SophosID is Migrating – Please Log in With Your SophosID

Hey all. I'm going to answer a bunch of your questions in one fell swoop so get comfy as this will be a long one :)

Totally get where you're all coming from regarding the subject line. To be honest, there wasn't going to be a decent way to get the message across. Needing to ask people to log in is _always_ going to look a bit phishy. The constant barrage of phishing emails I'm sure we all end up receiving does train us to be very wary of ANYTHING asking us to log in.

I'm really proud to see a lot of people used their noggins and googled instead - that's exactly what I would have done! We put the various blog posts out there for this exact reason. Also, we avoided putting direct links to the login portals in the email, instead pointing people to this very Community article instead. We did use our URL shortener soph.so but a whois will show that registered to Sophos HQ in the United Kingdom.

SophosID is an identity used to log into various Sophos properties but it is not directly connected to your Sophos Central (previously known as Sophos Cloud) account. The only exception is when you're a partner as you'll be using your SophosID to log into the Central Partner Dashboard via the Sophos Partner Portal.

The list at the bottom of the blog post is pretty much the exhaustive list of things that use SophosID.

You only need to log in once and it doesn't matter what computer you do it from. SophosID is not related to your endpoint protection, instead it's used for things like licensing, support, forums, training portal, etc.

This will not affect your endusers. This is just related to you and your account. You might have received this and been confused as you don't use Sophos. Likely, at some point in the past, you created a SophosID if you were using our on-premise products (maybe for a trial or you owned them) as we do all the downloads and licensing via MySophos. Or maybe you joined our forums to leave a comment. The list of applications above will hopefully give you an idea what you signed up with us for.

The domain spoofing that John Coates mentioned is likely due to the email system this was sent from was not in sophos.com's DNS. I'll dig into this so thanks for the heads up.

Password manager issue, likely a GET somewhere on the page that is triggering a basic security check it performs. All authentication is done over an encrypted TLS session so there's nothing to be concerned about.

For a little more insight into why we had to ask people to do this - we're changing our backend identity provider. As we store all customer/user credentials securely, we have no way of accessing the plaintext passwords of our users (for jolly good reason!). To create a new identity for you in the new provider, we need you to successfully log in using your SophosID (authenticating against the old provider). We can then use the provided credentials to create a new identity in the new provider and securely (cryptographically) store those credentials.

We've been doing this migration silently for the past few months and this email was sent to help push us over the finishing line and finish getting everyone migrated. When we turn off the old identity provider, we're not going to be able to validate the credentials you provide when you log in. Therefore a password reset is required so that we can validate you are in control of the account you registered with and we can get you created in the new identity store.

If you've read all the way to the bottom - bravo! Thanks for taking the time and I hope this has helped you understand a little more about this migration.

If you need a little pick-me-up, a chuckle, and some security news, we're trying to stay our usual silly and up-beat selves on the Naked Security podcast (soundcloud.com/sophossecurity). We don't do advertising or anything, it's literally just our way or providing a little entertainment that is suitable for "work" :)

It goes without saying - please stay strong and look after yourselves and your health. My heart goes out to all of you right now. With everyone isolating, working from home/remotely, and so on, the pressure you must be facing to keep your businesses IT running must be immense. IT admins, SOC team members, general blue-team superheroes, and everyone knee-deep in cat5e cables, I salute you.

- Greg

Hey all. I'm going to answer a bunch of your questions in one fell swoop so get comfy as this will be a long one :)

Totally get where you're all coming from regarding the subject line. To be honest, there wasn't going to be a decent way to get the message across. Needing to ask people to log in is _always_ going to look a bit phishy. The constant barrage of phishing emails I'm sure we all end up receiving does train us to be very wary of ANYTHING asking us to log in.

I'm really proud to see a lot of people used their noggins and googled instead - that's exactly what I would have done! We put the various blog posts out there for this exact reason. Also, we avoided putting direct links to the login portals in the email, instead pointing people to this very Community article instead. We did use our URL shortener soph.so but a whois will show that registered to Sophos HQ in the United Kingdom.

SophosID is an identity used to log into various Sophos properties but it is not directly connected to your Sophos Central (previously known as Sophos Cloud) account. The only exception is when you're a partner as you'll be using your SophosID to log into the Central Partner Dashboard via the Sophos Partner Portal.

The list at the bottom of the blog post is pretty much the exhaustive list of things that use SophosID.

You only need to log in once and it doesn't matter what computer you do it from. SophosID is not related to your endpoint protection, instead it's used for things like licensing, support, forums, training portal, etc.

This will not affect your endusers. This is just related to you and your account. You might have received this and been confused as you don't use Sophos. Likely, at some point in the past, you created a SophosID if you were using our on-premise products (maybe for a trial or you owned them) as we do all the downloads and licensing via MySophos. Or maybe you joined our forums to leave a comment. The list of applications above will hopefully give you an idea what you signed up with us for.

The domain spoofing that John Coates mentioned is likely due to the email system this was sent from was not in sophos.com's DNS. I'll dig into this so thanks for the heads up.

Password manager issue, likely a GET somewhere on the page that is triggering a basic security check it performs. All authentication is done over an encrypted TLS session so there's nothing to be concerned about.

For a little more insight into why we had to ask people to do this - we're changing our backend identity provider. As we store all customer/user credentials securely, we have no way of accessing the plaintext passwords of our users (for jolly good reason!). To create a new identity for you in the new provider, we need you to successfully log in using your SophosID (authenticating against the old provider). We can then use the provided credentials to create a new identity in the new provider and securely (cryptographically) store those credentials.

We've been doing this migration silently for the past few months and this email was sent to help push us over the finishing line and finish getting everyone migrated. When we turn off the old identity provider, we're not going to be able to validate the credentials you provide when you log in. Therefore a password reset is required so that we can validate you are in control of the account you registered with and we can get you created in the new identity store.

If you've read all the way to the bottom - bravo! Thanks for taking the time and I hope this has helped you understand a little more about this migration.

If you need a little pick-me-up, a chuckle, and some security news, we're trying to stay our usual silly and up-beat selves on the Naked Security podcast (soundcloud.com/sophossecurity). We don't do advertising or anything, it's literally just our way or providing a little entertainment that is suitable for "work" :)

It goes without saying - please stay strong and look after yourselves and your health. My heart goes out to all of you right now. With everyone isolating, working from home/remotely, and so on, the pressure you must be facing to keep your businesses IT running must be immense. IT admins, SOC team members, general blue-team superheroes, and everyone knee-deep in cat5e cables, I salute you.

- Greg