Re: Poorly worded e-mail instruction from mozilla to change passwords, if it is genuine : Fwd: Second notice: LDAP password expiring.

Dear Daniel,

Thank you for the comment and clarification.

On 2016/04/09 3:35, Daniel Holbert wrote:
> Thanks for bringing this up!
>
> I think the bottom line here is the following: in emails that go out to
> non-MoCo/MoFo employees, we should *never* be linking to Mana (MoCo's
> HR/internal-ops wiki).
>
> MoCo employees are familiar with Mana and the Okta authentication site.
> But volunteers will not be familiar with them (and don't have access to
> them, I believe).

Right, I don't think I have an access to MoCo.
Believe it or not, I could go past the login window using the
newly reset LDAP account, but instead of seeing an ordinary
Wiki, I was greeted to create MoCo account, but when I followed the
instruction, I was kicked out basically the system says I am not 
authorised to use the application, etc. Very confusing.

> So, directing volunteers to Mana for "further
> instructions" on a password-reset will make them feel like outsiders &
> potentially cause worry about whether they're being phished.
Outsiders is OK because we are outsiders :-), but
the doubt whether if we are being phished or not is serious matter.

> Seems like some or all of this Mana page should move somewhere public
> (though probably *not* to a *publicly-editable* wiki, from a security
> perspective).  That way, non-MoCo employees with LDAP accounts can have
> access to it for instructions when they're resetting their LDAP
> accounts.  And just as important, the template for the LDAP-reset email
> needs to be fixed to point to that public resource rather than the
> MoCo-internal mana link.

This will be much appreciated by those who get confused a few years 
after the LDAP account was created and are notified to change LDAP 
password by an e-mail.

> I'm CC'ing mpoessy, who I think can get the right people's attention to
> look into this.  Thanks again for calling attention to this!
>
> ~Daniel

Thank you again for taking notice.
Until I verified by looking at URL bar, etc. that the first password 
reset URL seems to be genuine, I was very worried.

Chiaki

> On 04/08/2016 09:11 AM, ISHIKAWA,chiaki wrote:
>> Hi,
>>
>> I have no idea where to report
>> but I have a feeling that dev-planning is where I can point out that the
>> current
>> e-mail request sent by mozilla.org for LDAP password change leaves rooms
>> for improvement so that the improvement can be planned for the future
>> e-mails.
>>
>> Here is what happened:
>> I have received an e-mail that requests LDAP password change from
>> mozilla.org if I were to believe that it comes from mozilla.org by
>> looking at the From: line.
>> If it is genuine, the mail is not worded very clearly
>> to avoid misunderstanding. Many people may take it as phishing e-mail.
>> (Possibly that is why I can't find the first notice?)
>>
>> The following e-mail quoted below  came in today and requested me to
>> change my password at mozilla LDAP database. Initially, I have no idea
>> if this request e-mail is genuine or not. Why?
>>
>> Issue 1:
>>
>> It would be great that mozilla.org has an easy to access webpage on its
>> website, in its own .mozilla.org domain to make sure that the recipient
>> can check the authenticity of the e-mail: that mozilla.org does send out
>> such e-mails periodically to request the change of password with such a
>> wording, etc.
>> A single web page would at least assure such requests do come in.
>> As it stands, it is no different from phishing e-mail from bad guys to
>> log in to my banking account, etc. to change the password immediately
>> due to breach incident, etc.
>> (Also, I don't think I received the first request in the last few weeks?
>> Maybe I overlooked it somehow. Or it could have gone into spam folder?)
>>
>> Issue 2:
>>
>> If every URL involved in the process or in the accompanying text is
>> within .mozilla.org,
>> the recipient has more assurance that the e-mail is genuine.
>>
>> What compounded my uncertainty is this: naturally I wanted to check the
>> "further instruction" in the mentioned URL
>>
>> https://mana.mozilla.org/wiki/display/SD/LDAP+Password+Reset+Instructions.
>>
>> But when I accessed it, although it is supposed to be a wiki page for
>> MERE BROWSING of the instruction, it requested for me to log in using
>> the said mozilla LDP account (!) using an EXTERNAL authentication site.
>> If this is a phishing attempt, a perfect method to obtain the password
>> of an account holder.
>> The authentication URL is
>> https://mozilla.okta.com/login/login.htm?fromURI=%2Fapp%2Fmozillacorp_mana_1%2Fexk17bvb7gwCMzi161d8%2Fsso%2Fsaml%3FSAMLRequest%3DhZJbSwMxEIX%252FypL3NhvdbpfQFuouhUIVqZcHX0qMow3NzUy2Xn692S2V6oM%252BBU7mMOc7zASF0Z7P27i1a3htAWP2brRF3n9MSRssdwIVcisMII%252BS38wvV%252FxsmHMfXHTSaXJi%252BdshECFE5SzJls2UbOr8gtWL82JclixvRmNWVsVFvSiKipVNUVcku4eAaX5Kkj2ZEFtYWozCxiTlrBzkxSCvbtmIn1U8Lx5I1iQGZUXsXdsYPXJKjftUWouh20UxlM5Q4f1RlC74jRFWbBiF9x0bP%252B4fxy9v9eWnYiV7qiiiox0byWpnEbrVf0HKwxCXbQjpHSjjtZIqkmzhgoS%252B6yl5FhqhI7pOpag9fCvzY0fdstZAuIGwVxLu1qsTnhR3%252BA0VXqgBrZ2l3mFcA%252FouAplNutS8Ly3Mflsm9PR3cjiEq0SzbK5dCvzRxTXiH9hOUU%252BD536UxyAsqgSdMFKetzqAiAkthhYInR1W%252Fjy32Rc%253D%26RelayState%3Dhttps%253A%252F%252Fmana.mozilla.org%252Fwiki%252Fdisplay%252FSD%252FLDAP%252BPassword%252BReset%252BInstruction
 s%26SigAlg%3Dhttp%253A%252F%252Fwww.w3.org%252F2000%252F09%252Fxmldsig%2523rsa-sha1%26Signature%3Dd7OenOqyYW7ymUhf2mMArzLMSGdKwmXew4pQVXwh80ZDoekQxBG5soNEP94ZdML358zJj9zdXCcPuINI%252BRQcaoNP
 riT
>>
>> yXmjdxPVsHK5OgnIuUCXajUwI%252F0lNBytcYs4Sttd67dxsgvtVXFHnZTZme1s%252B8MQnN2meAE72otBrupgIl2smnOot5vLDLMWb7%252F0ZSBhDcU3j9o7TpskGIODsLw%252F%252B8zS1y0GKSNNdTu7%252Ft0u0feJe%252FsVePRHIx8OUMdl0FdzfK5LptiZ1lMH5Tol5QZcy3wJAQsIqUkPdzUDHHp%252FjWHrbGcZ2AJCHyIrPR0OwUcCiZ%252B1bdVzg6pm8DzBguA%253D%253D
>>
>>
>> (OK, some of you working on a single-signon type of application
>> immediately notices okta.com name, and think that this is a non issue.
>> But communication-wise, the current scheme sucks.)
>>
>> The easy to reach web page which I mentioned in Issue 1 should state
>> very clearly that
>> this okta.com site is used for mozilla log in to access (WHAT?) a
>> simple  instruction to
>> change our LDAP passwords.
>>
>> I wonder, though, if https://passwordreset.mozilla.org/ can do the
>> password resetting, why can't a similarsite INSIDE mozilla's domain can
>> let us log into the wiki page (?).
>> It is a little difficult to fathom the logic of the workflow, especially
>> the requirement to log in before one can read the change procedure.
>>
>> Maybe okta.com usage and such is a widely shared knowledge WITHIN core
>> mozilla employees, but for volunteer patch submitters, it is not. Well
>> at least this volunteer does not know it. Thus the announcement web page
>> discussed in issue 1 above.
>>
>> Anyway, unless a permanent web page that can be accessed without needing
>> to log in explains clearly  the flow of LDAP password change in a few
>> sentences and that we need to access certain EXTERNAL authentication
>> service to read the instruction (!?), a receiver of the request is not
>> quite sure whether he/she should follow this almost phishing-like e-mail.
>> The web page discussed in Issue-1 should mention the name of the
>> external service and URL clearly.
>>
>> Such additional information that allows one to cross-check the authenticity
>> goes a long way to trust such an e-mail request from mozilla.org.
>>
>> WELL, if the following is NOT a genuine request from mozilla.org, I bet
>> someone is trying to collect the passwords for mozilla account holders :-)
>> (Just kidding, but are you sure?)
>>
>> Of course, I checked that okta.com seems to be in business since 2010,
>> but I have never met someone who uses this service myself. Most of the
>> cloud services I use engage other authentication services, AND MORE TO
>> THE POINT, such services EXPLAIN THE USE OF EXTERNAL AUTHENTICATION
>> GATEWAY IN ADVANCE and in publicly accessible web pages(!).
>>
>> BTW, I noticed that the first URL, as far as my careful checking goes,
>> DOES come from mozilla.org domain and so I should be OK (?).
>>
>> In any case, requiring a login to access  the instruction to change
>> password is a bad design IMHO.
>>
>> I hope this comment can help someone to re-word the e-mail text and let
>> someone provide a single one web page for some paranoid account holder
>> like me to crosscheck the authenticity of the request e-mail to a better
>> degree.
>>
>> TIA and thank you for offering the great software products and
>> infrastructure to work together.
>>
>> PS: the use of PGP mail text with the PGP public key in a prominent web
>> page inside
>> mozilla.org domain might also add to the trust.
>>
>> ------- Forwarded Message --------
>> Subject:     Second notice: LDAP password expiring.
>> Date:     Fri, 8 Apr 2016 09:30:17 +0000 (UTC)
>> From:     [email protected]
>> To:     [email protected]
>>
>>
>>
>> Hi,
>>
>> Please change your LDAP password as soon as possible.  The password
>> change form is available at https://passwordreset.mozilla.org/.
>> Further instructions on changing your password are at
>> https://mana.mozilla.org/wiki/display/SD/LDAP+Password+Reset+Instructions.
>> Please remember
>> to log-out of all your current applications, before you reset your
>> password.  Your current password is set to expire on Thu Apr 14 19:00:00
>> 2016 in 6 days.
>>
>> Please note that you will be locked out of LDAP based services if you
>> do not change your password before this period.
>>
>> Thank you,
>> Mozilla SysAdmins
>>
>> p.s: This add-on can help you with changing all of your ldap passwords in
>> Firefox - https://addons.mozilla.org/en-US/firefox/addon/9652/
>>
>>
>>
>>
>>
>> _______________________________________________
>> dev-planning mailing list
>> [email protected]
>> https://lists.mozilla.org/listinfo/dev-planning