Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail accepts forged YouTube emails

john-millikin.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Gmail accepts forged YouTube emails

#51

Post by azca »

dfee wrote: post #50
orangepurple wrote: post #35

Earlier quoted context omitted.

DMARC is not a complete solution Many email clients don't preserve message integrity when mail is forwarded, which breaks DKIM as well as SPF. Mailing lists still alter message fields which break DKIM and they forward mail, which breaks SPF. Mailing list software is being brought up to date to deal with this, by adjusting the "From" header and re-signing the message with updated DKIM information. Many users are still…

This is going to sound funny, but is there a way to sign only certain emails (out of all emails a user sends) instead of signing all messages with DNS based verification? I should mention specifically in a way that’s at least decently user accessible; ruling out GPG.

You can always sign based on specific rules via your MTA to sign some and not sign others. You can also send from many sender's (say allocated by spf allow rules) that aren't signed at all but matches the IP ranges allowed.

Re: Gmail accepts forged YouTube emails

#52

Post by azca »

jeffbee wrote: post #49
jmillikin wrote: post #47

Earlier quoted context omitted.

The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from. Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.

With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.

Remembering back to the uucp days and when certain OOB nodes came back up after outages, this is precisely why email as a standard can handle delayed delivery and MX records have preferences for relays that can queue for future delivery.

Re: Gmail accepts forged YouTube emails

#53

Post by jmillikin »

jeffbee wrote: post #49
jmillikin wrote: post #47

Earlier quoted context omitted.

The message has been forged, as can be observed from the From: header being a domain that the sending server was not authorized to send from. Whether a subset of the message -- in this case the body -- is authentic doesn't matter. If I were to MITM google.com and send back an archived snapshot from a month ago, that would be forged traffic even if it matches responses that Google had once sent.

With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.

It's not about the age! Look at the headers!

  Received: from 7n.robtoledoyour.com (7n.robtoledoyour.com. [2a01:7c8:bb01:51a::7])
  From: YouTube
That email was sent by , claiming to be .

YouTube has not created DNS records allowing to send or forward email on its behalf.

Re: Gmail accepts forged YouTube emails

#54

Post by jeffbee »

jmillikin wrote: post #53
jeffbee wrote: post #49

Earlier quoted context omitted.

With all due respect, you don’t know what you’re talking about. Relaying month-old traffic is completely acceptable in email.

It's not about the age! Look at the headers! Received: from 7n.robtoledoyour.com (7n.robtoledoyour.com. [2a01:7c8:bb01:51a::7]) From: YouTube That email was sent by , claiming to be . YouTube has not created DNS records allowing to send or forward email on its behalf.

You are inventing imaginary requirements for email that do not exist. The "From:" header is not part of the envelope. The "From:" header is protected by the DKIM signature. This message is from youtube.com. You received it via some other relay. Nothing about that is weird. People love relaying email all over the place.

Re: Gmail accepts forged YouTube emails

#55

Post by einpoklum »

> Gmail accepts forged YouTube emails

Well, you shouldn't use GMail. They're mining your emails for information and occasionally passing them on to the US government, as Edward Snowden has revealed. There are other email providers, both free and for-pay, which should suit your needs well enough.

Re: Gmail accepts forged YouTube emails

#56

Post by mise_en_place »

throwaway892238 wrote: post #33

Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years. If I'm a hacker trying to phish someone into…

Why would you use SNS to send emails? That just seems really silly to me. It’s meant for pub-sub. I’d alert with PagerDuty or OpsGenie, so I’d not only get an email but a text or voice call.

Re: Gmail accepts forged YouTube emails

#60

Post by bocytron »

jeffbee wrote: post #10
RKearney wrote: post #6

The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain

Correct, this message isn't forged, it's authentic. You can check the signature yourself.

Then why was it addressed to "alltimecaptaincool2019@gmail.com" and why was it sent from postalerts@robtoledoyour.com ?
Post reply on HN