Force changing all weak email passwords

[clivejo]

Hi,

When logging into customers CP there is a messaging say:

For the purpose:

1. We will force change ALL WEAK email accounts passwords for all mailboxes on our platform on Wednesday Feb 17th 2021.

How do we resellers help our customers with this change? ie how do we find out what you have changed the password to so clients can continue to use their mail boxes?

[NickGreen]

Hello,

All mailboxes that have weak passwords set will get their passwords automatically reset by our system to new randomly generated strong ones. After this each of your clients will be able to set new strong password of their choice for their mailboxes in Email -> Email Accounts menu of their corresponding account's control panel.

Best Regards,
Nick Green,
Technical Support Department.

[clivejo]

So basically we won't know until a client reports that they can no longer log in via their chosen email client?

[YASPE]

And what about new email limit for sending mails?

[NickGreen]

Hello,

We have decided not to forcibly change the weak email account passwords throughout the system until we find another approach regarding this case. We have however added additional per mailbox rate limit of 50 messages per hour and 300 per 24 hours window. The intention of these additional per mailbox limits is to reduce the volume of spam mails that could be sent through a compromised email account.

Best Regards,
Nick Green,
Technical Support Department.

[YASPE]

The limit that you have established does not work. If you want, I can tell you how to send unlimited emails from RP servers. There you have the problem. If you solve it, the ridiculous limit of 50 emails per hour would not be necessary.

[YASPE]

I think it's a good tool to control spam but some clients use only an only account and need more emails by hour, perhaps it will be better reduce limit from 1500 to 1000 in a day for the account.

[yav0r]

Nah, we won't be doing that at all. Came up with a better solution. We will not be suspending the e-mailbox, we will not change the password, we will simply reduce the e-mail sending capabilities for the mailbox to let's say 1 email per hour . Also, inject an e-mail from us into the mailbox with instructions on what needs to be done. Thus when someone goes into the mailbox to send an e-mail they will see our e-mail first. And if they don't they won't be able to send more than 1 e-mail per hour. Still working on it though, the solution may drastically change until we are ready as it did just last nite. ANY of those sollutions is viable and better than the alternative (we were 100% blocked for several hours on Friday... the needs of the many and all that).

[YASPE]

50 emails per hour is ridiculous