I do agree that they’re patting themselves on the back a bit too much and also should have been a bit more humble when dismissing things as password reuse.
I would want some follow-up answers, to questions like:
- Why would a bug trigger alerts that are as severe as "someone else tried to use your unique not-used-elsewhere master password"? I understand bugs, even severe ones, happen- but can I trust that your alerts aren't going to cry wolf on my account going forward?
- Why did you originally conclude it was credential stuffing/reuse, when there are a number of people that got the alert that clearly stated they had never used their master password anywhere else? Are you monitoring user reports / social platforms / etc to respond to and address these situations?
- When you say "some" were triggered in error- does this mean some of the attempts were legitimate, or were they all due to a bug? Do you even know the answer to this question? If there are legitimate attempts on non-reused-password accounts, it appears master passwords are leaking/being captured/etc in some other way and that deserves further investigation
I just want more than a sentence or two surrounded by 10+ paragraphs of "this happened because of how good we are at keeping you safe"