Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in answering my security question.

The provider's response to this event was to reset my password.


  Dear Customer,
  
  We received a request to reset the password for the account ‘myusername’
  from the IP address 41.174.96.79 but the security question entered was
  invalid.
  
  As a security precaution we have set your accounts password to:
  roRy1391
  
  Once you have logged in you will be prompted to change your password
  immediately.


(The email turned out to be real, and I was able to login and change my password successfully.)

It seems to me that the appropriate response to such an event is for the provider to do nothing. After all, what if this attacker had already gained access to my email account? Then he would have received this email, and gotten access to my account anyway.

However, there is a possibly mitigating factor. This provider always requires answering the security question whenever logging in from a new IP address. This also, in theory, would have stopped this attack if the attacker had gotten access to this password reset email.

Was this an appropriate action on the provider's part? If not, what should they have done instead, and what should I say when I yell at them?

This is an absolute breach of security. Even if their policy was somehow sound, sending the password in plaintext to you in an email means that the reset is useless, and as you said, if the attacker had access to your email the security questions wouldn't do squat.

They should have done nothing as the security question answered was invalid. The best thing to do, IMHO, is to go a step further and block the user from answering questions for a defined period. Notifying you is a proper step, but changing the password just makes it useless.

I'd ask them a simple question: "if you're going to send me (or someone pretending to be me with access to my email) a password if I/someone else guess the security question wrong, what's the point of security questions?"
