One is a proven issue. The other is a theoretical problem. Potentially real, but at this stage still theoretical. Both vectors do need to be addressed, but one is more clearly the pressing issue right now.
Also, since this thread has reached the minimum required length for compulsory inclusion of the appropriate xkcd, here it is
That’s not an entirely fair characterization. The inability to prove whether an electronic system has been tampered with is not theoretical, and is also a pressing issue. Saying you don’t need to plug the hole, because you haven’t seen anyone use it yet, even though it can’t be correctly audited is circular.
Yes, but Microsoft is a demon sent from the pits of Hell. Even if we bend the truth a bit, aren’t we still doing the Lord’s work? #liarsforjesus#thelordneedsourhelp#notactuallyomnipotent?
We moved from gmail to Office 365 email hosted by Microsoft. Since then I’ve seen this exact same attack make it through their spam/malware filters every single day. Another variant purports to have a secure file awaiting the recipient where it takes them to a fake office portal to have them log on.