|
|
|
I'm updating this one to blocker as it could prevent people from accessing their accounts and result in linden theft.
A similar situation occurs when creating a new account...my anti-phishing/anti-spyware notifies me that the security certificate belongs to a third party site (vresp.com) and issues a caution. Makes it look like the whole Second Life registration process has been hacked by scammers.
These are good points. Thanks for taking the time to raise them here.
Already, I know Yoz Linden has contacted Vertical Response (the aforementioned vresp.com, which we do mass emails through) to clarify the authenticity of future sent emails. I'll import this and get Yoz's attention on it. Linden Lab sent out another email today to select residents regarding the same issue - namely, requesting that recipients update their billing information. We hope that this email will set off the mental phishing filters of far fewer people. Here are a couple of the things we did this time that should make a difference:
1: Started the email by referencing the resident's avatar name. The combination of email and avatar name is (unless explicitly revealed by the resident elsewhere) only known by us. Both of these actions were recommended by Yumi Murakami and others - thanks! Unfortunately, one of the changes we weren't able to make was the email address specified in the From: header. This still uses the vresp.com domain, due to Vertical Response's own restrictions. If the feedback from this mailout shows that this is still a major issue, we'll pursue it more actively. I'm not going to mark this issue "Resolved" yet, nor blog about it, because it's still in progress - the feedback from this mailout will give us much more information about what more is needed, or if we're already on target. If you receive one of these mails, do let me know what you think! Linked to
Another useful thing which you guys at Linden Lab are pretty good about doing to establish the non-phishiness of your emails is to write everything in good English. For whatever reason, phishers and spammers are rarely if ever capable of writing even a few sentences of understandable and grammatically correct English prose, even though they have amazing technical skills and are very clever (in an evil way.)
How about confirming what the email says on the account page, if the details need updating, send the email and also have the web site place a message on the user's account page on the site. If this doesn't happen already couldn't this also help?
Possible solution could also include having the e-mail containing a numeric code which is also listed on the SL account page for the avatar. If the codes don't match, the mail should be considered phishing.
Reasoning : while a scammer can fake a LL or Vertical Response mail, it's much harder to both fake the mail and the account page at the same time. For now, using resident names, the SL logo, and making sure all links point to secondlife.com has seemed to mostly clear up questions about whether the email is official. Other suggested improvements would be nice to have, but aren't currently critical.
issue description reads as feature request, not bug.
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
|
New Feature
In Progress
Nice to have
Provide guidelines for authenticating e-mail claiming to be from Linden Lab
Rather than linking to any webpage, users should be directed to the main secondlife.com front page and given directions from their (e.g. click on Accounts from www.secondlife.com