[jackbrookes]

Maybe unrelated, but I think some people do this to check (at least partially) what email is tied to an account. E.g. if you suspect an anonymous instagram user to be your friend Bob, you can invoke the reset email procedure to see

    We sent an email to bo****@gm***.com

Which gives you a hint

[luma]

Folks in the thread noted that the recovery code sent was the same each time, which leads me to think it might have been a phishing attack. Send email that looks like FB recovery, but have the links go to some domain you own and snarf up creds, including MFA etc.

[tomhoward]

Not in my case; I've had two password reset emails in the past 3 days (having had none since February) and both have gone simultaneously to the different email addresses I have on the account, with different codes on all the emails (even the ones sent at the same time), and the click-through URL is certainly on the legit Facebook domain.

[tonyedgecombe]

I've been getting a lot of those lately. They were easy to spot as I don't have a Facebook account.

[Cthulhu_]

A variant I've seen was "We've sent you a recovery code to your email at gmail.com". I think it's useful for login name based authentication, since people will have multiple email addresses and may forget which one they used for that account.

(we have a 15 year old who's made at least four, probably more different gmail addresses for different purposes. Ironically, the one he used to sign up for porn includes his real first/lastname)

[larschdk]

Best practice would be to display this message no matter whether the email address is correct or not, to avoid leaking information. Many sites do this.

[hathchip]

The GP is talking about a situation where you are not asked for an email address. You ask for a password reset for the username @coolanonguy. The website tells you that the reset email was sent to an obscured email address. The obscured email allows you to confirm (with high likelihood) or deny (with certainty) that @coolanonguy is your friend whose email address you know.

[WA]

That is the security researcher perspective, but it’s a UX nightmare resulting in a lot of confusion for normal users, because they don’t get any info if they even have an account or are trying to use the correct email address.

[bananapub]

? the comment you're replying to is talking about resetting by *account name*, not email address.

[dist-epoch]

Interesting hack, but it wouldn't explain the case where you receive multiple such resets emails.

[batch12]

Well.. I have a theory. Maybe the threat actors are sending the recovery email with the hopes that the target does not engage. Then, the threat actor can indicate that they "no longer have access to this email address" to force recovery to an alternate address. Then, perhaps they have gained access to some people's old alternate email addresses either through credential stuffing or recreating deleted email accounts. If so, the TA can finish the reset and take over the account.

[sammy2255]

Could be multiple different actors doing it

[Kiro]

Is that how it actually works on Instagram or was it just an example?

[glenstein]

I actually lost my Instagram account because, I believe, it filled in my email field with a dummy one, [e-mail] and then when I had to do verification, I could never recover the account. I believe it was in the very early days of Instagram although it's possible there was user error on my part in this case.

It is too bad because for symmetry I used the same use name in a number of places (not the one I have here).