5 ms·
Ask HN: Am I paranoid or is Mailchimp lax about API security?
I'm using Mailchimp's API and found that the api key is transmitted over HTTP for many accounts. For example, the accounts that use the WordPress plugin Mailchimp distributes.
The api key gives you access to all mailing lists in that account.
I mentioned this to Mailchimp as a security concern, but their representative didn't seem worried.
I'll be using SSL, however am I being paranoid, is this just not something to lose sleep over?
For more background, here's the discussion I had with Mailchimp support:
http://groups.google.com/group/mailchimp-api-discuss/browse_thread/thread/a868a0f48e309930/7886904dd01ad640
- eliot_sykes 16y agoClickable, shortened link: http://bit.ly/cvck2Z http://bit.ly/cvck2Z
- ntulip 16y agoThe API Key/Access Information should be kept secret. At a minimum I can get some account, campaign information, etc. No private information like Credit Card numbers is available.
- eliot_sykes 16y agoWith the API key, my understanding is you can use the API to access all the email addresses and customer names on that accounts mailing list(s), which for some companies is one of their most prized assets.
- pinksoda 16y agoI wouldn't worry about it. Traffic sniffing is mostly a concern for computers connected to public wireless networks. A linux machine, in a datacenter, connected via an ethernet cable doesn't have much to worry about.
- blueben 16y agoThis is incredibly bad advice. Do you know who has access to your datacenter? Who has access to plug devices into the switch that your server lives on? Does your network provider regularly audit their gear to make sure it hasn't been compromised? How do you know? If you think traffic sniffing is "just for wifi", you're out of your mind.
- eliot_sykes 16y agoThanks for providing an alternative view, I'm going to be using SSL for sure. The more I think about it, the more I'm amazed that Mailchimp don't make a bigger deal of getting people to use SSL.