Hacker News Reader

Right. I understand that having that option lets you mitigate some problem. Can anyone expand on what this option does and how it mitigates the problem? Did I miss something from the blog post?

View on HN

Sure -- AFAIK the problem was that Mailchimp was hacked, and the hacker was able to see and intercept the password reset links being sent to the customer by looking at Mailchimp log data. This option indicates that links should not be stored in log data, so even if an attacker has compromised your Mandrill account, they should be unable to see the exact reset links that are being sent.

edit: worth noting that there are obviously other ways a hacked Mandrill/Mailchimp account could be abused. This just shuts down one of the major abuses you could perform.

Mailgun, not Mailchimp.

Those are two entirely separate companies (unlike Mandrill and Mailchimp which is the same company.)

Thanks. I did indeed miss critical parts of the post. I will review again.

Reply on news.ycombinator.com