News for hackers. Stuff that matters.
Re:Sendgrid under siege from hacked accounts by edoceo on Saturday August 29, 2020 @05:37PM (#24319599)
Oof. So,I tried sending mails from our own domain and our mail server - but Google tagged us as spam. We migrated into Google hosting and it was fixed, now back to Spam. So we move to a provider like sendgrid, but then they have a hack. Damnit!

When we hosted our own, we had DKIM, SPF, DMARC and such, clean IP and clean messages, we only sent account create and transaction notices - low volume, relevant messages to folks who opt-in. We had our little box setup right and we're polite actors but got tagged which killed our user experience (password resets went to Spam and folk called support)

But it feels the "big-web" forced us into vulnerable providers for the spam game.

We need more self hosted email and less centralized control.

Re:Sendgrid under siege from hacked accounts by tialaramex on Sunday August 30, 2020 @12:59AM (#24321477)
Keep in mind that some users almost certainly believe your email is spam. Even if they're explicitly paying you to send them that email.

For an end user "spam" is "email I don't want".

"But" I hear you screaming, "That's their credit card bill, they even confirmed their email address and specifically opted into receiving it by email - that's not spam". It's unwanted, they don't have $850 to pay off the balance and they don't want to think about the interest charges, so it's spam as far as the user is concerned, some non-trivial fraction of users will click "Spam".

You've probably seen people who have piles of unopened real world postal mail, they feel the same way about that. Unsolicited catalogue. Bank statement showing I am overdrawn. Nagging letter from my mother. All unwanted: Spam.

Worse, some of these same users will anyway be angry that the important message they marked as spam is treated as spam. Why are facts true? They shouldn't be true if I don't want them to be. Is that irrational? Sure, that's humans for you.

This is a losing proposition, and the end-user facing providers are aware of that, but "spam blocking" is something users demand from such providers even while being very angry that it doesn't do what they want. "Humans are irrational" is not actionable.

Re:Sendgrid under siege from hacked accounts by DyslexicAtheist on Sunday August 30, 2020 @02:08AM (#24321699)
> For an end user "spam" is "email I don't want".

last time I checked (been a few years since I used Google) BigTech is perfectly able to distinguish a bad actor from an opt-in type of service. They even presented me with a little notification whenever I moved stuff into SPAM that didn't belong there asking "do you want Gmail to unsubscribe you from X" ... I can't exactly recall the text - but all their lofty claims about their "AI" should account for something?

I agree with you that the _user_ is the biggest wildcard. But it's not that we should allow Google/Microsoft get way with this as an excuse. They are currently right in the middle of killing open protocols like imap in favor of their own flavored shit (probably something AMP like but for email). They do not deserve the benefit of a doubt. They do not even deserve to have their side of the argument heard at this stage.

Re:Sendgrid under siege from hacked accounts by Arnavion on Sunday August 30, 2020 @04:33AM (#24322165)
GMail prompting you to unsubscribe is because the email carries a standard [1] header (List-Unsubscribe) and GMail detects it. They may also be using some smarts to detect unsubscribable emails that don't have the header, but in general it's because of the header. It doesn't have anything to do with distinguishing between spam and legitimate subscriptions.

So if you mark a legitimate subscription as spam and don't unsubscribe when gmail prompts you to, it's likely that it'll get sent to your spam in the future, and perhaps contribute to the sender's spam score which affects other people's inboxes too.

[1]: de-facto standard? I can't find any RFC for it.

Re:Sendgrid under siege from hacked accounts by DyslexicAtheist on Monday August 31, 2020 @04:32AM (#24329484)
actually I wasn't talking about mailing lists (I'd never move something from majordomo or similar to spam since I 100% know why I received them). But I'm talking about corporate news letters delivered by services like MailChimp and other marketing tech. - No idea if these have a List-Unsubscribe header - but even if they do I shouldn't have received the message in the first place (in most cases).
Re:Sendgrid under siege from hacked accounts by Silhouette on Saturday August 29, 2020 @06:47PM (#24319955)
We need more self hosted email and less centralized control.

This is true, from both sides of the equation. The biggest single problem with email today, IME at least, is the number of major mail providers who are acting as gatekeepers for their users and doing a bad job of it. In particular, they block way too much legitimate mail, and often do it silently, so the sender is not even aware of the problem or able to contact them about getting it fixed.

Then the sender of the missing mail gets the customer support requests about the missing password reset emails, or the complaints that someone didn't know they were still subscribed despite the receipt emails being sent for each payment, or...

At this point, there really ought to be a blacklist for unreliable mail services on the receiving side analogous to the spam blacklists, so businesses can warn their users if given an address on a bad service and invite them to choose another.

Re:Sendgrid under siege from hacked accounts by jacquesm on Saturday August 29, 2020 @07:01PM (#24320036)
At this point in time I think I'd rather deal with the spammers than with Google, Microsoft etc. Unfortunately they've managed to lock up email to all intents and purposes, good luck reversing the situation to the point where they have to play nice.
Re:Sendgrid under siege from hacked accounts by chromedev on Sunday August 30, 2020 @12:04AM (#24321279)
There are plenty of people successfully hosting their own email. If you're getting flagged as spam, then you need to take a few steps every once in a while but self-hosted email is still totally doable.
Re:Sendgrid under siege from hacked accounts by foepys on Sunday August 30, 2020 @12:47AM (#24321435)
As somebody who is running their own mail sever I'd love to agree with you but GMail, Hotmail, and all the other large email providers make it extremely hard to do so.

If you only send a few emails per month, you are fine. When you host an email server for others, even if it's only your family and friends, it can quickly become a nightmare. And if I ran a business, I'd never do it myself.

Landing on a blacklist of those large providers effectively shuts your email server down and it's way too easy to get blacklisted. There are so many techs around email now (DKIM, TLS, SPF, HELO testing), that coordinating them becomes a huge responsibility. Misconfiguring a single one can lead to rejection at the large providers that deal with billions of incoming emails a day, with hyper aggressive spam filters. The worst thing that can happen is that your emails were to be classified as spam but you didn't know it. A flat out rejection is relatively rare so you are often not notified that your configuration is incorrect.

Getting off those blacklists is extremely hard. Especially if you don't land on GMail's blacklist but on those community driven ones that only allow your IP to be removed from it once. If you land on them a second time, you need a new IP and hope that this IP isn't already blacklisted.

Many large providers are blacklisting entire ISP IP ranges due to past so waves. E.g. GMail is blocking the entire AWS EC2 range, I believe.

Re:Sendgrid under siege from hacked accounts by smnplk on Saturday August 29, 2020 @05:43PM (#24319633)
`We need more self hosted email and less centralized control`

We need to start over and build a truly open internet.

Re:Sendgrid under siege from hacked accounts by Reelin on Saturday August 29, 2020 @06:06PM (#24319752)
> We need to start over and build a truly open internet.

I want to agree, but email is actually an example of an open and federated protocol achieving success. It's pretty much everything that could have been hoped for as far as openness and interoperability go at the protocol level. Unfortunately, balkanization still occurs at the social (ie network) level.

Re:Sendgrid under siege from hacked accounts by dredmorbius on Saturday August 29, 2020 @07:07PM (#24320055)
The open email Internet was buried in an avalanche of spam.

Open alone is insufficient.

Re:Sendgrid under siege from hacked accounts by paulryanrogers on Saturday August 29, 2020 @09:12PM (#24320550)
If email were architected to put the cost of storage on senders then I think the spam problem would have been more manageable. Instead it's so closely modeled on physical mail that recipients get overwhelmed quickly.
Re:Sendgrid under siege from hacked accounts by smabie on Saturday August 29, 2020 @09:32PM (#24320631)
Even if email worked like that, I don't think it would solve the spam problem. Spam emails are rarely personalized and the same exact message is sent out to many different addresses.

As such, the spammer would only have to store each unique message and the list of recipients associated with each unique message.

Re:Sendgrid under siege from hacked accounts by dredmorbius on Sunday August 30, 2020 @03:15AM (#24321903)
Even with single copy + list, with a poll-and-request delivery model (sender polls recipient's system, which then requests message on some schedule):

1. Sender canot simply mass-cram messages to recipients, as many spam engines today do. (Qmail for a time was notorious for doing this).

2. There's good chance that any bulk spammer will accrue a negative reputation by the time most recipients bother to request messages. So they won't.

3. Spammer must sustain a stable online presence --- not be knocked offline or blocked by ISP or hosting provider.

4. Spammer has to track successful deliveries vs. messages that are complete.

Upshot: the spammer's workfactor increases.

Re:Sendgrid under siege from hacked accounts by bsder on Saturday August 29, 2020 @11:17PM (#24321095)
Hrm. I wonder if this is an actual use case for blockchain and proof of work.

If you want to send me an email, you have to send me an SMTPCoin. If my user doesn't mark it as spam, I give you the coin back. If my user marks it as spam, I keep the coin.

Re:Sendgrid under siege from hacked accounts by jonas21 on Saturday August 29, 2020 @11:38PM (#24321177)
Preventing email spam was in fact the original use case for proof of work.

https://en.wikipedia.org/wiki/Hashcash

Re:Sendgrid under siege from hacked accounts by _heimdall on Sunday August 30, 2020 @03:36AM (#24321962)
This was the inspirstion for nano's use of proof of work too. They don't use PoW for the chain itself but do require every transaction to include a small proof of work to avoid spamming the network, almost identical to hashcash.
Re:Sendgrid under siege from hacked accounts by TylerE on Saturday August 29, 2020 @07:56PM (#24320256)
To be honest, at this point I wish email would just die and get replaced with an actual modern protocol. It's a nightmare. Everything about it sucks.
Re:Sendgrid under siege from hacked accounts by samat on Saturday August 29, 2020 @08:12PM (#24320327)
Please don't. Anything modern would another lock-in. I can read decade old emails, switched multiple providers. Messages in those 'new protocols' are long unaccessible and protocols themselves are dead.
Re:Sendgrid under siege from hacked accounts by Spivak on Saturday August 29, 2020 @10:52PM (#24320992)
At this point at least pay for delivery would give you some path to actually get to users.
Re:Sendgrid under siege from hacked accounts by zelly on Sunday August 30, 2020 @12:57AM (#24321470)
Spammers would pay too, maybe even outbid the genuine users. They already invest a lot into getting past filters.
Re:Sendgrid under siege from hacked accounts by smabie on Saturday August 29, 2020 @09:24PM (#24320598)
Such as? How would it work?
Re:Sendgrid under siege from hacked accounts by TylerE on Saturday August 29, 2020 @09:48PM (#24320690)
Not having trivially forged headers would be a start.
Re:Sendgrid under siege from hacked accounts by Spivak on Saturday August 29, 2020 @10:54PM (#24321000)
Isn’t this basically what SPF, DKIM and SMTP over TLS get you? Sure you can try to forge messages but they should bounce immediately and not even reach the recipients inbox.
Re:Sendgrid under siege from hacked accounts by techdragon on Saturday August 29, 2020 @11:08PM (#24321054)
I’m not an expert... but From what I can tell no one trusts anyone’s email anymore and even as we added these new security things.. we didn’t start trusting any more than we did before... Consequences being that even with the extra security, trying to run your own mail server and get email recipients to receive the mail you send is like being some kind of extremely polite red team, on the offensive in the worlds longest least organised capture the flag.