0

I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I used to login to the account doing so I gave it to him and I got back access.

But, I can see some problems with this for example what if I was in an environment where my IP address is being shared between multiple systems? Then that means someone else can easily get it and use it to reset the password.

Is this a safe way to verify identity for an account password reset? It seems too easy for someone to get the IP address and do this.

  • do you store your IP Address or are you having a fixed one? – CD Rohling Nov 5 '18 at 23:29
2

It's not a safe way to verify you are the same person as the one who owns an account. It could be a relatively safe way to identify which account you (potentially) own if you have forgotten the username. (Or if your email address functions as your user name.)

If your IP address has only been used with one account recently, then the rep may be able to give you a hint like "The email address starts with an 'A' and ends in '...l@example.com". If they refuse to reset the password and refuse to change the email address, then I think you would be safe. (Or rather as safe as the email-based password reset system normally is. Ignoring the privacy breach that is revealing parts of your email address.)

But it definitely isn't enough to prove you are the account owner. Someone may observe you log in one time on a public WiFi network. They can determine which IP you had used if the network uses NAT. After connecting to the network themselves they will be able to use some website to tell them what external IP the public network is using.

Alternatively someone could identify your user name and send you a private message with some link. If you visit the website then your IP will appear in their server logs. If they have access to those logs then they can determine your address. Clicking the link might not even be required if, for example, the message is sent on a service that lets users post images hosted on any third party domain or if your web browser prefetches links automatically.

1

Is this a safe way to verify identity for an account password reset?

No.

However, when joined with other things, it might have been considered enough for the representative to consider that you indeed are who you claim to be and reset the password for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.