Re:Gmail Account Hijacking Vulnerability
by bramblerose on Sunday November 06, 2016 @02:22PM
(#12886586)
How is this a vulnerability?
1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they always contain a correct envelope-from header, so the emails will typically show up as 'Google (sent by: [email protected])', or something along those lines.
2) gmail.com doesn't have a forced-fail SPF record, so one could just send emails From: [email protected] using /any/ mail server, as long as the receiving mail server doesn't interpret softfail as fail -- and it shouldn't.
1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they always contain a correct envelope-from header, so the emails will typically show up as 'Google (sent by: [email protected])', or something along those lines.
2) gmail.com doesn't have a forced-fail SPF record, so one could just send emails From: [email protected] using /any/ mail server, as long as the receiving mail server doesn't interpret softfail as fail -- and it shouldn't.