519
LinkedIn user data leaked: Database shows emails, profile data, phones, full names, and more confidential info.
(lemmy.world)
The same threat actor has leaked larger amounts of data from LinkedIn dated 2023. They claim this new data contains 35M lines and is 12 GB uncompressed.
well with PGP, the header is unencrypted. But even with just smtp, the issue is simpler.
Putting it in the header makes it more accessible.
various emails could have the header "Is this you?", and not all of them will hold a 2fa code, and even if they do, they may time out before you can find it and use it.
But if the email has the header: "Your secure 2fa code is 123456" from "noreply@example.com"
then unsurprisingly, logging into example.com with the user's email and that 2fa code is going to be a breeze.
Is there a single large company that even sends PGP email?
Sure, IF 1. you already have the user's password, and 2. a new code wouldn't be required/the previous code invalidated when initiating a new login session?
Like, I'm not saying that 2FA codes via email is secure, but you're implying that they are making a security hole via this - which I don't see.
Pgp, the greatest program never used by anyone
I used it. For about 10 minutes. Then I read the help files. Then I searched. Then I used it some more. Then I uninstalled it.