4 ms·
Most strange thing is that he says the email was untouched so he concluded that the attacker somehow must've bypassed the email - if such a thing is possible..
by moepstar 13y ago
Most strange thing is that he says the email was untouched so he concluded that the attacker somehow must've bypassed the email - if such a thing is possible..
- pfg 13y agoThe attacker could have intercepted the email somewhere between OVH and the recipient unless the SMTP session was using SSL (which, unfortunately, isn't always the case). Obviously this is highly speculative.
- X-Istence 13y agoOn OVH's manager you can add secondary email addresses to a single account. I for example have three emails linked to my account. Upon logging in all those email addresses will get an email notifying me, AND upon doing a password reset all three email accounts will get the password reset link. At the first compromise which may have been external to OVH's systems the attacker may have added their email address to the list of valid emails, and may have received the password reset email at the other email address. This could explain why the second reset password email was unread...