69

I want to reset the password of the only Stack Exchange account I created some years ago. This page asks my email; I type it in and click on the "Send Recovery Email" button. Then I get an email sent by "Stack Overflow" <do-not-reply@stackoverflow.com>. In this mail, I read the following sentence :

If you initiated this request, click this link to reset your password.

The words "click this link to reset your password" contain a link pointing to https://stackjava-script.com/users/login?ssrc=account_recovery. A strange page appears with a French message having nothing to do with Stack Exchange.

So, what's going on here?

3
  • 5
    I just created a new account and then requested account recovery. In the email I receive it links to https://stackoverflow.com/account/recover?recoveryToken=%2fGOz... so I have no repro now. Is it possible that you have a local issue or a rogue ISP? Maybe a virus. Try a different computer and/or email client. The domain you linked to is also using an invalid certificate and the domain doesn't look to be registered by Stack Overflow: whois.icann.org/en/lookup?name=stackjava-script.com
    – rene
    Aug 16, 2016 at 19:13
  • @rene The SSL certificate issue appears to have been fixed, they're using Let's Encrypt now. Aug 17, 2016 at 13:46
  • 1
    @KevinBrown at least that is fixed and the website has a great explanation why you might end-up there.
    – rene
    Aug 17, 2016 at 14:17

1 Answer 1

113

We've received similar reports on and off over the last couple of years.

The short version of the problem is "your email provider is an idiot". They blindly replace the word "overflow" with "java-script". Why? No idea. But I found a similar report here:

enter image description here

If you fix the URL manually (the domain should be stackoverflow.com, of course), you should be able to reset your password.

12
  • 37
    Incredible. And yes, my email provider is ... Orange.
    – suizokukan
    Aug 16, 2016 at 19:52
  • 6
    Oh that's funny. But somebody must have caught on to take advantage, I mean, stackjava-script dot com is certainly a registered domain name. Btw the ovh (the registrar) abuse complaint form is at ovh.com/ca/en/abuse
    – Jason C
    Aug 16, 2016 at 21:00
  • 14
    @JasonC I'm not sure there's a real abuse case here. That domain isn't fishing (or phishing) for our users' credentials, or pretending to be Stack Overflow. It just happens to exist.
    – Adam Lear StaffMod
    Aug 16, 2016 at 21:01
  • @AdamLear Maybe OVH caught onto the issue and added it to be the good guy.
    – Jason C
    Aug 16, 2016 at 21:04
  • 16
    This looks like a really bad attempt to sanitize input. (We can't blame the website for this.) We might as well be in the Medireview Ages.
    – Laurel
    Aug 16, 2016 at 23:33
  • 26
    @Laurel Indeed. It's a clbuttic, time-honored approach.
    – Adam Lear StaffMod
    Aug 16, 2016 at 23:34
  • 1
    And here comes the real question: what theme are you using for GitHub?
    – Braiam
    Aug 17, 2016 at 23:33
  • 1
    @Braiam userstyles.org/styles/37035/github-dark
    – Adam Lear StaffMod
    Aug 17, 2016 at 23:47
  • 1
    Reminds me of when AOL blocked the UK town of Scunthorpe many years ago...
    – DavidG
    Aug 18, 2016 at 13:35
  • 13
    It looks like someone has bought the stackjava-script.com domain now and put a nice message explaining what is going on.
    – Flimm
    Aug 18, 2016 at 13:38
  • 1
    Funny. Imagine the abuse potential if the provider used javascript instead of java-script. Aug 18, 2016 at 13:56
  • They surely have some Brillant developers
    – Sklivvz
    Oct 14, 2016 at 10:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .