Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

Question

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft.

They allow to check if your own email address is part of this (or an older) list, which works like that:

1. Enter an email address at https://www.sicherheitstest.bsi.de/
2. After submission, they show a four-digit code.
3. If the entered email address is NOT part of the list: Nothing happens.
4. If the entered email address is part of the list: The BSI sends an email to the entered address, which
   • is signed with their OpenPGP key, and
   • contains the four-digit code in the subject line.
   • (The mail doesn’t contain the password.)

The OpenPGP signature and the code in the subject line make sure that the email is really coming from the BSI (phishers already send emails in the name of the BSI).

But besides that, is this process really a good practice?

As far as I can see, it has two problems:

• It’s not known if the list contains logins for email providers or for other sites (shops etc.). But if these would be logins for the email accounts (or if people use the same password there), the thiefs could control the email account and filter out any email coming from the BSI, right? So these people would never notice that their data is contained in BSI’s list.
  • So people that don’t get a mail can’t be sure if their data is not in the list or if the mail got intercepted (unless they change their password before even entering their email address in the test).
• And as they don’t send the password contained in the list, users (that use unique passwords for each site) can’t know which of their accounts are affected (→ many sites use the email address as username).
  • So people would have to change their passwords on all sites using their email address as username.

Am I right? Or are there good reasons why they handle it like that?

Could the process be improved? Are there any best practices for such situations where the data of many different services is involved (and not only from a single provider)?

Answer 1

I think this is a matter of degree. The list will help many people but maybe not everyone. However, if someone already has control of your email you have bigger problems anyway.

It is better than not being able to find out at all though as at least the majority of people will be able to find out and change their details if needed.

The only improvement I can think of would be to have a pre-confirmation first. You put in your address, the system sends you an email with a code you haven't seen. You enter the code and that confirms that you have some level of control of your email address. Then it sends the information. Any hacked account would then need more sophisticated monitoring and filtering to let through the first email but not the second. Hardly worth it for anyone to do.