Chris Kirsch - Forgot Password: Finding Missing People Using Login and Password Reset Forms
Channel: BSides Boston
Date: 01/11/2020

Open Source Intelligence (OSINT) is very helpful in finding missing persons. Login and password reset functions leak a lot of information but they have been underutilized in this field. Examples come from major sites including social media, financial services, eCommerce, telecommunications and technology providers, leaking masked emails and phone numbers, usernames, names and employers, all of which can be findings or pivot points. Even knowing what site a person participates in can yield great insights because it can provide a new lead and opens the door for getting information via legal process. Attendees will get access to a freshly compiled collection of over 300 sites that leak useful information for online investigators, social engineers and penetration testers. Defenders will walk away with helpful tips on how to design secure login, password reset, and signup functionality.