Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Hole in Sendgrid

chunkhost.com

Post reply on HN
Print view View original

21–30 of 97 posts

Re: Security Hole in Sendgrid

#21

Post by je42 »

callesgg wrote: post #8

Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.

Sending email is hard and for most people not a thing that provide them with a proper ROI, because among other things...

- You need to make sure that your email servers IPs are not on black lists.

- That you use DKIM properly

- your multipart mime encoding is correct

- bouncing e-mails are handled...

- take care of scaling & operating the servers

- and so on....

You can spent ( and waste ) a lot of time on this... especially if you are new to email sending..

Re: Security Hole in Sendgrid

#22

Post by toomuchtodo »

IgorPartola wrote: post #9
callesgg wrote: post #8

Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.

If you use EC2 or the like your IP address or the entire address block could have easily ended up on a spam list so your email will be blocked. I wish SendGrid was only necessary for people who sends lots of mail but the reality is that no cloy provider can guarantee that email from their IP addresses will be delivered.

If you invoke sending email through Amazon SES, it's free for the first 2K per day, due EC2 blocks being on spam lists.

http://aws.amazon.com/ses/pricing/

"You can send 2,000 messages for free each day when you call Amazon SES from an Amazon EC2 instance directly or through AWS Elastic Beanstalk."

Re: Security Hole in Sendgrid

#23

Post by hadoukenio »

uptown wrote: post #16
sanderjd wrote: post #15

Earlier quoted context omitted.

In this case, looping in the original email address on the SendGrid account before changing to a new one would have kept this from happening. SendGrid's support personnel should almost certainly not be able to change an email address without the change being signed off on through the old address first.

But what happens in those rare cases where that first account gets lost / locked permanently?

Yes, this is part of what I'm trying to get answers to.

Do you tell the user on signup to print an in-case-of-emergency-break-glass password which is only ever to be used to get into a locked account and other special circumstances?

It may seem over the top but seeing as it's unique across service providers, I think it's a hell of a lot better than the overly abused "what is your mother's maiden name" type questions. I consider these questions to be in the same boat as sharing passwords between websites (since they are)!

Re: Security Hole in Sendgrid

#24

Post by gtaylor »

je42 wrote: post #21
callesgg wrote: post #8

Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.

Sending email is hard and for most people not a thing that provide them with a proper ROI, because among other things... - You need to make sure that your email servers IPs are not on black lists. - That you use DKIM properly - your multipart mime encoding is correct - bouncing e-mails are handled... - take care of scaling & operating the servers - and so on.... You can spent ( and waste ) a lot of time on this... es…

> - You need to make sure that your email servers IPs are not on black lists.

This alone is a huge, huge chore. Especially if you run a hosted service that allows some user-specified content in outbound email bodies. It's a lot cheaper for us to pay Mandrill to handle all of that for us, provide us excellent metrics and diagnostics, and let us know if one of our users is sending junk mail before it gets out of hand.

Re: Security Hole in Sendgrid

#25

Post by jrochkind1 »

Meekro wrote: post #14
IgorPartola wrote: post #11

So what they are saying is that SendGrid should have had two-factor auth and this would have never happened.

SendGrid's policy (as stated in their first email) is that the support people shouldn't be changing account emails in this fashion. Even if SendGrid had 2 factor auth, who's to say the support guy wouldn't have just disabled that?

If their policy is that support staff should never be able to change an accounts email address... why does the system let them do it?

Re: Security Hole in Sendgrid

#26

Post by jtchang »

Social engineering will almost always work. I don't really fault Sendgrid for this (though I could see this not working as well if you were using Amazon SES...no support to even talk to!). It sucks that they got caught with their pants down but I bet a good social engineering attempt on ChunkHost might have yielded similar results.

The lesson here is to have multiple defenses. 2 factor auth is a great start and it worked in this case.

Re: Security Hole in Sendgrid

#27

Post by d357r0y3r »

uptown wrote: post #16
sanderjd wrote: post #15

Earlier quoted context omitted.

In this case, looping in the original email address on the SendGrid account before changing to a new one would have kept this from happening. SendGrid's support personnel should almost certainly not be able to change an email address without the change being signed off on through the old address first.

But what happens in those rare cases where that first account gets lost / locked permanently?

Require that the company submit a legally binding/notarized document before changing the e-mail address.

Re: Security Hole in Sendgrid

#28

Post by gtaylor »

toomuchtodo wrote: post #22
IgorPartola wrote: post #9

Earlier quoted context omitted.

If you use EC2 or the like your IP address or the entire address block could have easily ended up on a spam list so your email will be blocked. I wish SendGrid was only necessary for people who sends lots of mail but the reality is that no cloy provider can guarantee that email from their IP addresses will be delivered.

If you invoke sending email through Amazon SES, it's free for the first 2K per day, due EC2 blocks being on spam lists. http://aws.amazon.com/ses/pricing/ "You can send 2,000 messages for free each day when you call Amazon SES from an Amazon EC2 instance directly or through AWS Elastic Beanstalk."

We just switched off of SES because of the lack of bounce/rejection diagnostics, and their internal blacklisting policies are really aggressive. If someone's email server goes down for a few hours, they're blacklisted for quite some time, even after it comes back up.

After using SES for close to two years, I'd suggest looking elsewhere if you really care about deliverability or stats/metrics. We switched to Mandrill a few months ago and have been very impressed. It's still a tiny, microscopic percentage of our budget, but we get so much more (open/click reporting, sub-accounts, rendered email body history, much better blacklist/whitelist management).

Re: Security Hole in Sendgrid

#29

Post by hadoukenio »

d357r0y3r wrote: post #27
uptown wrote: post #16

Earlier quoted context omitted.

But what happens in those rare cases where that first account gets lost / locked permanently?

Require that the company submit a legally binding/notarized document before changing the e-mail address.

Lol. So what you're saying is all I need is photoshop to get the keys to the kingdom?

Re: Security Hole in Sendgrid

#30

Post by hamburglar »

meritt wrote: post #19
callesgg wrote: post #8

Send your emails yourself. It's not like it is hard. At least not harder than integrating to a third party email sender.

Deliverability plays an immense part why people rely upon an ESP.

Yeah, I have to imagine anyone who claims sending email yourself isn't hard probably hasn't sent enough email to know how hard it can be. There's a new problem with every order-of-magnitude increase in volume.
Post reply on HN