So what they are saying is that SendGrid should have had two-factor auth and this would have never happened.
Security Hole in Sendgrid
11–20 of 97 posts
Re: Security Hole in Sendgrid
#12Another title for this submission could have been: "Massive Security Hole in ChunkHost. Non-2FA accounts can be owned." Because it turns out anyone with a Sendgrid Support account also effectively had potential access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services. SendG…
I don't see how this was specific to ChunkHost, or how anybody else using SendGrid and supporting password resets through email wouldn't be vulnerable to the same attack... Since presumably password reset emails aren't outside SendGrid's target market, it seems reasonable to suggest that this is a problem SendGrid should try to fix.
Re: Security Hole in Sendgrid
#13Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.
Is sending emails yourself as easy as changing two lines of code in your app? That's what it took to integrate Mandrill for me. If you think that's as hard as sending email yourself, you are wrong.
Re: Security Hole in Sendgrid
#14So what they are saying is that SendGrid should have had two-factor auth and this would have never happened.
SendGrid's policy (as stated in their first email) is that the support people shouldn't be changing account emails in this fashion. Even if SendGrid had 2 factor auth, who's to say the support guy wouldn't have just disabled that?
Re: Security Hole in Sendgrid
#15So what's the answer? Here's two very legitimate scenarios: 1) You sign up, enable two-factor auth, then lock yourself out (lost password and your second-factor). How do you prove to the service provider that you are you? 2) You sign up, enable two-factor auth, then Mallory claims that they locked themselves out. How does the service provider prove that Mallory is not you?
In this case, looping in the original email address on the SendGrid account before changing to a new one would have kept this from happening. SendGrid's support personnel should almost certainly not be able to change an email address without the change being signed off on through the old address first.
Re: Security Hole in Sendgrid
#16So what's the answer? Here's two very legitimate scenarios: 1) You sign up, enable two-factor auth, then lock yourself out (lost password and your second-factor). How do you prove to the service provider that you are you? 2) You sign up, enable two-factor auth, then Mallory claims that they locked themselves out. How does the service provider prove that Mallory is not you?
In this case, looping in the original email address on the SendGrid account before changing to a new one would have kept this from happening. SendGrid's support personnel should almost certainly not be able to change an email address without the change being signed off on through the old address first.
But what happens in those rare cases where that first account gets lost / locked permanently?
Re: Security Hole in Sendgrid
#17Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.
Yeah, it's not hard: until you want to reach mailboxes at some obscure providers like Yahoo or Outlook.
Re: Security Hole in Sendgrid
#18Another title for this submission could have been: "Massive Security Hole in ChunkHost. Non-2FA accounts can be owned." Because it turns out anyone with a Sendgrid Support account also effectively had potential access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services. SendG…
Are there any web hosting companies that don't rely on the "send a reset link to your email address on file" model of password resets? You're right, that model is deeply broken if anyone can intercept those emails (as happened in this case), but it seems unfair to single out ChunkHost for criticism.
[deleted]
Re: Security Hole in Sendgrid
#19Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.
Deliverability plays an immense part why people rely upon an ESP.
Re: Security Hole in Sendgrid
#20Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.
Yes, SendGrid sends emails, but there is value add on top of that. (e.g. negotiating with hotmail to ensure your emails get through, webhooks, APIs, statistics, templates, etc.).
Yes, sending an email is easy enough. It's all the other stuff we have services like this for.