset email is a horrible idea. Especially when it involves something that people are likely to fill out with fake info (realname, birthdate, etc.) or if it's a "secret" question where when entering it initially you don't know if it grants full access to the account or for what it's actually used.

I think the best solution is to simply rate-limit those emails: Allow one reset request per week. That's way enough (if you forget your password more often, you should probably see a doctor to get your brain checked out) and if some jerk decides to request the email once per week it's not that much of an issue.

Not the answer you're looking for? Browse other questions tagged .