Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I "hacked" Dustin Curtis's Posterous.

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 123 posts

Re: How I "hacked" Dustin Curtis's Posterous.

#11

Post by there »

jgrahamc wrote: post #2

I agree with the conclusion. Posterous could fix this problem by implementing something like The Zucchini Method ( http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443... [PDF]). Basically, they could accept posts via email as long as the user included some hard to guess word (or other token) in the subject line.

or do what flickr does and give you a unique email address to send to that only you will know. you can add it to your address book so you won't have to remember it, and it's probably stronger than what most users would choose for a password.

Re: How I "hacked" Dustin Curtis's Posterous.

#12

Post by coderdude »

drp wrote: post #10

Hey, you left your door unlocked so I painted this sign on it to let everyone know.

That's what happens when you don't even have a door lock to begin with, then go tell the whole world about it. (Dustin told the whole world about not having a password. Not this guy.)

Re: How I "hacked" Dustin Curtis's Posterous.

#13

Post by bh42 »

robinduckett wrote: post #4
jcromartie wrote: post #3

If Dustin were a major corporation or a politician, you'd be talking to the FBI and facing prosecution right now. Nice hack, BTW.

Hardly a hack!

There doesn't have to be Knuth level computering for it to be a fun or easy, or simple, or elegant hack. And sadly the comment about the FBI is completely true. Any script kiddies reading this better keep that in mind.

Re: How I "hacked" Dustin Curtis's Posterous.

#14

Post by masklinn »

coderdude wrote: post #9

Why on Earth would anyone use the confirmation skip? That's basically security through obscurity. Even less so if the email address you use is known by people.

Convenience is often on the opposite end of the Security slider. Many people go whole hog on it.

Same with privacy, see Facebook.

Re: How I "hacked" Dustin Curtis's Posterous.

#15

Post by ergo98 »

Does Postereous not support SPF?

SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password.

Sadly SPF is grossly underused.

Re: How I "hacked" Dustin Curtis's Posterous.

#16

Post by ergo98 »

ergo98 wrote: post #15

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

As an aside, instead of post@, posterous should use a guid for each blog. e.g.

B566EA61026F474BA8ADB877FF765087@postereous.com

If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.

Re: How I "hacked" Dustin Curtis's Posterous.

#17

Post by eli »

ergo98 wrote: post #15

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

Sure, they could check SPF, but what if your mail server doesn't support it? Reject the message?

Re: How I "hacked" Dustin Curtis's Posterous.

#18

Post by [deleted] »

ergo98 wrote: post #16
ergo98 wrote: post #15

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

As an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.

[deleted]

Re: How I "hacked" Dustin Curtis's Posterous.

#19

Post by frognibble »

How does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain).

I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?

Re: How I "hacked" Dustin Curtis's Posterous.

#20

Post by lyso »

[deleted] wrote: post #18
ergo98 wrote: post #16

Earlier quoted context omitted.

As an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.

[deleted]

No, since the reply goes back to the real address.
Post reply on HN