I have an e-mail address at a certain institution. A few days ago they sent me an e-mail (in German), which I'd like to paraphrase without revealing the institution:
Dear Madams and Sirs,
a new identity management system has been introduced at the ... Together with the new system, a new password guideline came into effect. Thus, it is now necessary for every user to have his current password checked by the new system.
You will soon receive a personified e-mail with instructions on how to confirm the password via the webpage of the [name of IT department] of the ... (Web: [website of IT department] -> ... -> [confirm password])
We point out that at no point in time we will ask you to send your login or password via e-mail or to change or confirm your password on any other webpage than
https://idm...Communication with that webpage is always encrypted (https). You can check if the webpage indeed belongs to ... by clicking the lock symbol in the status bar of your browser. The fingerprint of the certificate is ...
In case you are still unsure whether the above request has in fact been sent by the ..., please contact the help desk. (Web: [website of IT department] -> [Services] -> ...)
Yours sincerely, ...
Now this does not look like a phishing e-mail to me, and a collegue has in fact contacted the help desk: they confirmed it was our IT department who sent the e-mail.
What I'd like to know is whether sending the above e-mail was appropriate. They told my collegue that they had to do this because of a new hash algorithm they're about to use. I understand that they can't produce the new hashes from the old ones, but I still think that doing it via such an e-mail is very strange at best: it just makes users more insecure when the next real phishing e-mail arrives. What I find particularly dubious is the direct link to
https://idm... in the e-mail!
What I would have expected in such a case: The IT department just sends a request that every user changes his e-mail until this and that date. Would that be a better approach? Or was the IT departments approach better?
Update: They sent the "personified e-mail" a day later. It contained two pieces of new information:
- The sentence "The password has to be changed if it doesn't confirm to the new security rules",
- a date until when I'll have to confirm my password.
newhash(salt, oldHash(salt, password))which allows in place upgrades. Then upgrade to a clean hash on the next login. | If most of the users login regularly one can simply upgrade on login without chain hashing.