News for hackers. Stuff that matters.
Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by eli on Tuesday December 22, 2015 @03:55PM (#10780344)
At the risk of stating the obvious, a From or Reply-To address of [email protected] doesn't necessarily mean that Yahoo had anything to do with the message.
Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by dredmorbius on Tuesday December 22, 2015 @05:42PM (#10780859)
I've got more experience in hunting down spam than is healthy and can read headers.

Receiving SPF, DKIM validated spam from Yahoo's email systems, then discovering there's absolutely no way in hell to kick it back to them, sours one rather rapidly.

Trying to send mail to Yahoo has been roughly equally annoying for about as long.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by pyre on Tuesday December 22, 2015 @07:58PM (#10781409)
You're not Google or Microsoft, so you don't matter as an email provider.

  -- The Yahoo! Mail Team
Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by Pyxl101 on Tuesday December 22, 2015 @10:18PM (#10781761)
Can you clarify regarding no way to kick it back to them? My understanding was that they operate typical feedback loops per RFC 6449 (though I haven't personally verified this).

They also host a spam FAQ which has a link to a form to submit spam reports: https://help.yahoo.com/kb/SLN3402.html

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by dredmorbius on Wednesday December 23, 2015 @11:07AM (#10783922)
Try self-hosted mail. The section on reporting spam from Yahoo conspicuously omits such options as submitting full headers to abuse or postmaster. Doing so in past (mutt, full headers) generates a "you're holding it wrong" messagee.

This goes back years, I've not tried recently, status may have changed. But again, the long, long term experience has been pretty sour.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by Pyxl101 on Wednesday December 23, 2015 @03:46PM (#10785539)
The section on reporting spam from Yahoo has a link to a form where you can submit spam reports from Yahoo:

> Submit your report using our "Got Spam?" form if your email provider doesn't offer a spam reporting feature.

The "Got Spam?" link takes you to a form where you can supply the headers and content of the spam message sent from Yahoo.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by dredmorbius on Wednesday December 23, 2015 @11:21PM (#10787108)
What part of "mail to abuse@ or postmaster@ fails" don't you understand?

The web-form workflow breaks in many ways: console tools (which I use for email), mobile, and more.

The fact that I can simply "bounce" the whole message at Yahoo's spamtraps, if they had such a thing, and they can sort the message's legitimacy and structure themselves, but they don't allow this, speaks volumes.

And again, this shit for a decade or more.

Now, if Yahoo wanted to creat CLI tools to incorporate into mailflows for those of us who know what we're doing to slot into their systems, great.

But ultimately, their problems aren't mine, I've washed my hands.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by jlgaddis on Tuesday December 22, 2015 @08:04PM (#10781428)
I manage e-mail systems with thousands of users. I'm quite capable of looking at mail headers and figuring out where a message originates. Besides that, messages originating at Yahoo! are DKIM signed.
Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by grandalf on Wednesday December 23, 2015 @12:59AM (#10782192)
True, but Yahoo doesn't consider a properly DKIM or Domainkeys email something that should not just end up in the spam folder...

My experience with Yahoo mail is that there are tons of false positives on spam, and that none of the headers matter much... preference is given to a small number of whitelisted sending companies.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by jlgaddis on Wednesday December 23, 2015 @01:31AM (#10782253)
Sorry, I was referring to messages received at my mail system that originate on Yahoo!'s mail system; more specifically, messages that are signed by a yahoo.com key and coming from a yahoo.com mail host (according to DKIM and SPF).

Anyways...

> "Yahoo doesn't consider a properly DKIM or Domainkeys email something that should not just end up in the spam folder"

Nor should they. There's plenty of actual spam that passes SPF and DKIM checks -- which brings us back to my original point (the amount of spam that I receive from Yahoo!). A message should not be treated as non-spam just because it passes those checks -- they are merely one factor to consider.

Re:Notifying Our Users of Attacks by Suspected State-Sponsor... by grandalf on Wednesday December 23, 2015 @12:07PM (#10784279)
> Nor should they

Of course not as the only criterion. But the messages in question were not spam, they were legitimate emails with DKIM, Domainkeys, SPF, long term non-spam IP address, etc.