Slashdot Mirror
Skype Disables Password Resets After Huge Security Hole Discovered
another random user writes with news of a vulnerability in the Skype password reset tool "All you need to do is register a new account using that email address, and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)"
concealment adds a link to another article with an update that Skype disabled the password reset page as a temporary fix.
I could have been easily hit by that one...
"When information is power, privacy is freedom" - Jah-Wren Ryel
Now my identity will be stolen!
then there are epic lulz
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Which part of "Microsoft Product" did you not understand?
I almost feel sorry for them discovering this just after they discontinued Microsoft Messenger and moved people on to Skype. To be fair I expect this hole existed when they brought Skype.
I'd ask for a refund!
Bought*
I wish people would get this mix up of words right. It's like when someone says "me either" in response to something like "I dont like that":
- I don't like bees
- Nah, me either, i hate them.
It's neither dammit!!
I almost feel sorry for them discovering this just after they discontinued Microsoft Messenger and moved people on to Skype. To be fair I expect this hole existed when they brought Skype.
I’m not so sure about that, y’know. It would likely have been discovered by now.
I expect it’s a side effect of the migration of MSN users to Skype as it likely requires changes to both Skype and its backend.
Ignore this signature. By order.
Your to fussy. I could care less.
...take a deep breath, then get ready to rant!
Security is for pussies...!
I almost feel sorry for them discovering this just after they discontinued Microsoft Messenger and moved people on to Skype. To be fair I expect this hole existed when they brought Skype.
I’m not so sure about that, y’know. It would likely have been discovered by now.
I expect it’s a side effect of the migration of MSN users to Skype as it likely requires changes to both Skype and its backend.
It's not new. I have an email address that people assume doesn't exist and rt they sign up for things all the time. About two years ago, I received a password reset mail from Skype. When I went to reset it (as I do with every random account people sign up for with my email), they gave me the option to reset about a half dozen accounts. I now maintain a list of burner Skype accounts that had previously used my address.
Fun fact: you are limited to 4 successful resets, per email address, per day.
Guys, loose this off-topic subthread already.
If I understand this "security hole" correctly.. and they have already popped the data to let you know the email is taken.. isn't it pretty much close to nobrainer not to go ahead with that insert query? I may be a simple caveman.. but cmon.. even in my worst spaghetti code this is solidly on the durr side of Hurr-Durrrr
I have multiple skype accounts created on the same email address (for different people, however) and it does not allow one to login as the other. It's possible to password-reset any of them independently.
LOL!
Unfortunately, it's an AMERICAN thing.
Just like the idiots who keep saying 'more THAT' or 'MORE then', instead of 'more THAN'.
How can anybody not know the difference between those three words? Obviously they don't read any printed media, just trash off the internet.
To be fair I expect this hole existed when they brought Skype
That doesn't seem likely. In fact, I think this is a side effect of Microsoft preparing to integrate the 100 million msn messenger users into Skype. Somebody has been trying to ensure that the accounts will overlap nicely and has obviously made a huge mistake which allows this to happen.
"It is the business of the future to be dangerous" -Alfred North Whitehead
What kind of QA system do they have in place at Skype---or maybe they should start one?
Cry more.
Bought*
I wish people would get this mix up of words right. It's like when someone says "me either" in response to something like "I dont like that":
- I don't like bees - Nah, me either, i hate them.
It's neither dammit!!
It's damn it...
Microsoft also has issues with Xbox Live although not close to as bad. Some guy when he bought Xbox Live Gold accidentally entered my email address which has linked his 5 year account to my email. Last weekend I bought a game on steam which requires Games for Windows Marketplace. Since I had to have an account to play the game I entered my email and it said I already had an account so I did a password reset. This other guy has now lost his Xbox Live Gold account with 7 months left already paid for and support doesn't seem to know how to fix it. Also I now have a stupid gamertag which apparently I can't change without an Xbox.
This doesn't compare to the skype hole but there should be no way to link an account to an unverified email address.
Guys, loose this off-topic subthread all ready.
FTFY. Jeeze.
LOL!
Unfortunately, it's an AMERICAN thing.
Just like the idiots who keep saying 'more THAT' or 'MORE then', instead of 'more THAN'.
How can anybody not know the difference between those three words? Obviously they don't read any printed media, just trash off the internet.
Or people who say "this person that I just met". It's "who", or if you really understand grammar then it's "whom". "That" doesn't work unless you just "met" an inanimate object.
Guys, loose this off-topic subthread all ready.
FTFY. Jeeze.
FTF*Y*
Guys, *lose* this off-topic subthread *already*.
Christ!
That is all.
"All you need to do is register a new account using that email address
Wait, which email address? (the person whose account who want to gain access to, says the article)
and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)"
Right, and then what? You seem to have missed the entire rest of the process where you actually carry out the password reset trick. Make me read the bloody article indeed...
The reason this works is simple, but it’s still worrying. When you use an existing email address to sign up with Skype again, the service emails you a reminder of your username, which is okay, since no one else should have access to your email. Unfortunately, because this method enables you to get a password reset token sent to the Skype app itself, this allows a third party to redeem it and claim ownership of your original username and thus account.
Or something like that.
systemd is Roko's Basilisk.
Microsoft buying anything paints a target on it plus there is defiantly popularity and market value compared to other messengers so bound to have people hunting for security flaws. The just had another big security flaw discovered back in July http://yro.slashdot.org/story/12/07/16/175247/skype-bug-sends-messages-to-random-contacts bug agin you can't blame Microsoft they bought with this issue now they just need to fix it. This one is far worse then Skype Bug Sends Messages To Random Contacts.
http://www.thetechnologygeek.org
RTFA! It's all clearly explained there!
*WHOOSH*
Oh come on now. I thought it worked just fine.
MS Exec: Should we get Skype?
Dylan Hunt: Lets bring it!
MS Exec: Pwnt!
I want this account deleted.
I'm particularly disturbed at how pervasive the use of "axe" in place of "ask" has become in this country. People who use "axe" for "ask" will be the first up against the wall when *my* revolution comes.
I have an email address that people assume doesn't exist
With a username like "junk"? Inconceivable! There's someone out there who's actually checking junk@junk.com?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Not sure if we got one to bite, or if it's very,very clever...
if you really understand grammar
I don't think you can "understand" grammar (*) any more than you can "understand" vocabulary, as in why the sequence D-O-G represents a cute fluffy animal that barks and the sequence C-A-T represents a cute fluffy animal that meows. Grammar simply IS what it is, and sometimes it changes to something else, just like vocabulary. Wait a century and watch "whom" sink into oblivion.
(*) Unless, of course, we're talking about Universal Grammar.
Ezekiel 23:20
It is basically the difference between knowing their shit and knowing they're shit.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Skype has also been plagued with billing issues. I had a subscription years ago, that bank card is now expired. I cancelled the subscription, years ago.. as soon as Microsoft bought Skype, I started getting emails saying my card was declined, with no recourse, no way to cancel the subscription they tried to start up on me again...
-Myke
If you are god@heaven.com, then it is my spam you get :-P
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Too late, it's already been set free.
Free Martian Whores!
Oooh, that is a fun fact! You must have been bored though?
Usually when things like this happen, people start looking for places to poke fun, like bill.gates@live.com etc. I wonder who balmer has in his skype contact list?
I work for the Department of Redundancy Department.
Satan@Hell.com
Didn't you see the commercials?
Using axe gets you the ladies!
I think "understand" makes sense in this context. You are arguing that spelling, or perhaps definition, is simply memorisation. In this reductive sense everything, like the rules of physics, is simply memorised rather than understood. Grammar, though, requires a deeper knowledge of language concepts (in this case subject and object pronouns) and context than spelling or noun definition.
You are probably correct about "whom" disappearing - it's almost unused in common language already. English seems to be very good at losing its distinctions over time (thou, thee etc.), perhaps because of it's readiness to adopt foreign words. From a nerd point of view it seems sad to lose precision.
I think "understand" makes sense in this context.
I beg to differ, and here is why...
You are arguing that spelling, or perhaps definition, is simply memorisation.
In any language, some aspects are governed by universal rules and the rest is purely incidental. Not surprisingly, a large part of what we call grammar is incidental. There's no reason, for example, for English to have exactly three verb tenses (for a certain value of "verb tense") referring to past events, having the precise semantic nuances they have in modern English. (For a more academic value of "verb tense", English only has two verb tenses, the past one and the indefinite one, but I still often use the "high school L2 English" grammar notions I was taught at, well, high school. Force of habit, I guess. I didn't have access to The Grammar of the English Verb Phrase, Volume 1 at that time.)
Grammar, though, requires a deeper knowledge of language concepts (in this case subject and object pronouns) and context than spelling or noun definition.
I have mentioned UG, haven't I?
From a nerd point of view it seems sad to lose precision.
Not from a language nerd point of view. Unless you descend to the level of a pidgin, you don't lose anything. Languages tend to compensate. By way of example, can you figure out any case where "this person who I just met" and "this person whom I just met" could mean two different things, therefore necessitating the presence of "whom" in the language? Or is it the case that you can disambiguate between the subject and the object role of any noun phrase based on the syntax of the sentence, therefore obviating the need for "whom"?
If you're a nerd, take a look at Riau Indonesian to find out how simple grammatically a language can get without becoming unusable. Not even at that level of simplicity does it become a grammar-less pidgin.
Ezekiel 23:20