What is a potential outcome if Jaime had submitted the password reset form on the phishing site?

What is a potential outcome if Jaime had submitted the password reset form on the phishing site?

• A. They could use the new password to change the streaming service password on Jaime's account only.
• B. They could try using the old password and new password to login to Jaime's accounts on other sites.
• C. They could steal his social security number from the page.
• D. They could forward the password reset email to themselves.

Answer: (B)

The key idea here is that phishing is about stealing login information, and people often reuse the same passwords across multiple sites. If Jaime submits the password reset on a trick site and the attacker gets access to the new password (and possibly the old one), the attacker can try those same credentials on other sites where Jaime has accounts. Since many people use the same or similar passwords across services, this lets the attacker break into multiple accounts beyond just the one targeted by the phishing page. That’s why using unique passwords for each site and enabling two-factor authentication are powerful defenses. In short, once the attacker has credentials, they can attempt to log in elsewhere with those same credentials, which is why this outcome is a major risk of credential harvesting.

The key idea here is that phishing is about stealing login information, and people often reuse the same passwords across multiple sites. If Jaime submits the password reset on a trick site and the attacker gets access to the new password (and possibly the old one), the attacker can try those same credentials on other sites where Jaime has accounts. Since many people use the same or similar passwords across services, this lets the attacker break into multiple accounts beyond just the one targeted by the phishing page. That’s why using unique passwords for each site and enabling two-factor authentication are powerful defenses.

In short, once the attacker has credentials, they can attempt to log in elsewhere with those same credentials, which is why this outcome is a major risk of credential harvesting.