Sendgrid seems to be its own worst enemy (Adria Richards debacle, now this).
I suggest we dub the act or state of being one's own worst enemy, being "sendgriddled."
Security Hole in Sendgrid
31–40 of 97 posts
Re: Security Hole in Sendgrid
#32Earlier quoted context omitted.
If you invoke sending email through Amazon SES, it's free for the first 2K per day, due EC2 blocks being on spam lists. http://aws.amazon.com/ses/pricing/ "You can send 2,000 messages for free each day when you call Amazon SES from an Amazon EC2 instance directly or through AWS Elastic Beanstalk."
We just switched off of SES because of the lack of bounce/rejection diagnostics, and their internal blacklisting policies are really aggressive. If someone's email server goes down for a few hours, they're blacklisted for quite some time, even after it comes back up. After using SES for close to two years, I'd suggest looking elsewhere if you really care about deliverability or stats/metrics. We switched to Mandrill…
Thanks for the recommendation! Will have to check them out.
Re: Security Hole in Sendgrid
#33Earlier quoted context omitted.
But what happens in those rare cases where that first account gets lost / locked permanently?
Yes, this is part of what I'm trying to get answers to. Do you tell the user on signup to print an in-case-of-emergency-break-glass password which is only ever to be used to get into a locked account and other special circumstances? It may seem over the top but seeing as it's unique across service providers, I think it's a hell of a lot better than the overly abused "what is your mother's maiden name" type questions.…
The solution is to do what everyone who actually needs authentication from a company does; require a posted signed letter from a director, possibly along with an outbound (from SendGrid to the director) phone call to confirm. There's plenty of low-tech ways to confirm that a company really wants to do something.
Re: Security Hole in Sendgrid
#34Earlier quoted context omitted.
If you invoke sending email through Amazon SES, it's free for the first 2K per day, due EC2 blocks being on spam lists. http://aws.amazon.com/ses/pricing/ "You can send 2,000 messages for free each day when you call Amazon SES from an Amazon EC2 instance directly or through AWS Elastic Beanstalk."
We just switched off of SES because of the lack of bounce/rejection diagnostics, and their internal blacklisting policies are really aggressive. If someone's email server goes down for a few hours, they're blacklisted for quite some time, even after it comes back up. After using SES for close to two years, I'd suggest looking elsewhere if you really care about deliverability or stats/metrics. We switched to Mandrill…
Does open/click reporting still work for GMail with the changes to the way they load images?
Re: Security Hole in Sendgrid
#35Another title for this submission could have been: "Massive Security Hole in ChunkHost. Non-2FA accounts can be owned." Because it turns out anyone with a Sendgrid Support account also effectively had potential access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services. SendG…
That would be because sendgrid is lame.
I've recently tried to use their service to send emails, club member newsletters. I've never thought much about bulk e-mails before and I thought it was a "solved problem" by now. Sendgrid are well known so they were my first choice.
During initial testing I found both bugs in the API and missing functionality. I've worked over 20 years with IT and yet sendgrid support is easily on the top-3 list of my worst support experiences, a total waste of time.
We ended up using mailgun instead and so far it looks much better.
Re: Security Hole in Sendgrid
#36Earlier quoted context omitted.
SendGrid's policy (as stated in their first email) is that the support people shouldn't be changing account emails in this fashion. Even if SendGrid had 2 factor auth, who's to say the support guy wouldn't have just disabled that?
If their policy is that support staff should never be able to change an accounts email address... why does the system let them do it?
[deleted]
Re: Security Hole in Sendgrid
#37Earlier quoted context omitted.
Yes, this is part of what I'm trying to get answers to. Do you tell the user on signup to print an in-case-of-emergency-break-glass password which is only ever to be used to get into a locked account and other special circumstances? It may seem over the top but seeing as it's unique across service providers, I think it's a hell of a lot better than the overly abused "what is your mother's maiden name" type questions.…
The solution is to do what everyone who actually needs authentication from a company does; require a posted signed letter from a director, possibly along with an outbound (from SendGrid to the director) phone call to confirm. There's plenty of low-tech ways to confirm that a company really wants to do something.
Please, no.
Consider a determined attacker. A posted signed letter has zero cost and is easily forged and a phone call is free via Skype. There's plenty of low-tech ways to circumvent security.
Re: Security Hole in Sendgrid
#38We use Sendgrid and have hundreds of thousands of customers that might be phished by this social engineering trick. It's absolutely unacceptable that such a crucial piece of infrastructure is vulnerable to such a simple trick.
I'm going to bring this up with our team and see if there's another vendor that can more reliably protect our customers.
Re: Security Hole in Sendgrid
#39Earlier quoted context omitted.
In this case, looping in the original email address on the SendGrid account before changing to a new one would have kept this from happening. SendGrid's support personnel should almost certainly not be able to change an email address without the change being signed off on through the old address first.
But what happens in those rare cases where that first account gets lost / locked permanently?
You need some kind of "okay, you can get your password back, but it's going to take some time. You cannot get back up instantly."
Maybe they FedEx the password to your physical address on file. Maybe they contact all phone numbers and emails they have for you and say "someone has requested an emergency override, if you object call us back in the next 4 hours." Maybe they do a Skype session and compare your photo to the one they have on file.
All this costs money, of course. That's the price of doing business.
Re: Security Hole in Sendgrid
#40Another title for this submission could have been: "Massive Security Hole in ChunkHost. Non-2FA accounts can be owned." Because it turns out anyone with a Sendgrid Support account also effectively had potential access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services. SendG…
Are there any web hosting companies that don't rely on the "send a reset link to your email address on file" model of password resets? You're right, that model is deeply broken if anyone can intercept those emails (as happened in this case), but it seems unfair to single out ChunkHost for criticism.
With that same logic in mind - we could say that anyone working at amazon AWS or Rackspace (or any other hosting companies) could gain access to your application.
The thing is we trust these companies to have processes in place so that their representatives won't have the ability to potentially do something destructive and if they can because they are the highest ranked rep and they need that kind of access - then at least auditing and training should be in place to avoid that kind of behavior.