Password reset notifications

[mmckenna]

I don't believe there is a security risk. I think MikeOxlong hit it right on the head

I'll accept that.

I'm not familiar enough with vBulletin to say for sure, but there may be tools available to find out what IP addresses the reset requests are coming from, and that could be cross referenced to determine who is conducting the attack.

This is what I'm thinking, unless they are using various VPN's to hide their IP address. Would feel better if someone would provide some feed back on that.

But, I get it, disgruntled user. Not surprising.

 

[KevinC]

I'll accept that.



This is what I'm thinking, unless they are using various VPN's to hide their IP address. Would feel better if someone would provide some feed back on that.

But, I get it, disgruntled user. Not surprising.

The sourcing IP is in the reset email you are sent. So far I've seen Verizon Wireless and a VPN service.

 

[poltergeisty]

Yeah, either he's running a bot or using a VPN. VPN's use cloud/host servers so you'll know. Or it's a VPS, but I doubt that since the IPs are all different. There was in fact one IP that came from Verizon and that may tie him or her to his cell phone service. Or it's an infected router form a legit ISP. I've seen a number of those arrive at my site. The fact people are getting some 48 of them tells me that it could be a bot. I mean, who sits here and clicks the reset link 48 damn times manually?

You could send an email to all of the host's IPs that came with the password reset link with a date and time so that the host's can cross reference a source.

Like I mentioned before. If it's a bot then a good captcha will most likely stop it. Or you could run CIDRAM which blocks scores of hosters and cloud providers. But I don't know the nature of this forum and if that's even feasible. If you have a POST from a cloud/hoster they may/will get blocked with CIDRAM. GET is fine.

Perhaps this guy will just give up. :lol:

With my email I can block whole domains. So no problem here.

Edit- Is there an unique UA?

Edit 2- For the hell of it I tried a blank UA and this site allows it! Or at least I think it does. Unreal.

 

[mciupa]

Perhaps a Recaptcha should be used on the password reset link page.

Unless this happens