Looking for a better way of handling email signatures?
Email signature management & marketing | Signkit
Hi there!
Daniel from Signkit here.
We began building Signkit about 1 year ago trying to solve the need of our first customer. Since then we've welcomed more to the platform, and are now at point where we'd like to expand beyond word of mouth. Before we do that, we hope to get the valuable feedback of the Indiehackers community!
Signkit is a all-in-one platform for email signatures. Easily create and distribute on-brand signatures across your entire organization and build powerful marketing campaigns.
We're a team of two working on Signkit while maintaining our day jobs.
Thanks in advance. All feedback is greatly appreciated!
Interesting product. I couldn’t tap the burger menu to see other pages so perhaps it’s answered, but what email clients are supported on PC (only see Mac screenshot)? Gmail? Outlook? Thunderbird?
Hi Hash,
It's not mentioned explicitly on the landing page - but it should, so will add that! :) We have support for Outlook for PC and Mac and Apple Mail for Mac.
Hi Daniel!
The website looks professional.
I would like to mention two things:
http://app.signkit.io/users/password page is vulnerable to User Enumeration, meaning currently the system reveals if the entered email address exists in the database.
Hi Onar,
Thank you very much for you feedback!
I've enabled SSL - thanks for the suggestion.
Great find re. vulnerability to User Numeration. Will work on a solution for that 👍
How do you prevent this issue if I try to signup with a bunch of different emails just to try to see if a user exists?
The main reason for not disclosing active user is to prevent a large number of enumeration attempts. There is a fine line between security and usability tho. One way I can think of is to adopt a good captcha system. After a few attempts, the system will trigger a captcha to slow down enumeration attempts.
This is all somewhat opinion based but you're sacrificing your existing users experience for that of making it slightly more annoying for evil users. At the end of the day it's your existing, possible paying, customers who suffer the most.
Disagree. This is a very common practice. I wouldn't say it is slightly annoying. Google reCAPTCHA is user-friendly and very much effective. As I mentioned above, asking for a captcha after 5 attempts won't hurt a user and give you a piece of mind.
I don't think I expressed myself clearly; I 100% agree with the captcha argument.
I meant that user enumeration problem is very hard to fix and sometimes the suggested fixes are detrimental to real users. For example, when a failed login attempt is execute the suggestion is to provide a vague error message such as "username or password is invalid" instead of simply saying "password is invalid". To me, this is a poor user experience because an attacker can confirm that the user exists by attempting to register with the same username and getting an error that the user already exists (it's hard to get rid of this error).
I agree, additionally if I wanted to know if a username exists, I can simply try to register a new account with the username. If the account exists, the response will indicate it’s been taken.
Rate limiting logins/registration would seem to be the only way to mitigate... as far as I know.
Definitely. This may be the reason why it is not considered serious vulnerability. It is an open problem waits to be solved.
This comment was deleted 9 years ago