New answers tagged

0

You can try the following options: Have someone trusted in the organization warn them that there will be a test that will target the organization. This way if they see your message they know that it is a test and all is okay and it is not a sophisticated phishing scam. Add your contact information regarding any questions and that way when they call you ...


1

This could be sent from a hacked phone server, hacked phone account for sending sms, or from a service that has unlimited sms. Is this the literal message? Is this all that was in the message? If I google for this (with quotes) I don't get a result back. Do you see a number or name? Google it and post it here.


1

There are multiple reasons for this (sending data all over the place). If you are phishing with the intent of exploiting something, you may have something like mod_redirect running in the background to target specifics. E.g.: if UserAgent = IE && Windows 7 then send them to this particular page with Win7 IE specific exploits or if UserAgent = ...


1

The correct answer to this depends on whether any links go to Amazon.com or elsewhere. There may be multiple versions of this email - some sent from Amazon, and some sent from scammers. Hovering the mouse over the links will verify their actual destination in a tooltip, or possibly in the status bar. Note that this only applies to emails displayed in webmail ...


0

There is some debate about whether the wording of the message is correct, however it is trivial to copy wording. Clues about the origin of the email and what it is trying to effect are in the header content and any interactive content in the email (I.e. URLs - do not attempt to open suspect attachments but do scan them for malware if you are confident you ...


-2

It's legit. I received the same email, and yes my Amazon password had been disabled. To regain access I just followed the email's instructions, reset my password, and then I was in. I reviewed my order history, but nothing was amiss .. but now I've also been checking all the "haveibeenpwned" type sites, and can't find any that actually say that my email ...


-1

I've just received a similar email and the email appears legit. I was searching for information on what list it would be to know what else might have been affected. It has the right headers in authentication: Received-SPF: pass (google.com: domain of 2016061614470736b293d09e3b4022b187117dcb50p0eu@bounces.amazon.co.uk designates 176.32.127.205 as permitted ...


8

I called Amazon and the representative verified that no such email had been sent by Amazon. This is may be a phishing attempt. The original email seems (according to other reports) to include link formatted "Amazon.com" text, which may be a link to a fake version of the site. I can't see this in mine, possibly due to a measure by Yahoo Mail to remove such ...


2

I'm going to bet it's fake. If it's a real Amazon password reset demand, then you should be prompted to change your password at next login, not need to follow all those steps. You can also check: does your old password work? Does the temporary password work? If no/yes, then it's real. If yes/no, then it's fake.


0

Normally you protect your LDAP from anonymous access, so all request are being done from a account, not just a request fired at a server. Also while LDAP is a standard (that has withstood the test of time as HTTP and SSH have) its structure however is not 'standard' there are many ways to implement where and how a user authenticates, both in field names ...


1

I agree with the other two answers provided, but there are a couple of other benefits, when SSO is implemented correctly. Users enter their password less often Users don't have multiple passwords to keep track of Users are presented with a single login page, and they know what it looks like When users don't have several different login pages to go to, ...


1

TLDs (top level domains) are allowed to have certain restrictions based on location, the type of content, and the domain names. It is not surprising that they'd block it to avoid confusion on the domain name's owner which would appear to many as being the same as .lk.


0

Newer forms of SSO, such as OAuth2, do not do anything more than provide a secure token for the client to use to verify if a user is actually authorized successfully. It does not leak their username, password, or anything else. It's simply an assertion that, according to the identity provider, it is a real user by whatever means they've proved themselves, ...


1

LDAP should only be used on an internal network. Therefore, all services using it should be on the internal network, and should be secured from outside access. In fact, you should make sure you have specific firewall rules in place to prevent LDAP access from the Internet, nor should you try to use LDAP on a website on the Internet. It's simply not secure ...


0

The idea behind SSO is that it prevents the user from having to enter credentials more often, thus reducing the potential attack surface. Notice that it does say can reduce phishing. It also helps eliminate another pretty common issue: people writing passwords down and leaving them in plain sight (if they only have one to remember, they're less likely to ...



Top 50 recent answers are included