Feature: Use best security practices with the alert email “Use of breached password detected”
Description: The breaches password detection is useful but please consider that:
- email was not from auth0.com (which is suspicious).
- All email links were to a third party domain(sendgrid), obscuring the actual link location (more suspicious).
- Multiple emails in the “to:” field (the best practice is one email for each user).
- A call to action based on the links in the email (the best practice is not to include links but include instructions).
All of them aren’t security’s best practices.
We hope you can fix these mistakes soon.
Use-case: When a breached password is detected and you send the alert email related