Cybersecurity

8622 readers

118 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

VintageStory's wiki emails you a temporary password when requesting a password reset, is this insecure? (lemmy.dbzer0.com)

submitted 2 weeks ago by moosetwin@lemmy.dbzer0.com to c/cybersecurity@sh.itjust.works

4 comments fedilink hide all child comments

Note: The password in this image is no longer valid, don't kill me

This is just used by their wiki, the side with the payment stuff uses a different system (and a separate login)

you are viewing a single comment's thread
view the rest of the comments

[–] WatchfulConsole@sh.itjust.works 3 points 2 weeks ago* (last edited 2 weeks ago)

Not much different than a link to change your password that had those two random values added as a query parameter (which is what the link you get effectively does). Uncommon way to do it, but no real difference in the security model. Good to see they have a way to expire the password and force you to reset it if they ever had a compromise (since they note it has less than 1 day's validity). Another upside is that by having already changed your password to this new random value, your account should also be locked until the password is changed. That one's a mixed bag. Could be nice to know someone tried, could be frustrating if someone uses this to mildly DoS your account.