logoalt Hacker News

paxysyesterday at 4:08 PM2 repliesview on HN

Am I missing something? The source they shared is a screenshot of a password reset email, which anyone can trigger if they have the email address of the account.


Replies

zwogyesterday at 9:14 PM

You don't even need the email address. The account name is enough to start the password request.

salgorithmyesterday at 4:33 PM

I have a masked email* for Instagram and have received two password reset requests in the last five days. Obviously, this is just an anecdote.

* https://support.1password.com/fastmail/

show 1 reply