Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I "hacked" Dustin Curtis's Posterous.

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 123 posts

Re: How I "hacked" Dustin Curtis's Posterous.

#111

Post by evandavid »

robinduckett wrote: post #8
some1else wrote: post #7

It seems like a fault that wouldn't hurt the entire system, but it may cause a dilemma similar to Facebooks design flaw, where disowned groups could be taken under control - http://mashable.com/2009/11/10/facebook-groups-hacked/ . As with every such flaw, it's likely to start attracking spammers, and should be dealt with in some way (Facebook seems to have disabled reclaiming ownership of groups without admins?)

post+uniqueapikey@posterous.com Would half fix this problem.

or even post+memorableuniqueword@posterous.com

Re: How I "hacked" Dustin Curtis's Posterous.

#112

Post by aquateen »

calcnerd256 wrote: post #90
aquateen wrote: post #83

Earlier quoted context omitted.

Basically what I am wondering is if he were to make a post to Pepsi's blog on Posterous, what would the federal crime be? The parent has a lot of upvotes, so I really want to know why they agree he committed a crime, rather than found a bug.

Upvotes aren't for agreeing.

Whether they found it insightful or interesting, they probably deemed the statement true. No need to split hairs.

Re: How I "hacked" Dustin Curtis's Posterous.

#113

Post by jonah »

3pt14159 wrote: post #59
jasongullickson wrote: post #37

Earlier quoted context omitted.

Locked or not it's still trespass, which is illegal, in most places.

Not in some parts of Canada. Trespass is only once you've told someone to leave (or have a sign saying "no trespassing). Otherwise you are free to walk on anyone's property (this is Canada wide) and sometimes enter their house (this is specific to certain areas). If a door is locked then obviously you arn't allowed in, but in the North you are granted "implicit" permission to go into someone's house if you would be i…

That's a very sane law. Have you heard of any problems with it in practice?

Re: How I "hacked" Dustin Curtis's Posterous.

#114

Post by ergo98 »

qjz wrote: post #95
ergo98 wrote: post #15

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

SPF doesn't verify the sender, it only tells you if the server is allowed to send mail from a domain. You can still use the password for your account to forge the sending address of another user in the domain. Besides, the fact that your domain requires a password is only meaningful to you; it has no value to the outside world in terms of identity assurance.

>You can still use the password for your account to forge the sending address of another user in the domain.

Very few mail servers allow you to that. Once you add sender authentication, it generally comes with sender authorization.

>Besides, the fact that your domain requires a password is only meaningful to you

Almost all SMTP servers are locked down now, most requiring authentication. Those that aren't get blacklisted pretty quickly.

SPF tells you that the sender is authorized to send on behalf of that person.

It solves 99.9% of the issue.

Re: How I "hacked" Dustin Curtis's Posterous.

#115

Post by ergo98 »

ComputerGuru wrote: post #52
jey wrote: post #42

Earlier quoted context omitted.

They should just use SPF. This is what SPF is designed for, and it allows them to keep the user experience simple and straightforward. No weird passphrase to enter into the email, no weird random email address to email to, etc.

SPF only identifies the sending domain, not the sender himself. If your address is gmail and my address is gmail, our mx domain has the same spf record and same IPs. Sure, some mail servers will prevent you from authenticating with one ID and sending as another, but many others will let that slide.

Which others? Give some examples.

Gmail won't. Hotmail won't. Yahoo won't. In fact I can't think of a single authenticating mail service that doesn't also validate authorization (e.g. you can only send as you).

Now maybe you're going to point out micro-mail servers, but that's kind of beside the point because very few other people share it with you. e.g. you used gmail as your example, but services like gmail aren't vulnerable to that.

Re: How I "hacked" Dustin Curtis's Posterous.

#116

Post by ergo98 »

guinness wrote: post #38

E-mail provides no security. An e-mail can be forged simply by using telnet to connect to and SMP server (usually your ISPs) and typing the appropriate message (see wikipedia SMTP. The easiest fix for this is PGP as mentionned in previous posts. This is, however, a horrible solution since it will alienate many users (think your mother). The simplest solution that will do a good enough job is to send back an e-mail to…

Which provides a great way to spam people. The preview idea sucks.

SPF solves almost all of the issue. Unique mailing addresses should be available for users who want it (yeah most people can handle an address book). The absence of those is just grossly incompetent.

Re: How I "hacked" Dustin Curtis's Posterous.

#117

Post by jbrennan »

xinsight wrote: post #84
jbrennan wrote: post #40

Earlier quoted context omitted.

You've made this celiac crave pancakes again. Bad.

You can't tolerate glutin and you've never tried buckwheat pancakes? I find them superior to normal wheat pancakes in every way.

Don't judge me.

Re: How I "hacked" Dustin Curtis's Posterous.

#118

Post by olefoo »

jrockway wrote: post #91
InclinedPlane wrote: post #89

Earlier quoted context omitted.

"smtp relay along the way"? This isn't UUCP, the message will go from A to B across the internet backbone. There will only be SMTP relays along the way if either your email host or the receiver's email host has chosen to set things up that way. We'd have a much bigger problem with internet security if everyone's email was relayed through questionable servers as a matter of course.

Most residential DSL and cable users are prohibited from connecting to port 25, except on a special "smarthost". This machine, and anyone reading its logs, will learn your blog password. More secure than no password, but not secure.

Fortunately most of the people who operate mail relays for ISPs are honest and responsible.

Re: How I "hacked" Dustin Curtis's Posterous.

#119

Post by code_duck »

Sending email apparently from a particular address, as described, is so simple I can't believe two things: 1, that Posterous was set up to let that happen and 2, that in 2010, the email system is still so dumb that I can send mail with any sender address that to the majority of people would be indistinguishable from mail genuinely from the sending address.

Re: How I "hacked" Dustin Curtis's Posterous.

#120

Post by coderdude »

coderdude wrote: post #96
a4agarwal wrote: post #82

Hey guys. I'm the cofounder of Posterous. Yes, someone did figure out how to post to Dustin's site today. This security hole is now fixed. We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing. For the vast majority of users who use gmail, hotmail or…

Odd, the other Posterous threads are getting buried so quickly. When a new comment is posted in any thread it appears at the top, except for these Posterous threads. Is this damage control on the part of YC? The only other person so far to comment under the co-founder on this thread (at time of writing) is jseeba, who has had very little activity and one of the few comments he's ever made was in a thread called "Ask…

For the record, jseeba emailed me and let me know that he's just a lurker and not part of this.
Post reply on HN