[deleted]
Mailgun Security Incident and Important Customer Information
31–40 of 66 posts
Re: Mailgun Security Incident and Important Customer Information
#32In those security disclosures, I often read what I see as contradictory language. For example, I'm confused by this kind of statement: > Mailgun has now completed its diagnostic of accounts that were affected and has notified each of the affected users. At this time, we believe less than 1% of our customer base was potentially affected. If you were not directly notified by Mailgun regarding this incident, then your a…
Foremost, it was written by a human and unintended language contradictions are common. With that said, what you're suggesting isn't necessarily true -- the language can also indicate potential false positives, again because of the nuances of language.
> unintended language contradictions are common
Yes, definitely true. Although some contexts, like a security disclosure, might warrant a very carefully non-contradictory worded statement that leaves no doubts of interpretation.
> the language can also indicate potential false positives, again because of the nuances of language.
Yes, but in this context, false-positive aren't important to the audience of the disclosure. Nobody really cares if their account was "identified as affected, but in the end wasn't".
If you announce that 1% of your user base was affected, and it turns out that 50% of this 1% were false-positive, great! You were still right in announcing that 1% of your user base was affected. You can always correct this later and announce that things panned out better and only 0.5% of your users were impacted.
Re: Mailgun Security Incident and Important Customer Information
#33Earlier quoted context omitted.
Postmark costs money, Mailgun does not.
Postmark is free up to 100 mails / month. But mail deliverability issues are a hell that I'm happy to pay a small fee to avoid.
Do they have an overage charge for the free 100/month, like the 1.25/1000 they list for their non-free use? So you could be free most of the time with the occasional 1.25 charge if you have a busy month?
Re: Mailgun Security Incident and Important Customer Information
#34Only 1%? My eye. This has smell of Yahoo to it. I bet within 6 months, this goes up toward 10%. I bet they lost their entire data.
Re: Mailgun Security Incident and Important Customer Information
#35This was used to steal bitcoin cash tips on Reddit by hijacking password reset emails ( https://www.reddit.com/r/bugs/comments/7obxkb/mailgun_securi... ) I find it amusing they still have a "trusted by Reddit" blurb on their homepage after this!
I don't believe this would even be an issue if they offered the option to not log sensitive data. I had requested that they provide something like this and someone quite senior reached out to me. He was very polite and professional. He explained that they had to keep this data for operational and compliance reasons and that all email providers are required to. However, that didn't resolve my security concern. We ende…
This needs to be the #1 comment in the thread. If you use a transactional mailer, make sure you are not archiving emails with security-sensitive content.
That includes resets, username reminders, signin notifications, etc.
Also secure access to your transactional mailer account with 2FA and restrict access to those who need to be there (i.e. not your entire support team).
Re: Mailgun Security Incident and Important Customer Information
#36Earlier quoted context omitted.
Former mailgun customer. Asked them to delete my personal data a couple of weeks ago (I was not able to do it myself... ) because I would rather they don't leak it in a security hiccup. They kindly refused to do so (as I don't believe any tech support can be that incompetent) and kept spamming my inbox instead. While the severity of this incident is not clear, never imagined curses can act on such a short notice.
This is because Mailgun is in the practice of spam. The number of spam campaigns I've seen with Mailgun as the conduit is high, second only to Mailchimp.
To be fair, Mailgun is in the practice of sending email. It just happens to be that email is one of the main conduits of spam.
Re: Mailgun Security Incident and Important Customer Information
#37This was used to steal bitcoin cash tips on Reddit by hijacking password reset emails ( https://www.reddit.com/r/bugs/comments/7obxkb/mailgun_securi... ) I find it amusing they still have a "trusted by Reddit" blurb on their homepage after this!
I don't believe this would even be an issue if they offered the option to not log sensitive data. I had requested that they provide something like this and someone quite senior reached out to me. He was very polite and professional. He explained that they had to keep this data for operational and compliance reasons and that all email providers are required to. However, that didn't resolve my security concern. We ende…
Can you explain this a bit more, please? I am confused. How does ‘view_content_link’ cause a security problem?
Re: Mailgun Security Incident and Important Customer Information
#38Er, can we expect more information to follow? 1. How was the employee's account accessed? No 2FA? 2. Do employees ordinarily have access to customer secrets (e.g. API keys) or was there some further exploit? 3. The advice in OP for affected customers is to roll keys and SMTP logins. Couldn't/shouldn't you do that for them? Surely security should trump up-time/deliverability?
For 3. I'd say no way. There's no way for Mailgun to know what services are doing with those keys, how important those services are to their customers, how difficult it is for the service owners to rotate their keys, and how much bandwidth they have to do that right now.
In an ideal world, every customer would have a good setup where they can rotate third-party supplier API keys painlessly and have plenty of bandwidth to handle security emergencies. Alas, there's a lot of bad setups out there, and some of them are critical to their customers' operations.
Nothing I've personally worked with had a setup bad enough to make that painful, but I'd be very worried about how reckless a service is to rotate API keys that aren't being actively exploited to do something dangerous without getting a positive confirmation from the customer.
Re: Mailgun Security Incident and Important Customer Information
#39[deleted]
Re: Mailgun Security Incident and Important Customer Information
#40Earlier quoted context omitted.
I don't believe this would even be an issue if they offered the option to not log sensitive data. I had requested that they provide something like this and someone quite senior reached out to me. He was very polite and professional. He explained that they had to keep this data for operational and compliance reasons and that all email providers are required to. However, that didn't resolve my security concern. We ende…
Can you explain this a bit more, please? I am confused. How does ‘view_content_link’ cause a security problem?
It's the opposite. That is a link to the section of the Mandrill docs, not the Mailgun docs. The view_content_link option fixes the security problem. (In theory, anyway).