Email account under attack

[Dode]

@ZakMcKracken 

Agreed, but time delays can be made progressive, up to the point an account is locked if necessary.

[ZakMcKracken]

Yeah true. Another option is to copy proton mail, using a 12 word recovery phrase. Nobody will ever guess that.

I think the major problem is, when using the lost password method, the method to get into your account has been made significantly easier. Where a password is relatively difficult to guess, a hacker can get around this by replacing it by a 4 digit number. The method to get into an account using the lost password method should not be a lot easier than using a password, which a 4 digit number clearly is.

[ZakMcKracken]

Actually, thinking about it further, the situation is worse. When you login normally you would require to type in your password and a 6 digit 2fa code. When you do the lost password option, all you need to type is a 4 digit number (why not also 6?), but without any additional 2fa check.

[Twitch199]

I really want to know why BT is so committed to the 4 digit pin and in general such a basic password reset process. Further having the BTID reset sends verification code to the same email is also madness.

After having my account hacked last week and recovered, I have just received a few more un requested pin texts, granted not a barrage only a few, but clear the hackers haven't given up even after briefly getting access.

I wish BT would allow you to opt out of the pin process or at the very least limit pin request to 1 every 24 hours.

[wictod]

I tried to look into this and google sort of explained that the BT email architecture is cobbled together with different parts and some legacy elements one of which is the password reset function that is obviously not fit for purpose.

[Kimberlin]

@Twitch199  Some questions you probably need to ask yourself, do you honestly believe that BT are going to change their own tried and trusted practices regarding the use of the four digit pin?

Having had your email account hacked already, do you believe it won’t happen again?

It really is you that has to evaluate those questions. BT will likely just continue to stumble on with it until they reach a point whereby it’s no longer viable at all to offer an email service. BT obviously no longer provide email accounts to new users but they’ve continued to saddle themselves with the service undoubtedly to avoid upsetting existing email account holders, so they must and do accept the consequences for any fallibility with it.

[Twitch199]

Yep - that's why I'm trying to change over - but this is no easy task when your account is decades old and has been your main email for life. 

[stupid_hackers]

Normal pins are 6 digits, doesn't even make sense why 4 digit ones get delivered.

[thompsri]

Hi, I've had > 30,000 such OTP SMS messages overnight. The account does seem to be ok. With a rate like this its only a matter of time before my account is stolen. How does BT get these accounts back is this situation?

[wictod]

So it's still going on then... has stopped for me... really spooked me, I was waiting to board a plane at 04:30 in the morning and phone was going mad with texts.. I lost my bottle and deleted all my emails rather than have them get in and find them all.. it was the lesser of two evils.. have a ruined holiday worrying about it or take some drastic action.. Am now trying to migrate stuff away onto another platform.. oddly I got a text from BT saying you may have received several BT password reset PINS.. Please ignore them, you do not need to take further action and sorry for this?