Jump to content

Community

Fix "share by email" feature


Jan Krohn
 Share

Recommended Posts

Hi,

This morning I woke up to find that tens of thousands of spam emails were sent through the "share by email" feature.

The support's brilliant suggestion was to disabling that feature.

So instead of taking the responsibility to fix or remove a easily abusible feature, it's the customer's responsibility to disable it.

Bravo!

If the content that is to be shared can be removed and replaced by a spam message, then the feature is clearly broken. If this happens tens of thousands of times, and the system doesn't catch that, then the system is broken too.

Link to comment
Share on other sites

If it's made by a member, it is like a post. He can post 1, he can post 94823498273497247923492394792374923742. That's how it works. If it's made by a guest (bot or something), than not even one as THEORETICALLY Captcha should stop them.

Anyway, you should try to provide a more smart feedback than attack the support/IPS...

Bravo to you! You will really get far this way! ūüėĄ

Link to comment
Share on other sites

No, it's not like a post!! A post gets distributed to all users who are subscribed to that category, who can unsubscribe from such messages as they like.

The "share by email" feature on the other hand allows submission of random content to random email addresses.

I did send two very nice messages to support. If the best they can come up with is suggesting to disable the feature, I don't see how asking nicely for a third time is getting me anywhere.

(And just a hint: disabling the feature was nothing I couldn't think of myself before getting in touch with support.)

A feature that allows spamming random email addresses without giving them the option to unsubscribe violates CAN-SPAM, GDPR and probably evey other anti spam regulation in any other legislation too. And this is a feature currently provided by InvisionCommunity.

Link to comment
Share on other sites

8 minutes ago, Jan Krohn said:

 

A feature that allows spamming random email addresses without giving them the option to unsubscribe violates CAN-SPAM, GDPR and probably evey other anti spam regulation in any other legislation too. And this is a feature currently provided by InvisionCommunity.

Hi,

I'm really sorry for your bad experience with this feature. We agree about your concerns here and have changed the way how this feature works for IPS 4.5.0

Link to comment
Share on other sites

  • 2 weeks later...
  • 2 weeks later...

Invision Community Team: 

Thousands of emails are sent without control, the site email address is recorded in spam databases and your answer is "sorry, fix in 4.5"? You 've already tired us a little bit with blue message box about the new version, why don't you warn users with a red message box about this security hole?

 

 

Link to comment
Share on other sites

  • 3 weeks later...
On 2/6/2020 at 6:04 AM, Adriano Faria said:

If it's made by a member, it is like a post. He can post 1, he can post 94823498273497247923492394792374923742. That's how it works. If it's made by a guest (bot or something), than not even one as THEORETICALLY Captcha should stop them.

Anyway, you should try to provide a more smart feedback than attack the support/IPS...

Bravo to you! You will really get far this way! ūüėĄ

Here's the thing though ... he is correct. One should not need to 'disable' a feature that is technically not compliant with the new world order, nor should one need to be polite about sharing the frustration of the experience described. Jan was venting in frustration, and it wound up prospectively solving the problem. Thus, indeed it was "smart feedback".

I for one am quite tired of those "in the know" replying to valid queries in an ambiguous manner and with an air of superiority to boot.

I have to agree with @Jan Krohn and @desti ^

Either fix this issue or prominently warn clients so that they can avoid legal non-compliance --and responsibility for which the 'smart' client would ultimately place onto IPS

Edited by z929669
Link to comment
Share on other sites

  • Management

We will be releasing a patch or update soon that disables the email feature altogether. In 4.5, the email share function utilizes the sender's own mail client (mailto - for you nerdy types) and does not pass through the software. 

Link to comment
Share on other sites

On 2/6/2020 at 12:24 PM, Jan Krohn said:

The support's brilliant suggestion was to disabling that feature.

So instead of taking the responsibility to fix or remove a easily abusible feature, it's the customer's responsibility to disable it.

To be fair to the support staff, that is exactly what the general support department is supposed to do when you contact them. They advise on the software usage and explain your options, i.e. in this case, the option to turn it off. They aren’t in a position to decide to change that feature, nor to do it themselves instantly. If anything, they can pass it along to other team members who make those decisions. So I don’t really know what you expected from them that justifies this condescending tone. 

Link to comment
Share on other sites

We have published a patch to change how the email sharer works, it will now open the senders email client instead of sending email via Invision Community. This patch effectively backports the functionality from 4.5.

If you're affected by this you can obtain it from AdminCP > Support > Something isn't Working > Click 'apply patch'.

Link to comment
Share on other sites

Two of my forums were abused by this security hole.

Since Tuesday (March 17th) 

  • a spammer has sent out about¬†1.4¬†million spam mails (1,400,000)
  • which results in a direct loss of about 800$ and counting (payment to Sendgrid)
  • and a damaged sender reputation for my forum

Now I realize that

  • you are aware of this problem for weeks
  • you have a patch ready since Tuesday and
  • you didn't tell your paying customers a word

We need to talk. I am not amused.

Andreas

Link to comment
Share on other sites

15 hours ago, desti said:

I think someone was just scared to acknowledge the existence of the problem.

I don't think so but I have no explanation ‚Äď so I expect one from IPBoard.

I appreciate IPBoard as a great software partner with great support.
In my book a good and reliable partnership includes transparency and open talk if a problem exists and damage is done.
So that's what I expect now.

Andreas

Link to comment
Share on other sites

4 hours ago, NZyan said:

so I expect one from IPBoard.

I disabled this feature long before the problem occurred, but I don't know why i'd get information about such problems from other people, not from the software developer. So my main claim is not that I suffered any losses, but that no one informed me of the problem.

Link to comment
Share on other sites

Even though I was not affected, in my opinion this was pretty severe issue and all customers should have been informed, either via email or via the nagging upgrade red banners. It is quite possible that people are ramping up severe email bills as we speak. 

Link to comment
Share on other sites

The lack of communication channels surrounding these "hidden" updates (only visible to a community administrator if you click "Something is wrong" in the Admin CP), which has the undesired consequence of clearing out all cached files, simply needs to be reconsidered by Invision.

Link to comment
Share on other sites

  • Management

I'm very sorry for the inconvenience, confusion and poor handling of this issue. Although this functionality has existed for quite some time, this was not identified as a widespread / abused issue until recently. When the growing concern was brought to management attention, we acted as quickly as possible. 

A red warning banner should display for anyone impacted; I apologize if it didn't for some of you initially. We have corrected the issue - pushing remote notifications to AdminCPs is not a system we use very often, so there was a kink. 

Once again, my sincerest apologies for the ball being dropped on this; it is, as you know, not typical of and we will do our best to ensure it doesn't happen again. 

 

Link to comment
Share on other sites

 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

√ó
√ó
  • Create New...

Important Information

We use technologies, such as cookies, to customise content and advertising, to provide social media features and to analyse traffic to the site. We also share information about your use of our site with our trusted social media, advertising and analytics partners. See more about cookies and our Privacy Policy