4

I have, on multiple occasions, received this email from Twitter: enter image description here

Since I have received it multiple times either this person clearly thinks the email is theirs or it's spelled similarly, something to that nature.

If I were to confirm the account, and the person were to start using it, wouldn't I essentially have a "backdoor/trojan horse" of sorts where I could simply reset the password and take control of the account whenever I felt like it? What if it were a bank account instead of a Twitter account, it could have more sinister repercussions.

Other than it being an attack based on pure chance, you can't force someone to try to use your email, is it a viable attack? Is there a term for this kind of attack?

Improve this question
4
  • 1
    I call it "really annoying" - get quite a few emails where someone has got the wrong address... I'd hope that a bank account would have more authentication steps than Twitter though!
    – Matthew
    Mar 30, 2016 at 12:45
  • 8
    You seem to be assuming that this email is actually from Twitter and clicking the link will not do bad things.
    – AstroDan
    Mar 30, 2016 at 12:54
  • @AstroDan That is fair, but this particular email is just what sparked the idea I'm more curious about the concept in general. I certainly don't intend on clicking the link and finding out!
    – DasBeasto
    Mar 30, 2016 at 12:55
  • "Is there a term for this kind of attack?" Impersonation? Providing inaccurate personally identifying information?
    – user
    Mar 30, 2016 at 14:36

1 Answer 1

Reset to default
1

If I were to confirm the account, and the person were to start using it, wouldn't I essentially have a "trojan horse" of sorts where I could simply reset the password and take control of the account whenever I felt like it?

Given that they are not using 2-factor authentication, yes (though I don't think "trojan horse" is the correct term). They would be able to start using the account when it is confirmed, but you would have the ability to reset the password, and then log in as them.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.