Information about a recent security incident at Mailchimp

Even that doesn't work - some companies do exactly that with regular phishing exercises etc.

Employees get really good at spotting the tests.

Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."

> a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response

They have a similar concept in cybersecurity.

The Red Team

> a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies.

https://en.wikipedia.org/wiki/Red_team

But if your devs are outsourced...?

Once is a hack. Three times in a year is a systemic business problem.

Mailchimp was gutted.

You have to understand the sort of mythical place the company had in the nascent Atlanta tech scene. It was one of the first Atlanta tech unicorns and was growing and hiring at a rapid clip. The founders promised never to sell and that they would give annual bonuses in exchange for not offering employee equity. The office was brimming with art, music, and perks that were unusual for Atlanta at the time. They said they were going to build a generational Atlanta tech company.

I desperately tried to recruit my friends that worked at Mailchimp away, because I saw the writing on the wall. I had joined a promising startup offering significant equity, and more importantly, building real value in the world. To my disappointment, none of my Mailchimp friends joined me. They liked the culture too much, felt comfortable, and continued to tout the bonuses they were receiving despite Mailchimp offering lower total comp. I never stopped trying to pull them away, but I didn't succeed. I received counter offers and heard the Kool Aid stories. "The founders are so cool and so generous."

The job itself isn't that interesting, either. Marketing and email advertising isn't intellectually attractive. To top it off, Mailchimp has a disgusting PHP monolith that I've heard is like pulling teeth to work with.

I was right in the end. I walked away with a huge eight figure exit. Mailchimp employees got pay cuts, benefit cuts, and saw their culture ravaged. Intuit took what little niceties they had and threw it all to the wind. Macy's and Home Depot have better software jobs.

I really don't like Mailchimp. The company is rotten.

As purely an outsider and not OP: it seems their contractors and support people have direct access to critical customer data simply by typing password and/or totp into a form. Seems it’s not always the correct one.

* Limiting access (maybe to email subject instead of all content?) might prevent some fallout as it might be more difficult to extract password reset emails sent by customers.

* Limiting access from certain IP sources might make it more difficult to use captured login credentials.

* Hardware key based authentication might prevent the type of phishing that seems to have happened here.

You should never trust the marketing department to accurately convey any security model and should assume anything published regarding security has been approved by marketing.

Avoid companies that require data which isn't required. Overlook companies with previous vulnerability disclosures that leave you facepalming. Ignore companies that pre check marketing anything. Blacklist the companies with GDPR ignorant cookie "consent." Black hole companies that kill the planet to bring you advertising while telling you you're killing the planet.

I would make a joke about what remains. It wouldn't be funny. There are still lots of companies left however and those are the ones that gave at least a signal about caring about you.

And for the love of all things. If your company is forcing employees to sign up for garbage data farm software, SAY SOMETHING. Your data is important.

I once worked with one of those heroic security guys before. He setup the firewall so that the public website was only accessible from a white list of known up addresses. New users would need to submit their IP address to him in person before they’d be allowed to browse the site.

He insisted that this was industry best practice and it took two weeks before the site was online again.

> I failed to convince them to undelete my account (the deadline is currently 2 years), but there is an HN support incident: https://news.ycombinator.com/item?id=18715866#18717279.

A lot of companies have a habit of keeping data but not migrating dead customers to newer schemas and systems.

The likelihood of me keeping track of both well isn’t great. And then of I lose one, how do I go about revoking that from all the services? Not to mention that enrolling 2 keys requires you to have both keys every time you enroll. So I’m not sure how practical that is and how you know when you’ll need both keys. Recovery codes seem like a better option but then you’re stuck figuring out how to keep them around securely… OTP + diligence against social engineering is so far the only thing I’ve found that I trust. It’s not the best but multiple Yubikey’s sounds wrong and impractical as well.