How come the ‘from’ address is a @getalby.com email? Did they break into your server?
Discussion
Reset password email will come from alby since it was requested from their website.
They don't break any server, by using your public alby address in nostr, they just requested a password reset. This is not scam email, it's real email from Alby. The hack consists of that they can get your email from your Alby address, but to do so they have to trigger password reset. Everything is pretty safe, don't worry. Just make sure use strong passwords and have in mind for any incoming emails with email address connected to Alby account
that's correct. and we're very sorry this happened. we couldn't filter all requests and reset emails have been requested.
that email can be ignored and for additional security we now also enforce login with an one time token.
It's definitely unpleasant that it happened. But one must be careful on the internet. I personally, using tools to check for data leaks, have seen emails leaked from other much bigger companies and software. That's why personal culture regarding cybersecurity is an important thing. I'm also 99% sure that a large part of these emails have already been leaked somewhere else. That's why it's good to use email masking services.
yes, many requests we see originate from emails that also don't have accounts with Alby. There are many brute force attacks out there in the wild internet sadly.
Using alias email addresses like the ones proton offers is encouraged.
The transparency is a good start, but you haven't covered the case where a) an unique email address was used that only Alby had and b) wasn't used as lightning address visible anywhere publicly
The old logo is so cute. That’s all. I’m done.