I have an account on a major company website that has for some reason fallen under attack. Periodically over the course of the day I will get a text message from the company saying your password has been reset here is a temporary password please log in and reset your password. The first time this happened I brushed it off, second time contacted customer service who said they where unable to help. Its happened a few more times since then so I feel like whoever it is is making a concerted effort to break in. Since sometimes I am away from my phone and the temporary passwords are all always 8 digits, I'm afraid the attacker might brute force in if they are persistent enough.

What are some reasonable steps to take to try and add some security around the "reset your password feature"? Note, in this case changing my user is not an option as it must be telephone number.

closed as too broad by Steffen Ullrich, kasperd, Matthew, Dmitry Grigoryev, Steve Feb 6 '17 at 17:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Do I understand your question correctly that you ask how to protect your account when faced with an attacker trying to brute force the password reset feature and a company which has an insufficient password reset feature (i.e. just send a new one, w/o rate limiting) and is not willing to fix this? I'm not sure how to help since based on these few information you have no way to harden the account from your side. There might be ways but these are not visible from the few information you provide. – Steffen Ullrich Feb 5 '17 at 6:48
  • Yeah you are correct. What other information would be useful? – mercurial Feb 5 '17 at 13:02
  • Other information would be especially what the provider offers for protection. Some provide optional protections like 2FA. If the provider does not offer anything like this you could probably only try to publicly raise awareness about the providers security. Of course you should only do this if you don't simply assume that attacks would be possible but you need to kind of proof it for credibility of your accusations. – Steffen Ullrich Feb 5 '17 at 13:05

It is the responsibility of the company you have an account with to handle this attack correctly. Choosing a secure password is the best you can do. The web site should have rate limiting, or the company should manually block an attack like this.

Not the answer you're looking for? Browse other questions tagged or ask your own question.