It is easy. $ /usr/sbin/sendmail -f dustin@dustincurtis.com dustin@posterous.com Subject: hi Spam spam spam ^D
You don't even need to know the command line, you can often do stuff like that just from Outlook.
You don’t need a password. Posterous fail.
21–30 of 84 posts
Re: You don’t need a password. Posterous fail.
#22It is easy. $ /usr/sbin/sendmail -f dustin@dustincurtis.com dustin@posterous.com Subject: hi Spam spam spam ^D
Or,
$ telnet mailhost.com 25
HELO myserver.hostname.com
MAIL FROM: dustin@dustincurtis.com
RCPT TO: post@posterous.com
DATA
Subject: Hello
spam spam
.
QUITRe: You don’t need a password. Posterous fail.
#23Two solutions: 1. Change from "Contributors can post" to "Anyone can post". Counterintuitive, but the first is based on email FROM, the second is moderated. 2. Make a hash as your FROM address. Add it as an alias to send from in Gmail (or whatever you use). Send to posterous from the hash address. Your email address becomes your password.
> "Contributors can post" ... is based on email FROM
Sounds somewhat mislabelled then.
Re: You don’t need a password. Posterous fail.
#24Sure active users will notice spam posts but what about the long tail of customers who no longer update their Posterous blog? What happens when a 'creative' link marketer finds a way to index those sites and inject posts?
Re: You don’t need a password. Posterous fail.
#25It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
Headers are name/value pairs, a typical email will have 20 of those. It's possible to copy them if you have received an email from the blog owner or maybe from a mailing list post.
You only need to know the owner's email address.
Access to a message or a mailing list post by them won't provide any further advantage.
Re: You don’t need a password. Posterous fail.
#26Posterous really does fail here. I can see why they would want to tolerate a little of this to preserve ease of use for their users (just like Amazon with their Kindle email address). However, there are a number of steps that Posterous can take to combat forged headers in ways that should not impact users at all. Enabling SPF, for example, would be a good start.
Technically, it's the same problem as email spam, and most of the same tools can be used to combat it. Posterous should flag posts that they aren't sure of and make users confirm them before putting them up, etc.
EDIT:
The other fix would be to use an email address that can't be guessed from the blog address. In other words, the email address is the password.
Re: You don’t need a password. Posterous fail.
#27Posterous really does fail here. I can see why they would want to tolerate a little of this to preserve ease of use for their users (just like Amazon with their Kindle email address). However, there are a number of steps that Posterous can take to combat forged headers in ways that should not impact users at all. Enabling SPF, for example, would be a good start. Technically, it's the same problem as email spam, and m…
> "The other fix would be to use an email address that can't be guessed from the blog address. In other words, the email address is the password."
You'd still be sending your password in the clear, possibly through other peoples mail servers. Not great security.
Re: You don’t need a password. Posterous fail.
#28It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
I updated the post to reflect reality.
Usually, Posterous catches this stuff and sends an email asking you to confirm that you really are you. They analyze the headers more closely than just looking at the name. For some reason, this didn't work in this case.
Re: You don’t need a password. Posterous fail.
#29It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…
I updated the post to reflect reality. Usually, Posterous catches this stuff and sends an email asking you to confirm that you really are you. They analyze the headers more closely than just looking at the name. For some reason, this didn't work in this case.
According to him he just changed his email address to your email address in Outlook.
Edit: dcurtis edited his comment. Originally he claimed there was some kind of secret algorithm that prevents spoofing.
Re: You don’t need a password. Posterous fail.
#30While we're talking about Posterous, does anyone know why it adds a random number to the end of article URLs, as in http://blog.dustincurtis.com/apparently-765 ? I know it's not a big deal, but I find that aesthetically unpleasing, as it kind of ruins an otherwise beautiful URL.