> I realized I sent this to Paul, but forgot to CC the list. So Iâm > sending this again. >
*snip* > Unfortunately, some mail is still able to slip through the net. We are > also unable to identify these compromised accounts before the malicious > mail is sent, because the Mandrill account credentials are being harvested > from sources outside of our systems, so we have no insight into vulnerable > accounts until there is abuse. Generally speaking we advise all users to > secure their passwords and API keys, but sometimes mistakes are made, like > posting an API key on a publicly shared GitHub repo. > > I understand how frustrating this can be for you who have received one of > these emails, and I personally thank you for keeping those tinfoil hats on > tight. > > Forgive my ignorance, but for anything user-interactive, can you mandate MFA and/or comment on the viability and/or success in doing so? For API interaction, can you mix both keys and credentials or use some other method for achieving similar ends? What about other sorts of controls, (for example perhaps) geo-locking of user accounts and/or API interfaces so that their sudden use from another country is at least logged/flagged, if not blocked outright? Obviously, generating spam via a compromised account is extremely common and makes mail systems accessible from anywhere very attractive; in the userspace we recommend MFA as a significant control for compromised credentials, i'll admit to being less familiar with the applicability of this approach for anything API driven. But for a commercial mail-sending operation these sorts of controls would seem to becoming more and more relevant, as the impact of a reputation hit on your IP ranges, etc, is much more far-reaching than a private system? Cheers Mark. _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
