You don’t need a password. Posterous fail.
blog.dustincurtis.com
You don’t need a password. Posterous fail.
1–10 of 84 posts
Re: You don’t need a password. Posterous fail.
#2This is definitely happening in the wild, as well. A friend of mine had some spam advertising a mobile phone site posted to her Posterous, which fed into her Facebook feed, etc..
Re: You don’t need a password. Posterous fail.
#3It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened.
It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to approve before stuff is posted?
Re: You don’t need a password. Posterous fail.
#4Not so big a deal IMHO. You can always set a pass if spammers start targeting your blog.
Re: You don’t need a password. Posterous fail.
#5I did it. Sorry Dustin. It really was me. I changed one field in outlook.
I realise Posterous requires you to "confirm" the post, I just wanted to see if you had defaulted that requirement to off.
Re: You don’t need a password. Posterous fail.
#6It is easy.
$ /usr/sbin/sendmail -f dustin@dustincurtis.com
dustin@posterous.com
Subject: hi
Spam spam spam
^DRe: You don’t need a password. Posterous fail.
#7It is easy. $ /usr/sbin/sendmail -f dustin@dustincurtis.com dustin@posterous.com Subject: hi Spam spam spam ^D
You have to know his email address.
One quick whois lookup, and I found the email he was likely sending from. His site has another email listed, so I did a little digging.
Re: You don’t need a password. Posterous fail.
#8It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
No, they don't.
Re: You don’t need a password. Posterous fail.
#9It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.
Re: You don’t need a password. Posterous fail.
#10It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
Headers are manually created whenever programmatically sending email messages
To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like:
Date: Sat, 13 Jun 2009 06:53:06 -0400
From: Mail Delivery Subsystem
Message-Id:
To:
From: Steve Jobs