Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail accepts forged YouTube emails

john-millikin.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: Gmail accepts forged YouTube emails

#41

Post by RockRobotRock »

orangepurple wrote: post #35
throwaway892238 wrote: post #33

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into…

DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still…

I'm a satisfied Fastmail user, but it was down all day today for me :(

Re: Gmail accepts forged YouTube emails

#42

Post by dane-pgp »

beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Big email providers need to set a flag day after which they will drop all email from domains that don't have DKIM+SPF. Their servers also have to support TLS for sending and receiving mail.

That's the easy half. Next, we need a stronger system of domain reputation. For this, we grandfather in all existing domain names, but any newly registered domains need to put up a bond for good behaviour. If one of the big email providers detects high levels of spam from the domain, they can slash the bond, but after a few years of good behaviour the bond is returned.

Of course this gives a lot of unelected power to the big providers, but guess what, they already have that power, except they're using it for making their moat bigger, not for actually solving the problem. If this bond system used a public ledger, then smaller competitors would be able to see the reputation decisions that these big providers made, and crypto-currency would also be suitably international for a global system like email.

Re: Gmail accepts forged YouTube emails

#43

Post by jeffbee »

kazinator wrote: post #32
RKearney wrote: post #6

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain

... "In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices." Hmm, article references an e-mail post by good old John Levine, moderator of comp.compilers for over 30 years, who has some interesting things to say: "[If] I were a certain kind of bad guy, I would take the two seal ARC chain from a message from…

You're implying that this message has been tampered with, but it has not. It is perfectly authentic. Whoever produced this message possesses the private signing key of youtube.com. This message has in no way been forged.

The only mystery here is why someone is mirroring google mail back to gmail with unexpected envelope recipients. It could be a weird error, or it could be they think they can game the IP reputation system by doing it.

In any case, the fine moderators ought to correct the title, because it is wrong and misleading.

Re: Gmail accepts forged YouTube emails

#44

Post by superasn »

KennyBlanken wrote: post #11

Meanwhile, Gmail is obsessed with tagging messages I get from nearly every mailing list I'm on, including ones hosted by google groups , as spam. Even messages sent by a gmail user, to a google group. Outdoor groups? Spam. Technical mailing lists? Spam. Social group mailing lists? Spam. I have filters assigning these messages to labels. I have been on some of these lists for ten fucking years . I routinely go into my…

This is so true. This false spam tagging has caused me so much pain with paying customers, I ended up white listing all email to a particular to address using a filter.

It's unbelievable that email is so fragile and broken.

Re: Gmail accepts forged YouTube emails

#45

Post by dwallin »

beders wrote: post #14

What would it take to rescue email? What would need to happen to make it less annoying for you?

Honestly I think email needs to be rethought from the ground up, just a whole new protocol with a killer app to get it going.

Some of the most salient uses/qualities of email: - Asynchronous communication - Decentralized / Federated - Identity

Issues: - Spam - Lack of room for the format to expand - Identification verification is hard

My ideal replacement for email would look something like a decentralized/federated identity protocol with default whitelist for contact upon which you build out data formats for sharing.

One key spam reduction technique in a federated system is to realize that most legitimate interactions are with people and services you are already in contact with so it’s better to make initial connections harder to improve the quality of daily use. Another tool that works decently in a decentralized system is introductions/vouching. Eg. you can ask mutual contacts to connect you or at larger scale you can entrust third party services to “vouch” for a user, similar to how certs work. If a vouching service does a poor job of vetting who it lets through than users will stop trusting it.

Re: Gmail accepts forged YouTube emails

#46

Post by dx034 »

RockRobotRock wrote: post #41
orangepurple wrote: post #35

Earlier quoted context omitted.

DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still…

I'm a satisfied Fastmail user, but it was down all day today for me :(

I haven't experienced any downtime, was that a regional issue?

Re: Gmail accepts forged YouTube emails

#47

Post by jmillikin »

jeffbee wrote: post #43
kazinator wrote: post #32

Earlier quoted context omitted.

... "In fact, an ARC chain can be counterfeited,[3] so ARC processing applies when receivers trust the good faith of ARC signers, but not so much their filtering practices." Hmm, article references an e-mail post by good old John Levine, moderator of comp.compilers for over 30 years, who has some interesting things to say: "[If] I were a certain kind of bad guy, I would take the two seal ARC chain from a message from…

You're implying that this message has been tampered with, but it has not. It is perfectly authentic. Whoever produced this message possesses the private signing key of youtube.com. This message has in no way been forged. The only mystery here is why someone is mirroring google mail back to gmail with unexpected envelope recipients. It could be a weird error, or it could be they think they can game the IP reputation s…

The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from.

Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.

Re: Gmail accepts forged YouTube emails

#48

Post by orangepurple »

dx034 wrote: post #46
RockRobotRock wrote: post #41

Earlier quoted context omitted.

I'm a satisfied Fastmail user, but it was down all day today for me :(

I haven't experienced any downtime, was that a regional issue?

There are a few problems but it works for me

https://www.fastmailstatus.com/services/general

Re: Gmail accepts forged YouTube emails

#49

Post by jeffbee »

jmillikin wrote: post #47
jeffbee wrote: post #43

Earlier quoted context omitted.

You're implying that this message has been tampered with, but it has not. It is perfectly authentic. Whoever produced this message possesses the private signing key of youtube.com. This message has in no way been forged. The only mystery here is why someone is mirroring google mail back to gmail with unexpected envelope recipients. It could be a weird error, or it could be they think they can game the IP reputation s…

The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from. Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.

With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.

Re: Gmail accepts forged YouTube emails

#50

Post by dfee »

orangepurple wrote: post #35
throwaway892238 wrote: post #33

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into…

DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still…

This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification?

I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.

Post reply on HN