@briankrebs the only way this email will be improved is if some product manager comes up with a new SKU you have to rent in perpetuity to get those better email notices.

Perhaps those assholes can also make a "Useful Debugging Output In The Web UI P1" SKU for Intune whilst they're at it.

Neither will be included in E5.

@briankrebs usually the only way I can identify these sketchy but legit emails is because of my longstanding practice of making up single purpose email addresses. How otherwise would I determine PayPal really wants to give me $5 and not a scammer who scraped/stole my address?

Anybody less technical is lost. As shown by the constant questions I get from my parent.

@briankrebs I thought that was the goal--conditioning people to fall for phishing so it's their fault rather than admitting any culpability or complicity.

Like how *we're* supposed to "watch out for" paper-thin credit card skimmers that intercept cleartext secrets stored in public formats.

@briankrebs > How hard would it be for Microsoft to include just a tiny bit more information in each message?

I don't know specifically about Microsoft, but from my experience it could be quite hard indeed. Not technically, but organisationally: marketing teams often use their own systems with very loose coupling with production systems, and any non-trivial export needs a lot of extra legwork. CSV files are involved.

@briankrebs
Tangent on training people to fall for phishing scams. Piss poor phishing emulation programs.

Congratulations: you've gotten people to fall for a highly specific link that is an internal email from a legitimate HR account that has no external banner like you've trained people to look for, have no reporting and review mechanism for end users to get help checking unclear emails, and then rick rolled them.

If HR is pwned there is so freaking little my account has to offer an attacker. And under some vague circumstance there was... WTF WOULDN'T YOU WALK THROUGH THAT SCENARIO instead of a lazy ass rick roll?

Corporate email and communication etiquette is so brain dead in general I'm surprised anything of value ever gets accomplished.

@briankrebs I just got something like this as well and thought if it is some kind of phishing.

In my case it was referring to some Azure test account I created years ago.

I got confused as well and was in fear my whole MS account is in danger ... But I think it's fine.

What a sketchy mail they created😂

@briankrebs I've got one basic rule: When I receive a mail that could or could not be phishing, I visit their page, login and check from there. I recently got a message from Dropbox telling me that there are problems with my credit card - and it really looked phishy. Luckily after logging in there I saw the same message.

I really don't understand why companies often don't refer to their pages to validate the mail from there.

@briankrebs I suspect that it is done intentionally, precisely so that someone who receives the email can't social engineer their way in.

What they need is a zero knowledge proof, but I can't imagine what that would even look like.

@briankrebs You can tell it's genuine Microsoft because a real scammer would never be so evil as to require you to make a repeat purchase every 200 days or withhold access to your data.

Even cryptolockers only charge you once 😆

@briankrebs In a related item, I would like to see a general trend away from legitimate emails encouraging individuals to click on anything in the email. Instead, give clear instructions and short URLs that users can navigate to on legitimate and well known sites (Like... https://www.microsoft.com/EntraID?)

Doing so would hopefully reduce the FOMO related to emails that *sound* legit but aren't...

@briankrebs we have failed to get people signing and encrypting emails. gpg smime whatever it is nobody cares.

but the largest relays on earth are mostly using opportunistic tls for negotiation between MTAs.

are email vendors and platforms started to use that telemetry as attestations? though a bad dns change to dmarc or exploiting with RCE could send what would be a legitimate looking email from a vendor too, and be more dangerous due to aura of credibility. 😭