61–70 of 97 posts
Looks like a deeply unsatisfactory response from SendGrid. They don't even know for sure ("it appears .. pretty much confirms") that their own support staff changed the email address?
This shows why so-called PR-speak is necessary. Email like this should not be in a conversational style because it can easily be misinterpreted.
Trust me I know that CC's are getting sniffed in transit too often so I'm not saying they're 'safe'. I'm just wondering if there is something unique to Bitcoin that suddenly makes you a target as though you were known to be storing CC's data at rest onsite.
The problem is that it was technically possible, for a representative, to make this change without the proper verification. You just can't rely on humans for that.
I thought that was just the strangest thing, and it didn't sit well with me. Accessing a customer's account when they request service is one thing, but making changes on behalf of a stranger you know has no authority over that account? That was when I moved the last of my apps over to Mandrill.
Or is it that easy to register a domain with a fictitious persona?
Earlier quoted context omitted.
> - You need to make sure that your email servers IPs are not on black lists. This alone is a huge, huge chore. Especially if you run a hosted service that allows some user-specified content in outbound email bodies. It's a lot cheaper for us to pay Mandrill to handle all of that for us, provide us excellent metrics and diagnostics, and let us know if one of our users is sending junk mail before it gets out of hand.
Even if you do everything right you can still find yourself on a blacklist. Then you get to pound sand. Blacklists suck. Not as much as spam sucks, though.
Earlier quoted context omitted.
Even if you do everything right you can still find yourself on a blacklist. Then you get to pound sand. Blacklists suck. Not as much as spam sucks, though.
Frankly, with the amount of bullshit blacklists out there that real mail providers actually trust, I've come to detest blacklists more than spam.
Social engineering will almost always work. I don't really fault Sendgrid for this (though I could see this not working as well if you were using Amazon SES...no support to even talk to!). It sucks that they got caught with their pants down but I bet a good social engineering attempt on ChunkHost might have yielded similar results. The lesson here is to have multiple defenses. 2 factor auth is a great start and it wo…
You should fault Sendgrid as they specifically have a policy NOT to perform this change of email request (from the article). Sendgrid can also change their systems so that phone support personnel can NOT perform this change or perform this change with approval from a supervisor. Sendgrid being in the business they are in should also know that they are susceptible to these types of attacks and what they can lead to (m…
EDIT: May I ask what can be gained from faulting SendGrid in this case?
Another title for this submission could have been: "Massive Security Hole in ChunkHost. Non-2FA accounts can be owned." Because it turns out anyone with a Sendgrid Support account also effectively had potential access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services. SendG…
That would be because sendgrid is lame. I've recently tried to use their service to send emails, club member newsletters. I've never thought much about bulk e-mails before and I thought it was a "solved problem" by now. Sendgrid are well known so they were my first choice. During initial testing I found both bugs in the API and missing functionality. I've worked over 20 years with IT and yet sendgrid support is easil…
I use Mandrill for my private projects, and it is so much better it's shocking SendGrid has a single customer.