0

I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list.

Flow:

User goes to a website hosted by unbounce.com that uses my website's domain

---> Enters their email address in an iframe hosted by my domain test.com

---> Answers the reCaptcha question

---> On our backend, we make a request to the Google API to verify the user's response.

----> Once verified, we subscribe the user's email address to a Sendgrid list.

Security concerns:

  1. Hacker subscribes users to sendgrid list unknowingly

  2. DDOS

  3. Email address exposed because not stored in secure manner

  4. Email address exposed because not sent to Sendgrid in secure manner

Are there any other security concerns that need to be addressed when collecting email addresses from an unauthenticated page on your site?

Also is reCaptcha enough to address these concerns of exposing such an API endpoint to the outside world?

Are there any other solutions that I should look at or any other security concerns to address for solving the problem:

Collect email addresses from interested third parties through an unauthenticated page at scale.

  • DDOS against whom? unbounce? You? Sendgrid? Users? Adresses stored in nonsecure manner where? By you? Sendgrid? Unbounce? Are you sending a confirmation email to the address? – Acccumulation Mar 16 '18 at 21:28
1

This is asking a lot of questions... I'll try to suggest solutions where I can.

  1. Hacker subscribes users to sendgrid list unknowingly

The generally-accepted solution to this problem is double opt-in. After the user submits their email, send them an email with a verification link. Your Captcha solution should help reduce validation link spam, but you could also limit the number of emails sent to a given address in a given time period.

  1. DDOS

This is a pretty vague consideration, and a good answer depends on who you are trying to protect from DDOS. I'm also not very well-versed in DDOS protection schemes, so I'll take a pass on this part.

  1. Email address exposed because not stored in a secure manner

This again will depend a lot on the specifics of how and where you store the email address. There are essentially two parts to a good solution for this part:

  1. Access Control
  2. Encryption

Access control is the practice of limiting people's ability to retrieve information. For example, the homepage of your website would typically have no access control. But if you have an admin page, that would require a username and password to login to view the page.

A lack of access controls in the default settings for MongoDB has resulted in breaches to thousands of databases that people have inappropriately exposed to the internet.

Given that there are so many forms of access control, it would be difficult to provide guidance on access control without more information. Conceptually, just be sure there is some step, somewhere in the process of retrieving the information that would require some sort of secret key, or passphrase to gain access to the stored information.

Encryption is the next level of defence, requiring an additional key to read the information even if someone physically gained access to the list of emails. Column-level encryption in a database would mean that even if someone gained access to query the database, they would need an additional encryption key to read the address.

This has the side-effect that you typically cannot search over encrypted fields. As a result, only the most sensitive information is typically stored with this type of strong encryption... things like Social Security Numbers.

  1. Email address exposed because not sent to Sendgrid in secure manner

This is a pretty simple question to answer. Use HTTPS. Assuming it is a server-side application submitting the email address to Sendgrid, do not ignore certificate errors on https requests. That's about all you need to do. Since you're entrusting Sendgrid to hold the email address, you will also need to trust that they are storing them safely, and have properly implemented TLS on their list management API.

For your part, to protect the email addresses that you have stored in a third-party mailing list service... protect your account keys. Don't store API keys in source control. Use a strong password for your user account. Turn on two-factor authentication if available. The easiest way an attacker will get into that mailing list application is not by breaching SendGrid, it's by stealing the keys from you.

Are there any other security concerns that need to be addressed when collecting email addresses from an unauthenticated page on your site?

See the part above about double opt-in. Confirming that the someone controlling that email address by sending them email, before sending them anything, is about all you need to do when entering an arm's-length relationship with a mailing list subscriber.

If you are doing more than just marketing to them - for example, they are a patient at a medical clinic and you want to share prescription details with them - it is best to force them to create a user account first, and verify their identity by some other means. The kind of private information you need to verify them as an individual person should typically not be sent via email.

Also is reCaptcha enough to address these concerns of exposing such an API endpoint to the outside world?

What reCaptcha will provide you in the scenario is confirmation that the user is a person, and not an automated script trying to submit a list of stolen email addresses to your service to be spammed. It's enough to keep you from sending out a lot of validation emails through the double opt-in. reCaptcha alone will not protect you from someone submitting other people's emails to your list.

Are there any other solutions that I should look at or any other security concerns to address for solving the problem:

Collect email addresses from interested third parties through an unauthenticated page at scale.

One other tool you might find helpful is a system to validate the addresses themselves. Mailgun provides any API for their customers to validate emails on a number of properties, including whether or not the email actually points to a valid domain. Checking this will help your system avoid someone stuffing your validation system with emails that will hard bounce.

If you're sending information of any value, you might also want to avoid sending emails to any of the domains provided by services like Mailinator, since these addresses just go to publicly-accessible mailboxes that are owned by no-one. An email validation API like Mailgun's may help you here too, since someone will have taken the time to curate that ever-changing list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.