2

Why, for certain email domains (through which one creates an SE account), the isn't the password recovery system automatic and one has to use the "contact us" feature?

For example:
I have xyz@mailinator.com as my email id. I had used it to register at SE. Now when I put this email address in account recovery I get:

Account recovery is disabled for that email domain. To recover your account, please contact us directly.

  • well people are downvoting my question whille upvoting the answer. how is my question bad now? – sww Apr 6 '16 at 7:37
  • The downvotes mean, here on MSE, that people don't agree with the idea behind the post. In this specific case, people disagree with your idea that password recovery should always be automatic. – Shadow The Princess Wizard Apr 6 '16 at 12:33
  • @ShadowWizard I never said it shld be. It wasnt earlier and now it is! – sww Apr 6 '16 at 17:13
  • It's implied. "Why isn't the password recovery system automatic?" means you expect it to be automatic. – Shadow The Princess Wizard Apr 6 '16 at 17:20
14

Mailinator (and other services like it) allow you to create a fully disposable email address. What this also means is that anyone could change your password on your behalf.

This isn't a theoretical possibility. A few months ago someone did just that for a bunch of accounts on Stack Overflow. (Fun fact: people who are inclined to sign up for sites using mailinator are also fond of using their username as their email address.)

We disabled automatic recovery for a number of disposable-email providers to stop the immediate abuse at the time, and to prevent it from re-occurring in the future.

  • how can one prevent this by disabling automatic recovery. even while contacting SE team, the same thing will continue because the only point of contact is an open inbox – sww Apr 5 '16 at 22:06
  • 5
    @sww You're right, it's not completely preventable. Still, it helps to have a human make a decision rather than leaving the door wide open. My personal take on this is that if you use a disposable address, you should be prepared for your account to be disposable as well. – Adam Lear Apr 5 '16 at 22:07
  • I think I fell victim to this. I mailed the SE team an hour back regarding my account on SO. The sad part is, by the time they reply, I must have gone AFK and mailinator doesnt store emails forever. it deletes them and I might miss the reply from the SE team. – sww Apr 5 '16 at 22:10
  • 2
    @sww I'd suggest not using mailinator, then. Surely you have another email you can use to contact our support team. – Adam Lear Apr 5 '16 at 22:12
  • 3
    Then think next time before you use a disposable email address. – Patrick Hofman Apr 5 '16 at 22:12
  • I have an other email. but i had to give the email id with which the account is linked. shld have mentioned the email address in the body of the message when contacted SE team. Anyway thanks. @PatrickHofman yes – sww Apr 5 '16 at 22:15
  • @sww I'd submit another request (and list your "real" email), reference the fact that you contacted us earlier today, and list the email your account is associated with in the body of the request. – Adam Lear Apr 5 '16 at 22:16
  • @adam why are such services allowed in the first place? Wouldn't it be easier just to block them? – Patrick Hofman Apr 5 '16 at 22:16
  • btw, what happened to the person who accessed those accounts? were all those accounts destroyed? – sww Apr 5 '16 at 22:19
  • 1
    @PatrickHofman You'd think so, but there's literally hundreds of them. We blocked the common ones, and I thought we added a warning on sign-up about not being able to recover, but it's possible that we just talked about it and then I forgot to actually do it. I'll double-check. – Adam Lear Apr 5 '16 at 22:21
  • @sww Nah. The owners of those accounts are welcome to contact us if/when they decide it's time to reset their password. – Adam Lear Apr 5 '16 at 22:21
  • but wouldnt the person who did this still have access to those accounts? s/he changed the password. – sww Apr 5 '16 at 22:23
  • @sww If I recall, we suspended a bunch of them so access doesn't do them any good. – Adam Lear Apr 5 '16 at 22:24
  • approximately, how fast does the support team reply? (just an out of context question) – sww Apr 5 '16 at 22:32
  • Usually within a few days @sww – Patrick Hofman Apr 6 '16 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .