Slashdot Mirror

← Back to Stories (view on slashdot.org)

Skype Disables Password Resets After Huge Security Hole Discovered

Posted by Unknown on from the time-to-get-a-landline dept.

another random user writes with news of a vulnerability in the Skype password reset tool "All you need to do is register a new account using that email address, and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)" concealment adds a link to another article with an update that Skype disabled the password reset page as a temporary fix.

3 of 65 comments (clear)

  1. I don't entirely buy this... by dalias · · Score: 4, Interesting

    I have multiple skype accounts created on the same email address (for different people, however) and it does not allow one to login as the other. It's possible to password-reset any of them independently.

  2. Re:Defective Microsoft by Kiuas · · Score: 5, Interesting

    To be fair I expect this hole existed when they brought Skype

    That doesn't seem likely. In fact, I think this is a side effect of Microsoft preparing to integrate the 100 million msn messenger users into Skype. Somebody has been trying to ensure that the accounts will overlap nicely and has obviously made a huge mistake which allows this to happen.

    --
    "It is the business of the future to be dangerous" -Alfred North Whitehead
  3. Xbox Live by asavage · · Score: 1, Interesting

    Microsoft also has issues with Xbox Live although not close to as bad. Some guy when he bought Xbox Live Gold accidentally entered my email address which has linked his 5 year account to my email. Last weekend I bought a game on steam which requires Games for Windows Marketplace. Since I had to have an account to play the game I entered my email and it said I already had an account so I did a password reset. This other guy has now lost his Xbox Live Gold account with 7 months left already paid for and support doesn't seem to know how to fix it. Also I now have a stupid gamertag which apparently I can't change without an Xbox.

    This doesn't compare to the skype hole but there should be no way to link an account to an unverified email address.