Seems like a new modified url hack is back to reset passwords

Question

Was doing some studies.
http://www.macrumors.com/2013/03/22/apple-id-security-hole-allows-password-reset -with-email-address-and-date-of-birth/
Seems this situation is back. For the past couple months, my recovery email kept getting the message about how to reset your password. Thing is, I never requested it, nor did anyone get into my email address, since if a new device tries, I get a text message confirmation. So.. now then, skip to today. I get that apple thing again, and then later my main email gets a notice that 2 apps were downloaded (Free ones at least) So thats when I learned apple added a 2 step verification etc.. so I just enabled those and changed everything out and called in to verify nothing else bad happened.
So yea, reading the above link.. seems to suggest a way has been found again to change a password and gain access without actually getting into an email account to process it.

Answer 1

There are many ways for people to hack an account that don't involve a vulnerability like the old one described in that article. (In other words, there's no reason whatsoever to believe that another similar vulnerability exists.)
You could be using an easily-guessed password that falls to a brute-force attack by a botnet. Someone targeting your account specifically may be able to guess the password after doing some "cyber-stalking" (reading publicly-available information about you on Facebook, Twitter, etc). You could fall for a phishing scam and give away your password willingly to an attacker. Someone could surreptitiously look over your shoulder while you type the password. If you're using Windows (much less likely on a Mac, though still technically possible, and not possible on iOS), you could have malware capturing your keystrokes.
This is why it's important to use strong passwords, and to use a password manager to avoid having to enter passwords manually. And to be vigilant about making sure you don't get infected with anything.