They allow to check if your own email address is part of this (or an older) list, which works like that:
- Enter an email address at https://www.sicherheitstest.bsi.de/
- After submission, they show a four-digit code.
- If the entered email address is NOT part of the list: Nothing happens.
- If the entered email address is part of the list: The BSI sends an email to the entered address, which
- is signed with their OpenPGP key, and
- contains the four-digit code in the subject line.
- (The mail doesn’t contain the password.)
The OpenPGP signature and the code in the subject line make sure that the email is really coming from the BSI (phishers already send emails in the name of the BSI).
But besides that, is this process really a good practice?
As far as I can see, it has two problems:
- It’s not known if the list contains logins for email providers or for other sites (shops etc.). But if these would be logins for the email accounts (or if people use the same password there), the thiefs could control the email account and filter out any email coming from the BSI, right? So these people would never notice that their data is contained in BSI’s list.
- So people that don’t get a mail can’t be sure if their data is not in the list or if the mail got intercepted (unless they change their password before even entering their email address in the test).
- And as they don’t send the password contained in the list, users (that use unique passwords for each site) can’t know which of their accounts are affected (→ many sites use the email address as username).
- So people would have to change their passwords on all sites using their email address as username.
Am I right? Or are there good reasons why they handle it like that?
Could the process be improved? Are there any best practices for such situations where the data of many different services is involved (and not only from a single provider)?