2010-02-22, 12:34 AM
Somewhat unrelated story, but..
My main MS account had been registered to an email called (lets say, for example) "PhoenixWright@hotmail.com" Since 2006. Afterwards, I stopped using that email, made a new one, and lost the password to "PhoenixWright@hotmail.com".
Years later, early 2010, I want to do a PIC reset on my account. I can't log onto "PhoenixWright@hotmail.com" because I forgot the password. Then I tried to create "PhoenixWright@hotmail.com", which resulted in a success. I then reset my PIC..and it worked.
Or in other words, my MS account, was, for the longest time, registered to an email account that didn't even exist. Anyone who accessed my account via username and password could have had my account easily if they had bothered enough to try that.
Therefore, theoretically, a clever and nefarious person could gain access to an account with an inactive hotmail address just by knowing the username, password, and the name of the email. Seems like a pretty big hole to me. O.o
EDIT: This is a true story, but the email address I used is one different than the one in the example. >_>
My main MS account had been registered to an email called (lets say, for example) "PhoenixWright@hotmail.com" Since 2006. Afterwards, I stopped using that email, made a new one, and lost the password to "PhoenixWright@hotmail.com".
Years later, early 2010, I want to do a PIC reset on my account. I can't log onto "PhoenixWright@hotmail.com" because I forgot the password. Then I tried to create "PhoenixWright@hotmail.com", which resulted in a success. I then reset my PIC..and it worked.
Or in other words, my MS account, was, for the longest time, registered to an email account that didn't even exist. Anyone who accessed my account via username and password could have had my account easily if they had bothered enough to try that.
Therefore, theoretically, a clever and nefarious person could gain access to an account with an inactive hotmail address just by knowing the username, password, and the name of the email. Seems like a pretty big hole to me. O.o
EDIT: This is a true story, but the email address I used is one different than the one in the example. >_>

