4 ms·
That's just for support. Legit password resets for example come from more random top level domains with "microsoft" in it, like microsoftonline.com Another fun
by throwaway290 6mo ago
That's just for support. Legit password resets for example come from more random top level domains with "microsoft" in it, like microsoftonline.com
Another fun one is facebook, they use facebookmail.com or whatever else for serious security stuff
- e40 6mo agoThe number of redirects while using ms properties is just insane. It makes white listing them in uBO impossible because they redirect so fast, through multiple domains. The White listing is needed to sometimes make them work.
- throwaway290 6mo agoIt's a thing with google and facebook too. If you login to youtube or go to facebook account settings, at least 3 redirects through very random places. I guess 3 is not a lot compared to microsoft's 15.
- CraigRood 6mo agoIs this because at one point <username>@facebook.com was a valid communication method? Great concept to be fair, but once you pull back the first layer you can immediately see its problems.
- Metacelsus 6mo ago>Legit password resets for example come from more random top level domains with "microsoft" in it, like microsoftonline.com Or aka.ms