Window displaying ph & backup email appearing on inbox page not cool - very insecure!

[hadaso]

I would say that a better way to achieve the same would be either to Flash up the same window without showing the details' and instead a link to the settings page that shows them. Not that I like it. I hate things that popup when I am focused on doing something else (and I reluctantly accept this behavior only from my wife). The correct way for an email provider would be an email that suggest that you go to your settings page and provide the needed info.
Anyway, it's not a password that can be used to take over the account. For this info to be usable to someone else that someone would need access to the recovery address or phone.

[gardenweed]

I also just had one of these pop-ups.
I opened my email in the web UI, as usual, and this pop-up appeared showing in plain sight my account recovery details and asking to confirm or upgrade. The details displayed were correct.
Unfortunately I was rattled enough not to screenshot it.
The artwork matched the pastel party style currently in use by FM.

I have raised a ticket with FM asking if they actually send these.

[somdcomputerguy]

Well the screenshot image has been deleted or something so I have no idea what it looks like, but the window or pop-up or whatever one wants to label it as has been verified by another FM user to be in existence. While this may be annoying, it isn't an uncommon thing for a service which has an account for somebody to request if the account details are accurate and/or up to date. There are many many ways this request can be made, and some are sure to not be the way that some want..

- bruce

[gardenweed]

Reply received back from FM.
Yes the popup is legit.

[gardenweed]

Originally Posted by somdcomputerguy

Well the screenshot image has been deleted or something so I have no idea what it looks like, but the window or pop-up or whatever one wants to label it as has been verified by another FM user to be in existence. While this may be annoying, it isn't an uncommon thing for a service which has an account for somebody to request if the account details are accurate and/or up to date. There are many many ways this request can be made, and some are sure to not be the way that some want..

- bruce

For sure.
Other service providers do regularly remind me to check and update my details.
It's the first time that I've seen a notice display all of my details and each form of them in full and plain sight.
I can't think of another service check that does this.
The usual method that I recall is that only the last 3 or 4 characters of the secure item will be shown. The rest is either hidden or not stated.
I think this goes beyond just being not what I want, and falls into the category of being a potential security breach in itself.

[Bamb0]

Originally Posted by JoeR

Fastmail should know better

They probably overlooked that.... (uugghh)