Your account is created in avast! feedback community!

[Skakara]

Hello, I hope this is the right forum to post this.

½ hour ago I received an email from "feedback@noreply.avast.com" with the title:

"Your account is created in avast! feedback community!" and message:

Hi,

Welcome to avast! feedback! Find login credentials below:
Email: xxx
Password: xxx

You can help us make our community better by expressing your opinion!
You can change your settings, password, upload avatar, or track activity in your profile

What the ?!?! I have NOT registered to avast feedback community!!! Why did I receive this email?? And is my email address really AUTOMATICALLY have been used to create some account/profile?!?!? And emailing passwords in plain unencrypted emails?! Really smart.

THIS IN UNACCEPTABLE!!! I've NEVER encountered anything like this before.. and I've seen lots of things happening.

[lukas.hasik]

Hello,
this is SSO for most avast portals. I expect that you logged in to forum and then tried to add (or just went to) feedback.avast.com portal. As you were logged in it recognized you and allowed you to work as registered user. Of course, the local feedback.avast.com account was created automatically for you however it still uses the same authentication as you use at forum...

[Skakara]

I expect that you logged in to forum and then tried to add (or just went to) feedback.avast.com portal.

What do you mean "tried to add"? I've never visited feedback.avast.com. Only after I got the email I checked out the front page.

Of course, the local feedback.avast.com account was created automatically for you however it still uses the same authentication as you use at forum...

Uses the same auth? The password which was sent in the email is COMPLETELY different than my PW to this forum.

And I want to pass my opinion once again about sending passwords in plain emails, don't.

I'm sorry but your answers do not clear up what happened.

[Skakara]

Wow, isn't this great, check this stupidity out:

I went to "Profile Settings" in feedback.avast.com, and what do I see there?

Full Name *
Enter your nickname or full name for it to be displayed in the system

That setting is filled with my EMAIL ADDRESS!!! No f way. This is so wrong!

Let's see what the next setting says:

Email *
Email is used to login and send notifications. Email is not shown in public

Well daah, my email WAS SHOWN IN PUBLIC ALREADY WHEN THIS STUPID AUTOMATIC SYSTEM REGISTERED ME WITHOUT MY CONSENT!!! Read that previous text in red a few times.

I can't believe you are doing this. Who designed and approved this stupidity?

[Para-Noid]

The avast forums and the feedback board are linked.
Thus making the use of the same log-in extremely logical.
This makes it easier to go from one to the other.
There is no "stupid" involved. There is a whole lot of
"smart" involved.

The only way your email is displayed is if you failed to select a screen name.
I do not see nor is there a way for me to see your email.

[Skakara]

The only way your email is displayed is if you failed to select a screen name.

The only one that has failed is Avast!

I registered to this forum alone back in 2012. I selected my forum name to be "Skakara".

Now, jump back today, at 13:23 I received the email quoted in the first post. I'VE NOT REGISTERED TO feedback.avast.com (and didn't visit it before)! I was AUTOMATICALLY REGISTERED for some reason I don't know. So, how did I "failed to select a screen name"?! Tell me.

I do not see nor is there a way for me to see your email.

That's too wrong. On https://feedback.avast.com/users page there's a "Newly Registered" section which did show my email for a while (until there were more new members)! I see that there's "new members" that have also "failed to select a screen name".. or maybe they were too automatically registered WITHOUT CONSENT like I was.

[Para-Noid]

@ Skakara

I sent a PM to the proper person. Hopefully this will be rectified.
Sorry for my misunderstanding as to what you meant.

[lukas.hasik]

thank you for notifying us. We'll have to do something to improve the privacy... And also the UX and flow. Seems that this way of SSO is confusing.

[Skakara]

Thank you for the acknowledgment. Million thanks and a deep bow.

[Skakara]

Finally now when your feedback.avast.com site is working again (first it gave DB errors & then it went down for long time) I could test this thing a bit more. Here's what I found.

When I've logged out from "avast account" (this is what this forum now uses) and go to "feedback.avast.com" and do:

- Click login -> Login Form -> Single Sign-On = https://forum.avast.com/sso?sso_redirect=1 page opens with "File not found." text.

- Click login -> Login Form = enter my email and the password which came in the "Your account is created in avast! feedback community!" email -> I'm logged into "feedback.avast.com", and just that site, I'm not logged in to this forum. Which means that the "Your account is created in avast! feedback community!" email & registration was JUST for the feedback.avast.com site. It has NOTHING to do with your "Single Sign-On" which you're referring to in this topic all the time. Which makes sense since the password you mailed me in the "Your account is created in avast! feedback community!" email is completely different than my "avast account" password.  Somehow you, Avast, automatically registered me to feedback.avast.com and that registration has NOTHING to do with "Single Sign-On". Why did this happen? You better check your system very very carefully!


The password from the "Your account is created in avast! feedback community!" email does NOT work in "avast account" login.

So, you have 3 different login concepts: Avast Account, login to just feedback.avast.com and this mysterious "Single Sign-On" that doesn't even work (goes to error page).

If I'm logged in to just "feedback.avast.com" with the new different PW I was mailed, or when I'm logged in with my "Avast Account", I see the same profile in the "feedback.avast.com" (I know this because I changed the Full Name at one point and it shows the same name with both logins). SO, now I've 2 login credentials to just 1 account in "feedback.avast.com". Talk about messy.

I wonder what would happen if I were to try to change the password in "feedback.avast.com".   

[lukas.hasik]

Finally now when your feedback.avast.com site is working again (first it gave DB errors & then it went down for long time) I could test this thing a bit more. Here's what I found.

When I've logged out from "avast account" (this is what this forum now uses) and go to "feedback.avast.com" and do:

- Click login -> Login Form -> Single Sign-On = https://forum.avast.com/sso?sso_redirect=1 page opens with "File not found." text.

- Click login -> Login Form = enter my email and the password which came in the "Your account is created in avast! feedback community!" email -> I'm logged into "feedback.avast.com", and just that site, I'm not logged in to this forum. Which means that the "Your account is created in avast! feedback community!" email & registration was JUST for the feedback.avast.com site. It has NOTHING to do with your "Single Sign-On" which you're referring to in this topic all the time. Which makes sense since the password you mailed me in the "Your account is created in avast! feedback community!" email is completely different than my "avast account" password.  Somehow you, Avast, automatically registered me to feedback.avast.com and that registration has NOTHING to do with "Single Sign-On". Why did this happen? You better check your system very very carefully!


The password from the "Your account is created in avast! feedback community!" email does NOT work in "avast account" login.

So, you have 3 different login concepts: Avast Account, login to just feedback.avast.com and this mysterious "Single Sign-On" that doesn't even work (goes to error page).

If I'm logged in to just "feedback.avast.com" with the new different PW I was mailed, or when I'm logged in with my "Avast Account", I see the same profile in the "feedback.avast.com" (I know this because I changed the Full Name at one point and it shows the same name with both logins). SO, now I've 2 login credentials to just 1 account in "feedback.avast.com". Talk about messy.

I wonder what would happen if I were to try to change the password in "feedback.avast.com".   

Wow, thank you for the analyses!

[lukas.hasik]

Hi,
it should be fixed now.
- we don't show the emails anymore
- new "nickname" is generated instead of email address

[Skakara]

Great! I wish that other topics I've been active lately would actually get answers from Avast (I'm starting to think that I need to move away from Avast since nobody seems to care about real problem(s) in Avast AV).

But what about the fact that your system generated totally new credentials only to the feedback.avast.com site? Like I wrote earlier, I now have 2 login credentials to just 1 account in feedback.avast.com.