[Update: It’s real.]
Here’s the text of an e-mail I received this morning, purporting to be from the (excellent) backup service Mozy:
This message looks sketchy to me: no greeting, no signature, no contact information. The tech jargon reads as if its purpose is to baffle. There’s significant inconsistency: upgrade, update. And the strange underlining in that ominous final sentence: “Please accept the update request when it occurs.” Even the period is underlined.
This stern, cryptic message makes quite a contrast to Mozy’s shiny, cheerful newsletter-like e-mails to users. Here’s an excerpt from one such e-mail, one I received this morning, twenty minutes before the upgrade e-mail:
I can think of two ways to explain the upgrade e-mail:
1. It’s bogus.
Yet the e-mail appears to come from a genuine Mozy address. So:
2. It’s genuine, written by a tech-minded employee who wasn’t thinking about how the message might look to a lay reader.
At Mozy’s user forum, the authenticity of the upgrade e-mail has been an open question for eleven hours. How about it, Mozy? Will you tell your users whether this e-mail is real? And if it is, will you do better?
*
March 21: I went to Mozy chat support and found the answer: it’s real. Still no answer on the forum, but I suspect that will change soon.
Later that same day: Still no answer on the forum. Something I hadn’t realized: some users assume that the underlined sentence is a link (it’s not), which deepens their suspicion that the e-mail is bogus.
Tuesday, March 20, 2018
Mozy, sketchy
Subscribe to:
Post Comments (Atom)
comments: 2
For what it's worth, TLS 1.2 is a real thing, namely a security update which blocks certain recent exploits - it's a kind of great grandchild of SSL with extra bells and whistles, if you like. And yes, it is important that server operators enable TLS 1.2 and block earlier protocols, so we all feel safer. Your browser, if at all recent, will most likely already be using this by preference... so that just leaves internet-enabled applications that set up their own connection other than through a browser.
Now... that doesn't mean that this specific email you received is legitimate... just that whoever wrote it is basing it on sensible advice :) In your position I'd be cautious about the source, but the principles behind it are good ones.
Thanks, Richard. You have described the issue with a clarity that Mozy’s e-mail lacks.
I just looked back at the Mozy user forum and found that at least some users assume that the underlined sentence is a link, which deepens their suspicion of sketchiness. No response from Mozy yet on the forum thread.
Post a Comment