Netflixreader comments 31
Share this story
You can hardly throw a stone at a major Internet company these days without that stone’s password and personally identifying data being hacked. Data breaches have become the norm, and for average Internet users, that means an increased need for vigilance.
On Wednesday, an unexpected e-mail alert from Netflix made me wonder if the media-streaming giant had become the latest victim of a giant data break-in. That wasn’t the case. Instead, I found myself facing rather the opposite scenario: a tech company offering proactive support. But did Netflix’s vigilant take on my account’s security tip over into scare-tactic territory?
“It is more like a heads up”
I began to prep a dinner on Wednesday evening when I saw an e-mail alert on my phone saying, “Netflix password reset required.” It’s the kind of notice that might make anybody toss their bottles of cumin and dill aside and rush to a computer.
Once at my desk, I opened up the full e-mail, which explained:
We have detected a suspicious sign-in to your Netflix account. Your Netflix account may have been compromised by a website or a service not associated with Netflix. Just to be safe and prevent any further unauthorized access of your account, we’ve reset your password.
As it turns out, my Netflix account password had not been automatically reset—and this alert e-mail itself even told me exactly how to initiate a password reset of my own. (I confirmed that my password had not changed by typing “netflix.com” into my browser and logging in, as opposed to clicking anything in the e-mail body.) Confused, I opened the e-mail’s source and pored through it, looking for any signs of suspicious URLs or fraud. Nothing. This looked legit.
I then checked both my device and viewing history, which Netflix’s Web interface makes easy to do. I found no use since my last Netflix binge a little over two weeks ago. I’d watched some stand-up comedy through my Vizio set’s pre-installed Netflix app—the last trace of verified activity.
Enlarge / Click to see the full e-mail. The incorrect part about my password being reset, the use of clickable links, and the other slightly dubious information combine to make this look a liiiiiittle bit like a phishing e-mail, in this author’s opinion.
A cursory Twitter search showed other users recently complaining to Netflix’s customer service team about a similar issue—what’s with the warning when my activity feed shows nothing?—and Netflix had officially directed those users to the company’s customer service livechat. I clicked through and was immediately connected to a rep. I asked him if some other activity had been noticed on my account.
“I don’t see any streaming in your account in the past seven days,” the rep, Alberto, wrote. “What we can do to make you feel more safe is to send you a password reset e-mail, and I can also deactivate all the devices that are now logged in your account.”
“Well, honestly, I would feel safer if Netflix didn’t send out false alerts like this,” I wrote in response. I pressed for more information as to what triggered a “suspicious sign-in” notice. After putting me on hold for some time, Alberto returned with this (unedited) explanation:
Thanks to you for holding.. I was checking on my end and confirmed that the system sometimes send an email from firstname.lastname@example.org that alerts customers about possible unauthorized access and recommends that they change the password for their account. This doesn’t mean that the account was compromised, it is more like a heads up and a recommendation to change the password to prevent that from happening.. Netflix takes our customers’ security very seriously, keeping your data safe is among our top priorities. While we can’t always say how an account was compromised, some common ways are phishing emails or unsecure websites. If you Click Here you will find more info about how to keep the account secure..
At first blush, I felt like this explanation didn’t quite mesh with what the alert had told me. Was there indeed a suspicious sign-in? If it’s possible that the account wasn’t compromised, then what’s going on here?
“Of course, I get your point,” Alberto wrote. “However, I can see that the email states only that a suspicions sign-in was detected and that the account may have been compromised, but I don’t think it’s confirming it. But I see what you mean and I totally get you.” He said he would “pass the word along” to Netflix higher-ups.
Have I been pwned?
I forwarded my chat log to Netflix’s press center, asking for clarification and comment on my experience. I received this reply from an unnamed representative:
This is part of our ongoing, proactive efforts to alert members to potential security risks not associated with Netflix. There can be a variety of triggers such as username and password breaches at other companies, phishing schemes, and malware attacks.
Without any follow-up information, my original question—what exactly triggered the notice?—went unanswered. And with Netflix’s official line in the mix, I began to understand why.
This is only a guess, but Netflix may very well be taking a seriously proactive approach by simply checking publicly available information about its users’ e-mail addresses. That could include searches at databases such as haveIbeenpwned.com, which make it easier to determine whether accounts assigned to known e-mail addresses have been exposed in any way. My primary, personal e-mail address pulls up over half a dozen hits at haveIbeenpwned.com, for example. (Thankfully, that site hasn’t found my personally identifying information (PII) in any “pastes” of user data; I blame that, in part, on my PII vigilance after a 2015 doxing.)
None of those accounts, nor any others in my possession, share a password with the one I use for Netflix. I went on a full 1Password code-generation spree nearly two years ago. Much as I wish I could go back to “disappointingbrodkin” as the password for my every account, those days are toast.
So it’s not like Netflix could have gone to some other database, pulled up a key ring of any exposed passwords, and tested them out like an old-timey prisoner testing keys in a jail cell’s lock. Instead, someone on its security team may very well have said, “We have enough data to believe that there’s even a 0.01 percent chance of an exposed password. That’s enough to warrant a red flag. Send the alert.”
My remaining concern is that the Netflix notice I received ultimately contains dubious information—at least, as far as I can tell. I pressed both the customer service rep and Netflix’s official press representatives for harder data about why exactly my account was flagged or whether some “suspicious sign-in” had absolutely been tracked, and I never got it. I’d like to think there’s an answer to my question that will satisfy my curiosity without exposing Netflix’s more brilliant account-verification tactics.
But while I am annoyed by that slight feeling of certainty and am bothered that the message said my password had been reset when it in fact had not, I suppose I should be happy Netflix is being too vigilant about my password security, as opposed to the other way around. But if Netflix’s notices are too vague or contain the kind of claims that we can quickly poke holes through, then it runs the risk of desensitizing users of all technical proficiencies. In other words, don’t make well-intended notices look like yet another phishing attack, and we’ll be cool, Netflix.