Email address should not be reusable after account deletion

[Singletime]

Hello list,

I am affected by a Kolab security problem:

I was a KolabNow user for some time. In July 2016 I deleted my account. In October 2016, I tested whether it was possible to create a new account with the same email address as before, and surprisingly it worked!

This means that after at most three months someone else could take over the email address of a deleted account. This exposes ex-users to identity theft, e.g.:
a) by replying to mails of contacts that by mistake still use the old address;
b) by catching password recovery emails, when people forget to update their email address in all online accounts.

This problem is already known as the hidden entry https://issues.kolab.org/show_bug.cgi?id=4125: In https://issues.kolab.org/show_bug.cgi?id=4124#c5, bug 4125 is called "the requested functionality of preventing signup for deleted accounts". According to the date of the "neighboring" bugs, this is already known since at least December 2014.

To fix this problem, I suggest that Kolab instances should block addresses of deleted accounts "forever".

I have already contacted the KolabNow technical support about this in November 2016, but they answered: "We cannot reserve email addresses after they've been removed from our systems."
I also told them that I will disclose this problem after a sensible time interval, so that's what I am doing now, such that Kolab users are warned, and Kolab developers are informed.

Best regards,
Singletime

[Paul Ryszka]

Post by Singletime
Hello list,
I was a KolabNow user for some time. In July 2016 I deleted my
account. In October 2016, I tested whether it was possible to create a
new account with the same email address as before, and surprisingly it
worked!
This means that after at most three months someone else could take
over the email address of a deleted account. This exposes ex-users to
a) by replying to mails of contacts that by mistake still use the old address;
b) by catching password recovery emails, when people forget to update
their email address in all online accounts.
This problem is already known as the hidden entry
https://issues.kolab.org/show_bug.cgi?id=4125: In
https://issues.kolab.org/show_bug.cgi?id=4124#c5, bug 4125 is called
"the requested functionality of preventing signup for deleted
accounts". According to the date of the "neighboring" bugs, this is
already known since at least December 2014.
To fix this problem, I suggest that Kolab instances should block
addresses of deleted accounts "forever".
I have already contacted the KolabNow technical support about this in
November 2016, but they answered: "We cannot reserve email addresses
after they've been removed from our systems."
I also told them that I will disclose this problem after a sensible
time interval, so that's what I am doing now, such that Kolab users
are warned, and Kolab developers are informed.
Best regards,
Singletime
_______________________________________________
users mailing list
https://lists.kolab.org/mailman/listinfo/users

Hi,


that is not such a problem as this require domain name redirection to
kolab instance after account has been removed and there are two scenarios

1) domain mail has been moved to another provider in which case simply
creating account with the same email achieves nothing (you can as well
set it up on your home server)

2) domain is still redirected to the same instance in which case domain
administrator have authority over creating and deleting email accounts.

So the only problem I can see is when you are using providers domain
which has number of repercussion security and otherwise.

Best regards

Paul

[Singletime]

Paul Ryszke wrote on 19. April 2017 11:59 UTC:

So the only problem I can see is when you are using providers domain which has number of repercussion security and otherwise.

So can the [kolabnow.com](https://kolabnow.com/) people please give this warning on the "individual account" creation page? This would have helped a lot.

-- Singletime