Hotmail / MSN: more pathetically incompetent than NTL?

nffc · 19-11-2004, 09:47

The ease of "hacking" a Hotmail account (ie. locking the legitimate user out by resetting the password by using the secret question, then changing the secret question) is pretty well-documented, mainly because there are lots of them and because it's so simple to do, if you can research the secret answer...

Well there was me reading the other hotmail thread when I stumbled across the "alternate email" field. Being an inquisitive fella I clicked the "More" link... and it said something about it's used to send reset instructions if you've forgotten your pw/ secret question... good idea I thought...

Except MSN have got it the wrong way round!

Instead of the logical step, a la Gmail, ie using the email FIRST and not bothering with secret questions, or the O2 approach (answer the secret question and your password is sent via SMS or even emailed to the alternate), no MSN have used it if you can't remember password or secret answer

.

So basically, it's even easier to lock people out now- if you reset the password, secret answer and then change the email as well!

I might point this out to them, it's so stupid it's untrue. Then again, they'll probably fob me off with ********, like they usually do. Anyone else, feel free to do the same! The more people that tell them, the more they may realise it's a problem!

nffc · 19-11-2004, 17:30

Surely someone has an opinion on this?

19-11-2004, 18:01

i dont understand what your ranting on about. Its used so that if you know the user name and click a button and it will send the details to the alternate email address.

Granted that the email address can be changed if someone got into the account, then if someone has hacked into the account they can change all the details so it doesnt really matter

Gareth · 19-11-2004, 19:07

I kinda agree with gary_580 on this one.... if your account is compromised, there's not much that you can do. Admittedly, I'm not a fan of the secret question technique - it's inherently flawed, but then again I never use obvious answers to any secret question.

nffc · 19-11-2004, 19:26

I just think MSN should be doing more to stop people hacking accounts, using a secondary email first would be a good way to bypass the secret question all together- the secret question is definitely flawed.

In the absence of the 2nd email, then the question should be used.

The way it's set up, and they don't claim this, the email is useless unless you've forgotten your answer or someone's reset you.

I'm not really emphasising the fact that once it's been hacked, you can't do much- merely the fact that hotmail accounts are so easy to hack and this does nothing to decrease that ease, despite it purporting to!

**Paul** · 19-11-2004, 20:43

I don't suppose pointing out how to hack them on a public forum helps keep them secure ...

nffc · 19-11-2004, 20:58

Quote:

Originally Posted by Paul M

I don't suppose pointing out how to hack them on a public forum helps keep them secure ...

Err, people already know, look over on DS!

19-11-2004, 21:41

Quote:

Originally Posted by Gareth

I kinda agree with gary_580 on this one.... if your account is compromised, there's not much that you can do. Admittedly, I'm not a fan of the secret question technique - it's inherently flawed, but then again I never use obvious answers to any secret question.

M$ insist that your pets name is 5 letters or more. I must remember that he next time i get a new pet. My cat is really peaved that we have just changed his name to make it 5 letters!!

19-11-2004, 21:49

Quote:

Originally Posted by nffc

I just think MSN should be doing more to stop people hacking accounts, using a secondary email first would be a good way to bypass the secret question all together- the secret question is definitely flawed.

In the absence of the 2nd email, then the question should be used.

The way it's set up, and they don't claim this, the email is useless unless you've forgotten your answer or someone's reset you.

I'm not really emphasising the fact that once it's been hacked, you can't do much- merely the fact that hotmail accounts are so easy to hack and this does nothing to decrease that ease, despite it purporting to!

ok picture this as your having difficulty in understanding the design of the web page.

How it works

1. You enter your user name

2. you forget password so want to enter a new one

3. you cant answer the pets name question correctly

4. you cant answer the pets name question so you get it to sent you an email

How it cant work

1. You enter your user name

2. you forget password so want to enter a new one

3. you get it to send you an email

4. ahhhh how does the web page know you didnt get the email????

nffc · 20-11-2004, 00:42

Quote:

Originally Posted by gary_580

ok picture this as your having difficulty in understanding the design of the web page.

How it works

1. You enter your user name

2. you forget password so want to enter a new one

3. you cant answer the pets name question correctly

4. you cant answer the pets name question so you get it to sent you an email

How it cant work

1. You enter your user name

2. you forget password so want to enter a new one

3. you get it to send you an email

4. ahhhh how does the web page know you didnt get the email????

Well that's how Gmail works. You click a link in the email (which has a validity period) which lets you reset your password. No link clicked, no reset.

Simple as.