Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t need a password. Posterous fail.

blog.dustincurtis.com

Post reply on HN
Print view View original

11–20 of 84 posts

Re: You don’t need a password. Posterous fail.

#11

Post by borisk »

jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

Headers are name/value pairs, a typical email will have 20 of those. It's possible to copy them if you have received an email from the blog owner or maybe from a mailing list post.

Re: You don’t need a password. Posterous fail.

#12

Post by robinduckett »

jcnnghm wrote: post #10
jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

Headers are manually created whenever programmatically sending email messages To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like: Date: Sat, 13 Jun 2009 06:53:06 -0400 From: Mail Delivery Subsystem Message-Id: To: To change the sender, all you'd…

That was my point. When I read in his article that he wasn't requiring a password to post, I thought I'd see if he was telling the truth, turns out he was.

Re: You don’t need a password. Posterous fail.

#13

Post by loewenskind »

edanm wrote: post #9
jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.

99% of the time? So if someone decides to trash my reputation they can just post a bunch of stupid blog entries as me and it is on me to (a) detect that this even happened by checking my mail, (b) go do whatever work needed to remove the post and (c) try to explain to everyone what happened (likely causing even more people to do it when they realize how ridiculous the system I'm using is) and salvage my reputation?

That doesn't sound like "works 99% of the time" to me, that sounds like an epic fail.

EDIT: It appears that this was more of a configuration issue, so the above only applies if you set up your account this way.

Re: You don’t need a password. Posterous fail.

#14

Post by isleyaardvark »

loewenskind wrote: post #13
edanm wrote: post #9

Earlier quoted context omitted.

As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.

99% of the time? So if someone decides to trash my reputation they can just post a bunch of stupid blog entries as me and it is on me to (a) detect that this even happened by checking my mail, (b) go do whatever work needed to remove the post and (c) try to explain to everyone what happened (likely causing even more people to do it when they realize how ridiculous the system I'm using is) and salvage my reputation? T…

You can already post a bunch of stupid blog comments as someone else, as long as people realize Posterous has a similar problem, it's not going to ruin your life. (Plus, (a) doesn't seem to be that big of a problem for a service you're using your email to access.)

Re: You don’t need a password. Posterous fail.

#15

Post by Terretta »

borisk wrote: post #4

Not so big a deal IMHO. You can always set a pass if spammers start targeting your blog.

The password is for visiting, not for posting. If you set a password, nobody can visit your blog w/o the password.

http://posterous.com/help/private_sites

"You can set a password on your Posterous site so only the readers you want can see it. To see your site, a user must go to your site url and also enter the correct password for your site."

Re: You don’t need a password. Posterous fail.

#16

Post by leftnode »

edanm wrote: post #9
jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.

Shouldn't it work oppositely? Prevent the post from appearing until you explicitly approve it from a link in an email.

Re: You don’t need a password. Posterous fail.

#17

Post by Terretta »

Two solutions:

1. Change from "Contributors can post" to "Anyone can post". Counterintuitive, but the first is based on email FROM, the second is moderated.

2. Make a hash as your FROM address. Add it as an alias to send from in Gmail (or whatever you use). Send to posterous from the hash address. Your email address becomes your password.

Re: You don’t need a password. Posterous fail.

#18

Post by gommm »

What I'm surprised is why posterous doesn't do more check on all the headers sent by the email software (X-Mailer, and so on) and ask for a confirmation if those other headers are different enough from a known correct configuration...

Of course someone who received an email from the blog owner could use that to fake all those headers but at least it would prevent people posting by simply guessing the email address.

Re: You don’t need a password. Posterous fail.

#19

Post by megamark16 »

leftnode wrote: post #16
edanm wrote: post #9

Earlier quoted context omitted.

As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.

Shouldn't it work oppositely? Prevent the post from appearing until you explicitly approve it from a link in an email.

Yes, and unless I'm missing something I don't see a way to turn this type of confirmation-before-posting functionality on.
Post reply on HN