Someone is trying to reset your password

[saaby93]

A couple of times now Ive had the
to reset your password click this link
email come through.
and
your old password will no longer work afterwards

Why would anyone be trying to reset my password?
and what's the point if the reset link comes through to my email address?

[Don1]

Phishing, password reuse would be the normal reason. I'd be more worried that someone can reset your password without an additional form of ID - do that to enough people you have a DOS attack.

[anonymous-user]

Security is well documented as poor on PH.

Guys who do IT for a living have offered to patch it for PH some for free.. Haymarket not interested.

[Jack Mansfield]

Hi Saaby,

I'm just looking into this for you, will come back to you shortly...

Thanks for reporting it.

Jack

[B'stard Child]

saaby93 said:

A couple of times now Ive had the
to reset your password click this link
email come through.
and
your old password will no longer work afterwards

Why would anyone be trying to reset my password?
and what's the point if the reset link comes through to my email address?

Who sent the email - I mean really sentvit not who the email says sent it

[saaby93]

B'stard Child said:

Who sent the email - I mean really sentvit not who the email says sent it

Good point

Received: from a8-176.smtp-out.amazonses.com ([54.240.8.176])

the link to click is to
https://www.pistonheads.com/emails/process?

[saaby93]

Just happened again. Own up

It says it was from adverts at PH
but looking in more detail

a8-13.smtp-out.amazonses.com [54.240.8.13]

[anonymous-user]

Yes, same today.

What's going on?? It sounds as though a known security issue has not been addressed.

[anonymous-user]

And the same again today.

This really does need to be properly sorted out.

[saaby93]

and again
a8-56.smtp-out.amazonses.com [54.240.8.56]

[Mr2Mike]

Just got the same email, again from a8-176.smtp-out.amazonses.com

EDIT: Just tried a genuine "forgot password" request and the email comes from the same server.

[Burwood]

I got one too

[saaby93]

Jack Mansfield said:

Hi Saaby,

I'm just looking into this for you, will come back to you shortly...

Thanks for reporting it.

Jack

Just in case anyone was wondering, no-one came back and the dubious messages still appear from time to time
Unless one is the other

[thebraketester]

Give them chance for heavens sake.

[saaby93]

thebraketester said:

Give them chance for heavens sake.

Sorry

How long do you reckon in PH years?
And theyre just going through a transfer of ownership

[bitchstewie]

There probably isn't much they can do given that if you forgot your password you'd want to use the "forgot my password" functionality to send a reset link.

I'd focus on making sure you're using a strong unique password for every site you use, and make damned sure you're using one (and ideally multi-factor authentication) for your email account.

[saaby93]

bhstewie said:

There probably isn't much they can do given that if you forgot your password you'd want to use the "forgot my password" functionality to send a reset link.

I'd focus on making sure you're using a strong unique password for every site you use, and make damned sure you're using one (and ideally multi-factor authentication) for your email account.

It does make you wonder if it's not a PH issue but whether someone is monitoring/using your email account

[bitchstewie]

saaby93 said:

It does make you wonder if it's not a PH issue but whether someone is monitoring/using your email account

Use Gmail
Use a strong unique password
Switch on Multi-Factor

[bitchstewie]

Oddly I had one this morning.

Anyone else or am I the lucky one?

[Mr2Mike]

saaby93 said:

It does make you wonder if it's not a PH issue but whether someone is monitoring/using your email account

Anyone can trigger these messages on PH (and other forums) just by attempting to log in as an existing user and requesting a password reset. Unless you have evidence of your email account being used then it's not linked.

A slightly competent IT team should be able to see if many different user password requests are being triggered from a single IP address so I won't hold my breath on that.