after tracing some steps of an account that I know is affected, I can still only assume the email box of that person was compromised.
I see a lot of password retrieval attempts in the logs. Unfortunately up till now I did not log password retrievals so I don't know which emails have been entered.
I have looked very closely over my code regarding that page, multiple times, and cannot see a flaw there. So I have to conclude (unless I'm blind, but I'm fairly sure that's not the case atm) that some email boxes have been compromised.
Seeing that the person(s) responsible seem to like to hack servers (I've come across a handfull when doing my activity traces) perhaps they've hacked a website where the affected germans also had an account and perhaps used the same password as their email account. Perhaps they're trying to enter a load of email addresses on our website to see if anyone has an account here and if they do, they read the password retrieval email using their access to the compromised email box.
It's just a theory, but it wouldn't be the first time.
And one of the reasons why I think it's not our server that has been compromised is that only a certain group of people are affected and not a wide range of random accounts, including dev accounts.
And that certain group of people might have something else in common that has been hacked.
Now, the question regarding whether our password retrieval page is good or not, that's another matter. Though the only real improvement I can think of is adding something like a personal question and answer. All the other options like sending a link to click, leading to a page where password can be changed or reset, all result the same when an email box has been compromised.
I see a lot of password retrieval attempts in the logs. Unfortunately up till now I did not log password retrievals so I don't know which emails have been entered.
I have looked very closely over my code regarding that page, multiple times, and cannot see a flaw there. So I have to conclude (unless I'm blind, but I'm fairly sure that's not the case atm) that some email boxes have been compromised.
Seeing that the person(s) responsible seem to like to hack servers (I've come across a handfull when doing my activity traces) perhaps they've hacked a website where the affected germans also had an account and perhaps used the same password as their email account. Perhaps they're trying to enter a load of email addresses on our website to see if anyone has an account here and if they do, they read the password retrieval email using their access to the compromised email box.
It's just a theory, but it wouldn't be the first time.
And one of the reasons why I think it's not our server that has been compromised is that only a certain group of people are affected and not a wide range of random accounts, including dev accounts.
And that certain group of people might have something else in common that has been hacked.
Now, the question regarding whether our password retrieval page is good or not, that's another matter. Though the only real improvement I can think of is adding something like a personal question and answer. All the other options like sending a link to click, leading to a page where password can be changed or reset, all result the same when an email box has been compromised.
Can't sleep not knowing that
