Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
Thanks, Christopher
On Tue, 2022-01-11 at 11:58 -0500, Christopher wrote:
Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
On 11/01/2022 18:03, Yaakov Selkowitz wrote:
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
How I interpreted it, and how most websites do it, is that the unique link just verifies the email address (or any other non-critical action), but doesn't log you in.
Arthur
On Tue, Jan 11, 2022 at 12:10 PM Arthur Bols arthur@bols.dev wrote:
On 11/01/2022 18:03, Yaakov Selkowitz wrote:
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
How I interpreted it, and how most websites do it, is that the unique link just verifies the email address (or any other non-critical action), but doesn't log you in.
Exactly! Yes. That's what I was saying.
In this case, the situation is even sillier, because the non-critical action here is to "take no action". Taking no action is the least critical action you could take in this situation!
On Tue, Jan 11, 2022 at 6:04 PM Yaakov Selkowitz yselkowi@redhat.com wrote:
On Tue, 2022-01-11 at 11:58 -0500, Christopher wrote:
Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
An entity intercepting and reading your email should already be capable of anything besides installing your drivers (https://xkcd.com/1200). Is FAS somehow resistant to the "forgot password" button clicking "attack"? How?
On Tue, 2022-01-11 at 18:15 +0100, Alexander Sosedkin wrote:
On Tue, Jan 11, 2022 at 6:04 PM Yaakov Selkowitz yselkowi@redhat.com wrote:
On Tue, 2022-01-11 at 11:58 -0500, Christopher wrote:
Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
An entity intercepting and reading your email should already be capable of anything besides installing your drivers (https://xkcd.com/1200). Is FAS somehow resistant to the "forgot password" button clicking "attack"? How?
A FAS account with 2FA turned on is.
On Tue, Jan 11, 2022 at 1:53 PM Adam Williamson adamwill@fedoraproject.org wrote:
On Tue, 2022-01-11 at 18:15 +0100, Alexander Sosedkin wrote:
On Tue, Jan 11, 2022 at 6:04 PM Yaakov Selkowitz yselkowi@redhat.com wrote:
On Tue, 2022-01-11 at 11:58 -0500, Christopher wrote:
Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
You want anyone who receives or intercepts those emails to be able to access your account *without* logging in?!?
An entity intercepting and reading your email should already be capable of anything besides installing your drivers (https://xkcd.com/1200). Is FAS somehow resistant to the "forgot password" button clicking "attack"? How?
A FAS account with 2FA turned on is.
Because FAS asks for password and 2FA, 2FA-enabled accounts would still be vulnerable to a phishing attack that was modeled after these legitimate emails, but using a spoofed FAS site.
On Tue, Jan 11, 2022 at 11:58:36AM -0500, Christopher wrote:
Hi,
Today, I received an email from fas@fedoraproject.org with the subject line "Fedora Account System: please verify your Bugzilla email address". This email has a unique link to accounts.fedoraproject.org.
Based on the context, it seems legitimate. However, I noticed that clicking the link will take you to a sign-in page asking for credentials to your account. That seems strange to me, because it already has a unique link that's associated with the verification of a specific email in a specific FAS account, so asking for credentials should be completely unnecessary here. Asking for credentials makes this appear to be a phishing attempt, because that's how a phishing email would behave (appearance of legitimacy, requesting credentials when not needed).
I think the FAS developers should remove the requirement to sign-in for these verification emails, to reduce the appearance/behavior of phishing. The email itself says these emails are "To improve security". If that is a goal, then Fedora systems should avoid training users to supply credentials when not needed.
This was a one off thing, which I suggested we do to be nice and avoid problems for people, but perhaps it was misguided and we shouldn't have done it.
We moved to a new account system last year, and it has a 'bugzilla' field. Unfortunately, we didn't have cycles to start actually using that field at the time we switched. Shortly after we started looking into using it, but we realized that there was no validation for it. This wouldn't be acceptable, so we implemented a verification setup on it that was much like the one for the primary email address.
However, 161 people had entered email addresses that were not their primary ones. We were going to just clear them all out and announce that folks with these should reenter and validate them, but I suggested we could simply trigger a validation cycle on them. That would likely have more folks see the email and validate it, where they might miss a announcement.
Anyhow, this was a one time script thing, it won't run again.
kevin