4 ms·

The homepage claim is that no server-side code is required to integrate it - so this seems to allow anyone to rock up on your website, call into the EmailJS ser

The homepage claim is that no server-side code is required to integrate it - so this seems to allow anyone to rock up on your website, call into the EmailJS service, and trigger an email? Given that EmailJS doesn't send email directly - it only sends through the accounts (e.g. Gmail) you've connected - this feels like a recipe for getting your email account shut down rapidly. If your template allows a variable destination (i.e. you can set To: from client-side) and there's enough latitude in the template, I don't see anything stopping people spamming through this service beyond the "abuse measures" like IP rate limiting.

omarfarooq 5y ago
They say so themselves: > Personal email services allow connecting personal email providers that offer basic email functionality – an email address and an inbox. These include providers like Gmail, Fastmail, Outlook 365, etc'. Personal email services are useful in EmailJS when you need to send a small number of emails to yourself, or need to send emails to other people from your personal email account. Note, your personal email account could be blocked if you go over the daily limit of the email provider, and your email address could be flagged as spam if you send unsolicited emails to multiple recipients. Our general recommendation is to use personal email services only for development purposes or for very low volume usage. Source: https://www.emailjs.com/docs/tutorial/adding-email-service/ https://www.emailjs.com/docs/tutorial/adding-email-service/
- ealexhudson 5y ago
  Yeah, but they state it in quite non-obvious terms: "you might hit the rate limit", or "you could be flagged as spam if you send to multiple recipients". The real risk is that someone finds this script on your website, open, and abuses it for themselves. Which is exactly what spammers already do, from the old sendmail.pl scripts to current vulnerable Wordpress extensions. If an external actor finds this and abuses it, that will be a world of pain. Worse, if someone was specifically trying to target you for some hurt, the ability to send emails they control directly from your personal account?! There is so much damage you could do with that ability..

omarfarooq 5y ago

They say so themselves: > Personal email services allow connecting personal email providers that offer basic email functionality – an email address and an inbox. These include providers like Gmail, Fastmail, Outlook 365, etc'. Personal email services are useful in EmailJS when you need to send a small number of emails to yourself, or need to send emails to other people from your personal email account. Note, your personal email account could be blocked if you go over the daily limit of the email provider, and your email address could be flagged as spam if you send unsolicited emails to multiple recipients. Our general recommendation is to use personal email services only for development purposes or for very low volume usage. Source: https://www.emailjs.com/docs/tutorial/adding-email-service/ https://www.emailjs.com/docs/tutorial/adding-email-service/

ealexhudson 5y ago
Yeah, but they state it in quite non-obvious terms: "you might hit the rate limit", or "you could be flagged as spam if you send to multiple recipients". The real risk is that someone finds this script on your website, open, and abuses it for themselves. Which is exactly what spammers already do, from the old sendmail.pl scripts to current vulnerable Wordpress extensions. If an external actor finds this and abuses it, that will be a world of pain. Worse, if someone was specifically trying to target you for some hurt, the ability to send emails they control directly from your personal account?! There is so much damage you could do with that ability..