1

I have received many security emails from LinkedIn over the past few weeks. An example is shown below (redaction mine)

Josh Jackson

I do not live in the USA and I did not try to access LinkedIn at the times these were received.

Two things suggested to me that this could be a phishing email

  1. A slight grammatical mistake "to prevent anybody else from account." It seems unlikely to me that such a large company would make a mistake like this on such a vital email.
  2. "Change your password right away" encouraging me to take a sensitive action with some urgency

However, as far as I can tell, this is not a phishing email. All links appear to be legitimate and nothing else appears suspicious. I think this email message has been triggered by an "attacker" knowing my email address and trying to use it for passwordless sign in. Also, I changed my password by visiting LinkedIn independently, and I have still been regularly receiving these emails so it is unlikely they know my password.

My question is: assuming this email is legitimate, is it bad practice to prompt a user to reset their password when there is no evidence of a password breach? And what, if any, are the advantages?

I see two reasons it could be bad practice:

  1. It makes the user comfortable with following unprompted email links to reset their password and so might raise less suspicion in the case that there is a phishing email
  2. For those not using password managers, unnecessarily rotating passwords encourages easy to remember (and therefore, usually weak) passwords.

I can't see any advantage to asking a user to change their password immediately.

3
  • Welcome to the community. It might be that someone tried to generate a one-time sign in link for you, that means that your e-mail or similar got leaked apparently :/ Feb 5 at 22:11
  • 1
    @SirMuffington No, it is more wide spread then that, see reddit.com/r/linkedin/comments/193atde/…
    – Dijkgraaf
    Feb 13 at 20:03
  • Ohh I read it, so it seems it uses the e-mail before the change of e-mail address and in California and EU it would be a violation of privacy laws. Feb 14 at 9:59

2 Answers 2

1

This does look like a scam to me. And obviously you, as the person running a site with everything done right, should strongly avoid doing anything that looks like a scam.

You should give a warning like this when a user uses the normal login method. When I try to login to your site, and I have initiated the login, then I’m quite sure that I’m connected to you. If you have a site that people only login to once a month, you can send them an email asking them to login, but without any link. Maybe include an explanation: “Why did we not supply a link to reset the password? Because you cannot know it’s really us when you read an email, and you shouldn’t trust any links you receive in an email that you didn’t request, whether it looks like it is from our website, from your bank, or anyone else you would normally trust. Instead, go to our website, then login and change your password. “

I tried to use words that make it clear you can be trusted, but an email that claims to come from you could be sent by anyone. And the same goes for any company, so everyone are a bit safer.

0

In this particular instance it isn't a Scam, as the message does come from LinkedIn as I recently got one and verified the links were correct (not by clicking on them). See also the thread on Redit Getting ‘instant sign-in’ links from legit LinkedIn email address that I did not initiate, where someone verified that you can trigger that exact same email from LinkedIn.

However asking for a password reset and providing a link to reset it, that is a very bad practice, as it makes it more likely that the person will click on links to reset passwords in Phishing emails.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .