Healthcare.gov alerts me to messages that don't exist

Healthcare.gov repeatedly sends me email that says "You have a new message waiting for you in your Marketplace account." However, when I login to the account associated with the email address receiving these emails, there is no message waiting.

Healthcare.gov email subscription system discloses Marketplace user email addresses

The Healthcare.gov account creation process is not the only system component to expose user email addresses: the email subscription management system makes it even easier to determine if an email address exists in the system.

The footer of emails from Healthcare.gov contain a link to a Subscriber Preferences Page that can be used to subscribe and unsubscribe to emails from Healthcare.gov.





Clicking the link goes to a form requesting an email address.





When I enter an email address associated with a Healthcare.gov Marketplace user account, the site shows that the email address is subscribed to a topic called "For Account Holders".  There is no challenge to verify that I am the owner of the entered email address.





When I enter an email address that is not associated with a Healthcare.gov account, I get a different response -- a form to create an email subscription account.




In providing a different response for email addresses that have Healthcare.gov accounts and those that do not, this email subscription system is revealing whether or not an email address is tied to a Healthcare.gov account. This information may be useful to attackers seeking unauthorized access to Healthcare.gov.


Oh, and when I unsubscribed from emails, I got a confirmation email telling me that unsubscribing means that I'll receive future email updates.

You unsubscribed from topics:

• For Account Holders

You will receive an email update when new information becomes available.

Is there a problem here?

Healthcare.gov blames users for slow email

Healthcare.gov took over 3 hours to send me an account activation email. (Their phone support told me to wait 3 days for the email.) Then, when I receive it, they blame me for not being quick enough.

And, it seems they expect me to request another email and then sit by my computer refreshing my inbox for hours (or even days) so that I can immediately respond to their automated email when it arrives.

Healthcare.gov tells people to wait for email that was not sent

After several failed attempts to create an account at Healthcare.gov, I finally made it to the end of the process. It told me to check my email for instructions to get my username. I waited. I checked my email repeatedly. I received no email.

I then called their support line and was told that the system was under heavy load and I therefore needed to wait at least 3 days to receive an email.  Thinking that 3 days was a bit unreasonable when the user interface tells me it was already sent, I tried to create another account.

This time, I kept my browser's developer tools open so that I could monitor the requests and responses and I completed the account creation process. On the last step, I noticed a problem: The final request that submits all the data entered into the multi-page form fails. Most-likely, my data was not received and no email was sent.

That Status 500 in the image above indicates that a server-side (likely software) error occurred in the submission of the data I entered.

I tried again, and on each attempt, the site told me my data was received and an email sent when submitting the data failed.

Maybe I'm just too picky, but I expect information given to me in a software user interface to match reality. It seems that may not be a requirement at Healthcare.gov. This type of error wastes users' time, frustrates users, generates unnecessary support phone calls, and costs us taxpayers money.

Healthcare.gov exposes existing usernames and email addresses

As a fundamental principle in software system security, it is considered wrong to expose anything about protected data in a system in the error messages that are returned to those who are not authorized to access that data.

For example, if one enters an incorrect username and/or password, you do not tell them whether the username or password is incorrect. Confirming that a username exists is useful information to someone who is trying to gain unauthorized access: it allows them to narrow their attack to a known username and/or combine the username with other info to aid in guessing or otherwise gaining access to the password.  Such information is useful in social engineering.

GIVEN that not disclosing information to the unauthorized in error messages is a practice that is expected of any competent web application developer
AND that Healthcare.gov is a system many are required by law to use
AND that Healthcare.gov contains private information,
THEN let's take a look at what we get from Healthcare.gov :

FAIL!

PS: Given a real constraint on unique user names obfuscating the fact that a username exists may not be easy. However, one could at least present a more ambiguous error message along the lines of "That username is invalid. Please try another." Or, let the system generate the usernames in a way that no conflicts are created. (See comment below.)

Healthcare.gov's email validation system is fundamentally flawed: FIXED

FIXED: As of 11/05 (maybe sooner), this issue has been fixed. The last step of account creation no longer sends the email verification code (also the password reset code) to the user's browser. This fix should now prevent people from activating accounts using others' or fake email addresses.

---

At the end of the Healthcare.gov account creation process, they send an email to the provided email address that contains a URL to activate your account.  Email verification systems like this are common and help ensure the person who creates an account on a system actually owns the email account.

However, Healthcare.gov's email validation is fundamentally flawed. It is flawed in that it returns the email verification code (the one that is emailed) to the browser. This enables people with malicious intent to create a Healthcare.gov account with another's email and activate it without receiving the verification email.

The design of this email verification system suggests it was created by someone with no understanding of the purpose of what they built.

Your Healthcare.gov email address has been updated

After using a test email to create my account at Healthcare.gov, I changed it to my primary email address.

As many systems do, Healthcare.gov sent an email notification of email address change. This is typically done to provide the owner of an account that their account has been compromised in the event that they are not the one who made the change.



In order to be useful in informing the owner of an account of the change in the event that someone else made the change, these notification need to be sent to the old address. Some systems will send these change emails to both the old and the new address.

However, in the case of Healthcare.org, I only received an email at the new email address. I did not receive one at the old address. While it is possible that I did not receive an email that was sent, I repeated the exercise the next day and changed my email address again: I received notification at the new address and not the old.



Sending notification emails to only the new address defeats the purpose of notifying users when their email address changes. This makes it easier for those with malicious intent to go unnoticed.

Where's the PDF?

When viewing PDF files attached to emails, Round Cube WebMail resizes itself and the PDF viewer to be as small as possible -- an apparent attempt to conserve screen real estate. ;-)

Attached is

@matthodder: I know this old and simple- but man I love this gmail feature.

Sometimes software presents pleasant surprises and saves us from our own mistakes. Nice one Google.

That was the wrong password

I got the above screen after failing to login to my Meetup account to RSVP for a meeting.

As a user, I like that it tells me that I used the correct email address but wrong password.

However, this system has just verified information without authentication. It tells me that a valid user email address was used. This information could be helpful to someone trying to gain unauthorized access.

Now, in this case, I don't think disclosing that email accounts exist is a huge deal. This is a social networking site. This is not a banking system. This is not a medical records system. It is not an interface to access private information. Meetup profiles are public and searchable on the web -- although not email addresses. I say no problem in the context of this site.

For other systems, giving non-authenticated people information that narrows down access credential options could be a huge security problem.

{ Spell Check | My Grammar } Bug #5,384,439,201,264,785,965

Sending out an email in Lotus Notes triggers a spell check process. During this process, I was warned of the following "issue":



Maybe it is my grammar that is rusty; perhaps this sentence structure isn't "legal". I'm inclined to believe that I'm right.

Regardless, it isn't a spelling error. So why am I being told that it is?

Don't tell me my address is invalid!

Flying J lost my business because their email address rules prohibited my valid address.