Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

...I am really annoyed and unsettled by the password reset email I just received from Microsoft.

What should I think of this? My email client correctly told me that the underlying url is not the same as advertised...

I prepared a nice screenshot but can't post it because of missing reputation...

The text of the email is:

 View this email in your browser

   Reset your Microsoft Online Services password   Microsoft     
   We've received a request to reset the password for your user@domain.onmicrosoft.com Microsoft Online Services account. 

Click the link below and then follow the instructions in your web browser.

Reset your password now 

If clicking the link didn't work, copy the following URL and paste it into your browser window. 

https://prs-scu.passwordreset.microsoftonline.com/Default.aspx?o=EJbpn[...]

If you did not initiate this request, please contact support.  


   Microsoft Corporation | One Microsoft Way Redmond, WA 98052-6399
This message was sent from an unmonitored email address. Please do not reply to this message.
Privacy | Legal
   Microsoft 

And the links named prs-scu.passwordreset.microsoftonline.com... actually leads to http://click.email.microsoftonline.com/?qs=bc7f[...]

Edit, I gained image pasting rights, so here is the screenshot:

enter image description here

share|improve this question
    
Can you mention what it said it went to and what it actually went to (with any tokens altered obviously.) –  AJ Henderson Aug 2 '13 at 19:26

3 Answers 3

I'm the Program Manager in charge of the password reset experience for Microsoft Online Services and wanted to clear up a few of the things you are seeing. First of all, thanks for your feedback; we're always looking to improve our service, and comments like these really do help us to make things better over time.

The root DNS entry for our service is passwordreset.microsoftonline.com. This DNS entry sits in front of a load balancer which directs traffic to region-specific datacenters which have different DNS records, hence the prs-scu subdomain (as an aside, as you perform your password reset, we also use this load balancer to ensure that your session is highly available in case of a datacenter-specific issue).

Now, when we send the email to your account to reset your password, we dispatch that email through a shared email service that is owned by a different team at Microsoft. This is the same email service we use to send notification emails and informational emails for Office 365 as a whole.

The reason you see a different link in the href portion of the URL (e.g. click.email.microsoftonline vs. passwordreset.microsoftonline) is because the service we use to dispatch our emails puts a redirect in front of every outgoing URL to prevent phishing attacks. We chose to include the plaintext version of the url in the body to address the case in which a user's email client does not handle HTML properly.

If you'd like to discuss this further, or what else we can do to improve your experience in the future, please feel free to contact me at asteen@microsoft.com.

share|improve this answer
    
I appreciate your feedback and the background information. However, I still think this is unacceptable. As I see it, you have options that you could implement immediately: 1. do not use an html link to place the plain text link in your email to prevent the mail service from replacing the underlying url (it's for copy/paste only, anyway). 2. tell the mail service to not replace that specific link (hopefully its configurable). 3. change the mail service to not only change the underlying url but also the link text and the "alt" text, if identical. –  Zalumon Dec 24 '13 at 11:53
    
Thanks for the followup. We'll take this into consideration for one of our next releases. –  Adam Steenwyk Dec 26 '13 at 2:42

It's less of a risk than cold sending e-mails asking you to login to random websites, like some companies (Bank of America) have been known to do. I think that since it is a requested e-mail from Microsoft, you can generally figure it is probably safe, particularly since if someone had compromised your e-mail, they could simply use the password reset link themselves. It's still a little odd, but I don't see a huge security risk here.

They are actually probably doing it to keep the appearance of the e-mail being about the service that you requested a password reset for even though Live accounts (or whatever they are calling it these days) are actually centrally managed as it's own service. This makes sense from a perspective of not wanting to train users to go log in for any e-mail that tells them somewhere to go, but also bad in that the slightly more attentive user will notice that the link doesn't match.

Update: Since it is only a sub-domain that changed, this is probably even less of an issue. It looks like they are using an e-mail click tracker that redirect via a short url to the actual page the link indicates. This is more or less standard practice for many e-mails.

share|improve this answer
    
I wasn't attentive, my email client was ;-). Anyway, I now clicked on it anyway and everything seems to be ok. But still, I think this is very bad form from Microsoft. It just screams "phishing". –  Zalumon Aug 2 '13 at 19:59

If you are concerned about the ownership of a link, you can check the certificate that comes up in the link to see who it is registered to, or you may want to check out the whois information.

microsoftonline.com is registered to Microsoft:

Registrant:
    Domain Administrator
    Microsoft Corporation
    One Microsoft Way
     Redmond WA 98052
    US
    domain@microsoft.com +1.4258828080 Fax: +1.4259367329

Domain Name: microsoftonline.com

    Registrar Name: Markmonitor.com
    Registrar Whois: whois.markmonitor.com
    Registrar Homepage: http://www.markmonitor.com

Administrative Contact:
    Domain Administrator
    Microsoft Corporation
    One Microsoft Way
     Redmond WA 98052
    US
    domain@microsoft.com +1.4258828080 Fax: +1.4259367329
Technical Contact, Zone Contact:
    MSN Hostmaster
    Microsoft Corporation
    One Microsoft Way
     Redmond WA 98052
    US
    Email Masking Image@microsoft.com +1.4258828080 Fax: +1.4259367329

Created on..............: 2002-07-09.
Expires on..............: 2014-07-09.
Record last updated on..: 2013-06-08.

Domain servers in listed order:

ns2.bdm.microsoftonline.com
ns1.bdm.microsoftonline.com 

The phone number listed above is the Microsoft PR phone number @http://www.microsoft.com/en-us/news/PR_Contacts.aspx

In addition if you visit https://prs-scu.passwordreset.microsoftonline.com/ and look at the SSL Cert info, you will see its associated with Microsoft, but they should get an EV cert to make it more clear.

It sounds like they wanted to display a simple link to the user, but have the tracking or reset token not shown. Things like this need to be evaluated on a case by case basis.

share|improve this answer
    
Thanks for looking up the certificate. Actually the link they displayed was almost more complex than what it led to, so that couldn't have been the reason. I guess I just have to accept that this is now acceptable behavior. But I remain irritated that neither you nor AJHenderson seem particularly disturbed by this bad form. I used to tell my parents that this is a dead giveaway of phishing and now I have to go and tell them "it all depends", even MS does it, ugh. –  Zalumon Aug 6 '13 at 18:28
    
If you are comfortable with certificates, you will have more confidence then with a URL even if its different. To me, I care who controls the URL, not that it's the same. –  Eric G Aug 6 '13 at 23:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.