You don’t need a password. Posterous fail.

Re:You don’t need a password. Posterous fail. by jcnnghm on Friday June 18, 2010 @08:38AM (#1441992)

Headers are manually created whenever programmatically sending email messages

To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like:

  Date: Sat, 13 Jun 2009 06:53:06 -0400
  From: Mail Delivery Subsystem <MAILER-DAEMON>
  Message-Id: <200906131053.n5DAr2Nv025105@jclinux>
  To: <root@jclinux>

To change the sender, all you'd need to do is change the from line. For example:

  From: Steve Jobs <[email protected]>

A default sendmail implementation will deliver that message all day. Email headers should never be used for authentication.

[ Parent | on HN ]

Re:You don’t need a password. Posterous fail. by robinduckett on Friday June 18, 2010 @08:44AM (#1442008)

That was my point. When I read in his article that he wasn't requiring a password to post, I thought I'd see if he was telling the truth, turns out he was.

[ Parent | on HN ]

Re:You don’t need a password. Posterous fail. by adamsmith on Friday June 18, 2010 @12:39PM (#1442769)

But most major domains use domain keys / DKIM.

http://en.wikipedia.org/wiki/DKIM

As far as I understand it, you can't fake being an SMTP server sending mail from such a domain because their emails get signed with a private key whose matching public key is published by DNS.

[ Parent | on HN ]

Re:You don’t need a password. Posterous fail. by geocar on Friday June 18, 2010 @01:26PM (#1442971)

There are several ways to defeat DKIM here:

• If you can break DNS, you can get an NXDOMAIN reply, making recipients think there aren't any domainkeys

• If the domainkey private key is small, you can factor it. There's an article on HN's frontpage right now about this.

• If the server uses domainkeys, but it doesn't specifically verify the From: header, an attacker can still forge a message if they share a popular mail provider with their target. I don't know if this is still practical.

• Stupidity. DKIM is difficult to test, and as a security measure it would need to be tested.

An autoreponse confirmation would be immune to all of these attacks and would be trivial to implement correctly.

[ Parent | on HN ]

Re:You don’t need a password. Posterous fail. by apphacker on Friday June 18, 2010 @01:48PM (#1443039)

An auto-response confirmation would make posterous suck.

[ Parent | on HN ]

Re:You don’t need a password. Posterous fail. by geocar on Sunday June 20, 2010 @08:18PM (#1447497)

and yet DKIM is insecure for sender authentication.

[ Parent | on HN ]