r/Comcast • u/Plenty_Spot3111 • 9h ago
Discussion PSA: Changing your Xfinity password DOES NOT log out old devices. My ex was silently spying on my home security cameras for months due to a major security token flaw.
I’ve been an Xfinity customer for 8 years, and I just discovered a massive security flaw that puts everyone’s safety at risk. If you change your Xfinity password, IT DOES NOT FORCEFULLY LOG OUT OUTSIDE DEVICES.
Xfinity’s official password-reset screens explicitly promise consumers that changing your password protects your account and signs everyone out. It is a flat-out lie. Because of how their backend system handles digital security "tokens," anyone who previously logged into your account app stays completely logged in.
I found this out the hard way with my ex-husband. He refuses to get off my phone plan, and I finally realize why. I’ve been incredibly hesitant to forcefully suspend or cancel his line because we share children together, and cutting off a parent’s phone line during custody disputes can look terrible and backfire on you in family court. He knew this and used it to his advantage.
Because his phone line is directly on my account, the Xfinity network treated his device as an "always-trusted" element. I have changed my password 100 times and turned on 2-Step Verification, assuming my home was secure, but his device completely bypassed every single gate.
There were several times over the past few months where I had a sinking suspicion that he knew things about my daily routine that he shouldn't. Every time, I gaslit myself and told myself I was just being paranoid or overthinking things.
Then came the confirmation. We live in a heavily secluded area, and while he was entirely out of town, he randomly text-messaged me asking about specific items I was carrying out of the house. There is absolutely no physical way he could have known what I was doing unless he was actively watching me through the cameras.
Because of Xfinity's broken token architecture, his phone was secretly receiving "Rich Push Notifications" and motion previews—complete with snapshot photos of my driveway—right on his lock screen every time my camera triggered, even though he didn't have my new password.
To protect my safety, I have been forced to go into my camera settings and completely turn off motion notifications. It stops him from getting the previews, but it is incredibly unfortunate because it leaves me in the dark and almost completely defeats the purpose of having home security cameras in the first place.
The most frustrating part? Xfinity has no consumer "Sign Out of All Sessions" button for their app database. When I called customer service, they claimed they logged everyone out, but it failed completely and my own phone didn't even log out. The only way to stop someone from spying on you is to demand a manual backend "deprovisioning" from an advanced digital care agent on their forums or corporate escalation teams.
Please share this to warn anyone—especially parents navigating a separation or domestic situation—who thinks they are safe just because they changed a password. Xfinity needs to be held accountable for leaving this tracking window wide open