Let’s Encrypt CA inadvertently leaks users’ email addresses

Let’s Encrypt, the non-profit Certificate Authority (CA) that helps website administrators switch from HTTP to HTTPS quickly and effortlessly, has accidentally leaked 7,618 email addresses of its users.

Backed by the EFF, Mozilla Foundation, and several others organizations, Let’s Encrypt made some welcome security choices when it hired outside experts to conduct a security review of its software and the protocol it uses for automatic certificate issuance and management, and issued its first transparency report even before issuing its first certificate.

Still, no one is immune from making mistakes. In this case, the mistake seems to have been the result of bug in the automated system used to send out email to active subscribers.

Josh Aas, Executive Director of the Internet Security Research Group (ISRG), a public benefit corporation running the CA, explained that the bug “mistakenly prepended between 0 and 7,618 other email addresses to the body of the email,” and resulted in some subscribers being able to see other subscribers’ email addresses.

“The problem was noticed and the system was stopped after 7,618 out of approximately 383,000 emails (1.9%) were sent. Each email mistakenly contained the email addresses from the emails sent prior to it, so earlier emails contained fewer addresses than later ones,” he pointed out.

Aas has asked the recipients of these emails not to post lists of email addresses publicly, and has promised to share more information about how the leak happened at a future date.

One of the commenters on the incident noted that the emails in question were sent via a transactional email platform called Mandrill.

“Since the sensitive content appears in the message body of the emails, one imagines it might have been a bug on LE’s part when interacting with the Mandrill service. If so, shame on you, LE, and one hopes a strict process will be put in place to prevent this in futurem,” the commenter added.

“On the other hand, if Mandrill’s service was responsible for the leak, then as a provider of the very kind of service one expects not to exhibit this kind of fault, they should be sacked outright.”