3 ms·
Strong scent of bovine effluence. In order to reset their email password he would’ve needed access to their email.
by fijiaarone 2y ago
Strong scent of bovine effluence.
In order to reset their email password he would’ve needed access to their email.
- wmf 2y agoNo? If you're resetting your email password, it's probably because you're locked out of your email and thus the reset process shouldn't require email.
- insidstwr 2y agoIt should use 2fa and another email. For corporate just internal IT right? Security here seems lapse. Ideally reports are links to an internal system not attachments.
- tgsovlerkhgsel 2y agoShould have needed. I recommend listening to (or reading the transcript of) https://darknetdiaries.com/transcript/118/ https://darknetdiaries.com/transcript/118/ about someone doing account hijacking/password reset as a service. Even good services sometimes have zero-days.
- andrewaylett 2y agoMicrosoft supports self-service password reset: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr https://learn.microsoft.com/en-us/entra/identity/authenticat... "Microsoft Entra self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement. If Microsoft Entra ID locks a user's account or they forget their password, they can follow prompts to unblock themselves and get back to work." Which isn't actually quite as crazy as it sounds like it should be.