14

I've just received a email from SO titled "ACTION NEEDED: We are deprecating OpenID suppoort".

I haven't used OpenID as the login method for my account if memory serves me right. Besides, the impolite feeling of the urgency expressed in CAPITAL and boldface makes me wonder if that email is legit and if one should click the link provided to "add an email and password credential to your account".

So, has anyone else received this? Is this legit or phishing?

4
  • 6
    Cross site duplicate: meta.stackexchange.com/questions/307647/…
    – Servy
    Commented Jun 27, 2018 at 18:02
  • 1
    Did the email not link to the announcement above? I'd be pretty shocked if the email didn't actually link to that page.
    – Servy
    Commented Jun 27, 2018 at 18:03
  • Yes, it does. I was searching the account pages looking for that announcement. A link notification placed in "My Logins" or "Settings" would be a good idea, maybe?. Thank you very much for your prompt reply and link.
    – dpant
    Commented Jun 27, 2018 at 18:10
  • Have you checked mail headers? Yes, i know they can be faked, too. But not at least the last one, your mail server is writing, might be okay). And have you checked link target? Most scam mails try to send you to a faked website (e.g. stackoverflow.com.some-bad-site.example) to phish your login data.
    – Roland
    Commented Jul 9, 2018 at 9:00

2 Answers 2

16

Yes, there is a legitimate email going out to all users with OpenID credentials attached to their account that will be expiring and will lock them out of their account.

You previously only ever used the Yahoo option for login, which despite having a simplified workflow in our login system, is an OpenID provider that will no longer be available in the future. That is why you got the email. It looks like you've already added another credential that will function in the future.

7
  • 23
    How can you say it is legitimate when you don't know where that message came from. It could be a copy word by word of the legitimate email message, with the links changed for phishing. Commented Jun 28, 2018 at 6:53
  • 6
    @DanielGasull If animuson knows that an email that was sent out, and the OP had independently received a phishing mail, then the OP would have received two messages, not one, right? Since the OP has only received one, must it not be the one that came from SO?
    – user743382
    Commented Jun 29, 2018 at 9:33
  • 4
    Even if stackoverflow did send out these emails, that was a perfect opportunity for phishers to jump to action and add their emails to the mix. I would say, stackoverflow handled it poorly: they should not have included any links in the email in the first place. Also the expressed sense of urgency does not add credibility to the email.
    – crosser
    Commented Jun 29, 2018 at 9:40
  • 1
    Funny thing is, I used OpenID on SO at some point and it is still there among my list of logins below preferences, but I haven't gotten this e-mail. Does it only go out to those who have no other means of login?
    – Lundin
    Commented Jun 29, 2018 at 10:01
  • @Lundin Yes, it's meant for people who will get locked out of their account if they don't take action.
    – animuson StaffMod
    Commented Jun 29, 2018 at 13:13
  • I need openid to connect to data.stackexchange.com. What can I do to keep my SEDE account?
    – Cœur
    Commented Jul 1, 2018 at 3:13
  • We're still working on a solution for SEDE. I'm not familiar with what exactly is going on to make sure that's still supported.
    – animuson StaffMod
    Commented Jul 1, 2018 at 3:14
12

I got an email too. It comes from stackoverflow.email, and all the links go to sg-links.stackoverflow.email, without HTTPS.

And look at this:

$ curl https://stackoverflow.email/ -I
HTTP/2 302  
cache-control: private
content-type: text/html; charset=utf-8
location: http://email.stackoverflow.com/

And when trying to access by HTTPS:

This server could not prove that it is sg-links.stackoverflow.email; its security certificate is from *.sendgrid.net. 
This may be caused by a misconfiguration or an attacker intercepting your connection.

This looks like phishing.

9
  • 6
    This may be related: meta.stackoverflow.com/questions/360071/…
    – BoltClock Mod
    Commented Jun 28, 2018 at 8:28
  • 12
    Not sure why all the downvotes... first of all, it's a plausible scenario and secondly it seemed to be well-researched.
    – Christian
    Commented Jun 29, 2018 at 1:26
  • @Christian: Given that an SO employee confirmed its legitimacy, a sudden hypothesis that this looks like phishing is thoroughly worthless.
    – Makoto
    Commented Jun 29, 2018 at 3:12
  • 2
    @BoltClock It's ~1 year old and still not fixed....
    – user202729
    Commented Jun 29, 2018 at 3:20
  • 9
    @Makoto, how can the SO employee confirm the legitimacy of an email without looking at the headers of the email, not even asking for the address in the From header? Se my comment here: meta.stackoverflow.com/questions/370220/… Commented Jun 29, 2018 at 6:39
  • 3
    @Makoto: It's not a "hypothesis": this does look like phishing. The fact that it probably isn't tells you everything you need to know about the SE mailer system.... Commented Jun 29, 2018 at 10:35
  • 1
    You're making a whole lot of fuss about nothing. The question asked if such an email was sent out, and an employee answered that indeed such an email was sent out. Whether or not the specific email was real, doesn't matter.
    – user247702
    Commented Jun 29, 2018 at 10:50
  • @Stijn, that's not what the question asked. The question asks whether the email is real or not, and implicitly whether it's safe to click the link. Commented Jun 29, 2018 at 10:57
  • 1
    @PeterTaylor Sure, if you take it literally, that's what it asks...
    – user247702
    Commented Jun 29, 2018 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .