Ask HN: I just got a new password by email from info[at]ycombinator.com

https://news.ycombinator.com/item?id=2024075

by ra • 16 years ago

16 16 16 years ago

news.ycombinator.com

I didn't log in / out, or request a new password.

Has this happened to anyone else?

And is it possible to get the IP that requested this?

thanks

xuki• 16 years ago

Anyone can request new password for your account by entering your username.

Btw, just send you a new one.

moconnor• 16 years ago

Let's all do that O_o

Havoc• 16 years ago

The admins probably have access to that info. I don't see how its going to help you though. If it was a malicious hack attempt then the person is probably running it through proxy or using dynamically allocated IPs making the IP addr worthless without a court order from a court in the country that has jurisdiction over the ISP/proxy.

arethuza• 16 years ago

You have a very short username - could be that someone was looking at the "send a new password" page and made a mistake or was just plain curious.

I don't think I would worry about it too much unless I started getting lots of these emails.

marcinw4• 16 years ago

A better way for Hacker News to handle password resets is to send the original email address associated with the account an email containing a one-time, expiring link allowing the user to change their password from. Otherwise, your password would remain unchanged.

kvs• 16 years ago

Why is this better than current approach? Is it because the current password remain unchanged until the user click on the link to reset part?

theandym• 16 years ago

Exactly. It allows people to easily reset their passwords if they've forgotten them while reducing their need to update their password if someone accidentally/maliciously attempts a reset.

AdamGibbins3• 16 years ago

I think a better method is to send a new password but continue to allow the users old password until they first login with their new password at which point the old is erased and only the new is valid.

It removes that extra step and is in turn simpler for the user. Rather than sending them this weird long URL - not such a problem with HN but with other less-technical sites I suspect this causes some confusion the first time someone experiences one.

marcinw4• 16 years ago

This approach would introduce more complexity than it's worth, in addition to being less secure. Instead of just one password that can be used to login to your account, you now have two valid passwords.

ra• 16 years ago

Yes, that is a much better way to do it.

Also the resetting user should be asked to provide their email address rather than the public forum username which is easily scrapped.

raz0r• 16 years ago

This is really tragic.

allard• 16 years ago

it was me

oops

Ask HN: I just got a new password by email from info[at]ycombinator.com

Related Stories