3 ms·
I got one of these "someone request a password reset" mails from Facebook yesterday. I don't think I've had one before, and my email on its own domain I've had
by jlokier 3y ago
I got one of these "someone request a password reset" mails from Facebook yesterday. I don't think I've had one before, and my email on its own domain I've had for ~20 years doesn't seem to be one people type by mistake.
I thought it was probably phishing, yet the links all looked legitimate, including the one for password reset and the one to tell Facebook I didn't request the reset.
So I thought it might be a homoglyph attack (a URL that looks legitimate but isn't because it's using alternate characters that look the same or similar), and rather than click the link saying I didn't request the password reset, I logged into Facebook hoping to find a notification or something in the account settings logging that it was a genuine request.
I was surprised to see no notifcation, nor anything in the account settings and security area.
I was also surprised to see I needed to login again, as I thought Facebook kept a long term session open for longer than the 2 weeks since I'd visited it previously.
If it was a tricky method to get me to login to Facebook again, it worked! But I didn't stay long after I didn't find what I was looking for.
- ShowalkKama 3y agojust to be sure if you use firefox you can set network.IDN_show_punycode to false in about:config this will make the url bar display the encoded version instead (xn--wikipedi-86g.org)
- thrusong 3y agoThis was exactly my experience yesterday— on a firstnamelastname.tld email address for the first time, sort of phishing looking but with legitimate-looking URLs. Even the email headers looked legit but there was something so weird feeling about it I figured it was a sophisticated phishing attempt. I also found it odd there was no notification or anything inside Facebook.