3 ms·

What exactly does Mailchimp publish about their security model that would allow anyone to predict this breach?

by beardedwizard 4y ago

dividuum 4y ago
As purely an outsider and not OP: it seems their contractors and support people have direct access to critical customer data simply by typing password and/or totp into a form. Seems it’s not always the correct one. * Limiting access (maybe to email subject instead of all content?) might prevent some fallout as it might be more difficult to extract password reset emails sent by customers. * Limiting access from certain IP sources might make it more difficult to use captured login credentials. * Hardware key based authentication might prevent the type of phishing that seems to have happened here.
- iamacyborg 4y ago
  * Allowing customer to only allow MC staff access for fixed intervals when support tickets are raised.
iinnPP 4y ago
You should never trust the marketing department to accurately convey any security model and should assume anything published regarding security has been approved by marketing. Avoid companies that require data which isn't required. Overlook companies with previous vulnerability disclosures that leave you facepalming. Ignore companies that pre check marketing anything. Blacklist the companies with GDPR ignorant cookie "consent." Black hole companies that kill the planet to bring you advertising while telling you you're killing the planet. I would make a joke about what remains. It wouldn't be funny. There are still lots of companies left however and those are the ones that gave at least a signal about caring about you. And for the love of all things. If your company is forcing employees to sign up for garbage data farm software, SAY SOMETHING. Your data is important.
- InCityDreams 4y ago
  >Blacklist the companies with GDPR ignorant cookie "consent." Could you explain further?

3 ms·

What exactly does Mailchimp publish about their security model that would allow anyone to predict this breach?

by beardedwizard 4y ago

What exactly does Mailchimp publish about their security model that would allow anyone to predict this breach?

dividuum 4y ago
As purely an outsider and not OP: it seems their contractors and support people have direct access to critical customer data simply by typing password and/or totp into a form. Seems it’s not always the correct one. * Limiting access (maybe to email subject instead of all content?) might prevent some fallout as it might be more difficult to extract password reset emails sent by customers. * Limiting access from certain IP sources might make it more difficult to use captured login credentials. * Hardware key based authentication might prevent the type of phishing that seems to have happened here.
- iamacyborg 4y ago
  * Allowing customer to only allow MC staff access for fixed intervals when support tickets are raised.
iinnPP 4y ago
You should never trust the marketing department to accurately convey any security model and should assume anything published regarding security has been approved by marketing. Avoid companies that require data which isn't required. Overlook companies with previous vulnerability disclosures that leave you facepalming. Ignore companies that pre check marketing anything. Blacklist the companies with GDPR ignorant cookie "consent." Black hole companies that kill the planet to bring you advertising while telling you you're killing the planet. I would make a joke about what remains. It wouldn't be funny. There are still lots of companies left however and those are the ones that gave at least a signal about caring about you. And for the love of all things. If your company is forcing employees to sign up for garbage data farm software, SAY SOMETHING. Your data is important.
- InCityDreams 4y ago
  >Blacklist the companies with GDPR ignorant cookie "consent." Could you explain further?