4 ms·
> To check on the validity of the information, Fowler emailed many of the people listed in the file and told them that he was researching a data breach. Several
by tredre3 1y ago
> To check on the validity of the information, Fowler emailed many of the people listed in the file and told them that he was researching a data breach. Several of the individuals confirmed that the records contained valid account passwords and other data.
Do security researchers really contact people willy-nilly and ask them to confirm their passwords? Then they lecture us about the dangers of social engineering?
- Rychard 1y agoIf they already have your password (i.e. it has been compromised) there is no social engineering taking place. In fact, they're doing the honorable thing and not simply trying the credentials to see if they work.
- Defletter 1y agoI think what they're saying is that someone could pretend to be a researcher and ask for passwords to confirm that they match what was found in some fictional breached data.
- OneMorePerson 1y agoIf I'm reading it right the part about them confirming that the records contained the password implies that they were given the relevant record and then they confirmed it was accurate, not that they were just asked "hey what is your password"
- TruffleLabs 1y agoFor clarity this is what was said about emailing and confirming authentication of data: "To confirm the authenticity of the data, I messaged multiple email addresses listed in the database and explained that I was investigating a data exposure that may have involved their information. I was able to validate several records as these individuals confirmed that the records contained their accurate and valid passwords."