The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
Spamming Password Requests
MegaMan001
CRNARochester, MNRegistered User regular
CRNARochester, MNRegistered User regular
Someone has been trying to get into my various accounts by spamming password reset requests. I've changed my passwords, and everything has 2FA so I don't think I'm at a major risk, but is there anything else I can do?
I guess there's nothing stopping someone from just putting my email into any random website.
I guess there's nothing stopping someone from just putting my email into any random website.
I am in the business of saving lives.
+1
Posts
I think the only other thing you can do is simply delete any accounts that you don't think you need anymore.
Do... Re... Mi... So... Fa.... Do... Re.... Do...
Forget it...
I don't understand how they do this today. Doesn't it lock out after a certain number of failed attempts? My work locks me out for 30 minutes if I fail 3 times.
The only thing I did in the last couple of years was add a couple characters to my passwords to make them more complex. I have 2fa on places that offer it.
Well, there's no way to know for sure what's hammering your account or why. But there are two common scenarios.
With the number of breaches we've had over the last decade, there's a good chance one or more of your passwords somewhere has been compromised. (Usually by a back-end breach, like some random website you signed up for 10 years ago had a poorly-encrypted database, and that database got leaked and decrypted.) The attacker knows that people often reuse passwords, so they just attempt to reuse your leaked password from oldshittywebsiteyouforgotabout.com and use it on microsoft.com.
That's the biggest reason why you shouldn't reuse passwords across different sites.
The other scenario is password spraying. Instead of hammering a single account all day, they use a common password across thousands of accounts at once. They figure that somebody is using "June2004" or some other simple password string. They don't need to waste time on guessing your password 5000 times, if they just guess 3 passwords across 5000 different usernames.
the "no true scotch man" fallacy.
I spent the time to go through all my stuff and change everything and delete every old account I could - shout out to Papa Johns which does not let you delete your account.
Disney+ keeps sending me passwords reset requests. Around 500 requests since I first posted. Doesn't speak well to their system since I canceled my account and I haven't gotten any real message from them.
I wish there was a way to contact Microsoft and have them reach out to whoever the hell it is and tell them they have the wrong email or something but alas
I would also add that these people buy and sell lists of hundreds of thousands to tens of million email account names. So even if it's 3 guesses and then you're locked out for half an hour, they just set it up to do 3 guesses and then go to the next email. By the time they reach the end of the list, the start of the list has timed out.
Rumor is there was a huge Microsoft data breach that hasn't been announced yet.
Highly recommend everyone change their Microsoft account passwords if you haven't done so in a few weeks.
this has been happening to me too, I think there's just a large scale botting operation doing something with the emails on the MS account login specifically
well fuck
Edit to add per @BahamutZERO 's idea I checked my login attempts for my MS account and it has gone from ~3 a day to one every two hours. A variety of things, too, like account sync attempts, mobile and desktop logins, so... that's fun.
I turn on MFA for everything (and use Authy as my default security token factor) for years precisely so I don't have to worry about stuff like this. But yeah, I suspect if you check any account login attempt history for anything tied to a reasonably-public username (e.g., your email address) then you will find that they constantly get spammed on a regular basis.
(Just checked my Microsoft account and, yup, I get regular attempts from China, Brazil, and India pretty much every week.)
The only real solution to this problem is to set up alias emails for everything but it's a lot of annoying work just to avoid a problem that's blocked with a password manager and MFA enabled.
PSA: If you're concerned that someone has managed to get in then you can just change your password and then force everything to get logged out (Microsoft has that feature in account management somewhere).