Forgotten Password Emails

[roadsmash]

Anyone else getting these?

I didn’t want to forward to “[e-mail]” because it doesn’t sound like the right address, regardless of what the email says.

Is it legit? Is someone trying to penetrate me using a Trojan in my back door?

Is it spam?

Cheers

[Jack Mansfield]

Hi,

This isn't spam, it is a legitimate password reset email, however, it could be another user using your username to request a password reset (but that is all they can do)... The password reset is only a request and is not carried out unless you follow the link and carry out the change. Please just ignore any password resets you may get.

This is something we're going to look at into the future so that users can only reset their own password.

Apologies for the annoyance that this causes.

[roadsmash]

Thanks Jack

Just had another one. Seems pointless why they would do it, I’ll just mark these emails to be ignored.

Cheers

[Sheepshanks]

Is the link to reset the password genuine looking?

I wondered if someone had a similar name to you so looked you up - oddly your name doesn't appear in the member directory!

[roadsmash]

Sheepshanks said:

Is the link to reset the password genuine looking?

I wondered if someone had a similar name to you so looked you up - oddly your name doesn't appear in the member directory!

It looks relatively genuine but didn’t want to risk it.

Spooky! Maybe I am a ghost. :-)

[eybic]

It's strange that it directs you to email adverts@, that leads me to believe it's the classified side of your account rather than forums. Do you have a separate account you use for the classifieds?

[roadsmash]

No not at all. I have only one account and don’t view the classifieds.

[B'stard Child]

Sheepshanks said:

Is the link to reset the password genuine looking?

I wondered if someone had a similar name to you so looked you up - oddly your name doesn't appear in the member directory!

I thought Name change - Joined (or early posts around time of joining are) as maclarkk

But that one isn't in the members directory either...........

[GravelBen]

I got one too, I don't think I've ever used PH classifieds as there isn't much point outside the UK.

[MYOB]

I got one tonight too...biazarre.

[BenLowden]

For anyone receiving these suspiciously, can you forward on to me please at [e-mail] and we will investigate with our product team.

We've been using a single sign on for a couple of years now and no longer have separate accounts for forums and classifieds, so even if you don't use one or the other, you may still receive one of these emails if someone is trying to access your account.

[roadsmash]

BenLowden said:

For anyone receiving these suspiciously, can you forward on to me please at [e-mail] and we will investigate with our product team.

We've been using a single sign on for a couple of years now and no longer have separate accounts for forums and classifieds, so even if you don't use one or the other, you may still receive one of these emails if someone is trying to access your account.

Hi Ben - thanks.

But why would a non-classified user be targeted? What is the potential gain?

As far as I can see there is none.

[BenLowden]

roadsmash said:

Hi Ben - thanks.

But why would a non-classified user be targeted? What is the potential gain?

As far as I can see there is none.

True although I'm not a criminal mastermind so I'm not one for ideas in this area

It could be that it's a genuine email from our system that's randomly firing unprompted, so it would be helpful to see some examples so we can try and work out what's going on.

[Lemming Train]

Ben : I am receiving these again now. Could you please investigate and found out which member is trying to hack into the user accounts. It's been going on for months !

I have forwarded the most recent one to your email address above.

[funkyrobot]

Just had this myself. Please look into it.

[BenLowden]

I've received emails from quite a few of you, thanks. I've passed these on to our product team for investigation and will report back in due course.

[roadsmash]

As a suggestion I believe it would be more secure for people to reset their passwords by entering their email address, opposed to their username.

This change would resolve the issue.

[thebraketester]

Still happening.

No way to stop it? Or can the admin not be arsed?

[Gilhooligan]

Just had 5 password reset request emails come through in the same minute, despite not requesting it. Decided to change my password by going through my settings instead of clicking any links.

I’m guessing someone is trying to change my account password?

[roadsmash]

As per my earlier post, surely this issue can be simply resolved by making a change in the code of the website to ask for the email account of the user to reset the password, rather than the username.

Any chance of this happening?