Live data from Hacker News

How I "hacked" Dustin Curtis's Posterous.

news.ycombinator.com

21–30 of 123 posts

Re: How I "hacked" Dustin Curtis's Posterous.

#21

How does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain). I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?

> Does Posterous fallback to just checking the sender email address?

Apparently so, I didn't even change my name.

Re: How I "hacked" Dustin Curtis's Posterous.

#22
post #17
post #15

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

Sure, they could check SPF, but what if your mail server doesn't support it? Reject the message?

If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.

Re: How I "hacked" Dustin Curtis's Posterous.

#23

How does Posterous authenticate a message in the absence of DKIM or SPF records in DNS? The domain dustincurtis.com does not have an SPF record and DKIM is not supported by the mail host for dustincurtis.com(Google Apps for your Domain). I assumed that Posterous did something clever using the IP address of the SMTP peer or the headers in the message. Does Posterous fallback to just checking the sender email address?

> Does Posterous fallback to just checking the sender email address? Apparently so, I didn't even change my name.

Do you use Google Apps For Your Domain? If so, that might have foiled any IP address checking because dustincurtis.com is also hosted there.

EDIT: You must not be using Google Apps for Your Domain because Google does not allow sender forging.

Re: How I "hacked" Dustin Curtis's Posterous.

#24
post #2

I agree with the conclusion. Posterous could fix this problem by implementing something like The Zucchini Method ( http://www.jgc.org/antispam/03152005-2150120647b00f4af9d3443... [PDF]). Basically, they could accept posts via email as long as the user included some hard to guess word (or other token) in the subject line.

Perhaps a compromise would be to give the user the option to send emails to a hard-to-guess email address and then, if the user comes across the situation where he needs to delete a spoofed post, make a note near the deletion link that the option is available

This way, grandpa talking about his dog doesn't need to bother learning about security he doesn't really care about and the power user can post securely if it so happens that someone decides to spam his blog

Re: How I "hacked" Dustin Curtis's Posterous.

#25
post #18
post #16

Earlier quoted context omitted.

As an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.

[deleted]

How embarrassing for you. How exactly would the email go to the forger if they are spoofing YOUR email address. Coffee in the morning, gin at night. Never switch the two.

Re: How I "hacked" Dustin Curtis's Posterous.

#26
post #22
post #17

Earlier quoted context omitted.

Sure, they could check SPF, but what if your mail server doesn't support it? Reject the message?

If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.

Yeah, as soon as I saw this post I thought of SPF and DomainKeys.

Seems simple:

If your mail/DNS is setup to support either of these, then cool you don't need to confirm.

Else, you must "ok" each post.

DONE

Re: How I "hacked" Dustin Curtis's Posterous.

#27
This is a clear example of "good enough." Low security for low value targets -- if you need more you can get it. Setting a password, remembering a special email address, not posting via blackberry/mobile, all of these add friction.

EDIT: Although it is fun to think of solutions ... Posterous could mail you back a link; when you hit the link the post goes live. Then you would clearly need control of the sending address to post. And the link could just go to the new article, which you'll likely want to look at anyway.

Re: How I "hacked" Dustin Curtis's Posterous.

#28
post #25
post #18

Earlier quoted context omitted.

[deleted]

How embarrassing for you. How exactly would the email go to the forger if they are spoofing YOUR email address. Coffee in the morning, gin at night. Never switch the two.

People can't always be right, eh?

I was mistaken. You're right, I haven't had my coffee yet.

Re: How I "hacked" Dustin Curtis's Posterous.

#29

This is a clear example of "good enough." Low security for low value targets -- if you need more you can get it. Setting a password, remembering a special email address, not posting via blackberry/mobile, all of these add friction. EDIT: Although it is fun to think of solutions ... Posterous could mail you back a link; when you hit the link the post goes live. Then you would clearly need control of the sending addres…

I second. I have some flowers outside my house and they never got stolen. I think a lot of hackers overrate security just like a lot of nurses see diseases everywhere.

Re: How I "hacked" Dustin Curtis's Posterous.

#30

If Dustin were a major corporation or a politician, you'd be talking to the FBI and facing prosecution right now. Nice hack, BTW.

Hardly a hack!

it's a hack in the Bruce Schneier "easiest way to steal pancakes has nothing to do with where money changes hands" sense...

Our goal is to eat, without paying, at the local restaurant. And we've got a lot of options. We can eat and run. We can pay with a fake credit card, a fake check, or counterfiet cash. We can persuade another patron to leave the restraunt without eating and eat his food. We can impersonate (or actually become) a cook, a waiter, a manage, or the restraunt owner (who might actually be someone that few workers have ever met). We could snatch a plate off someone's table before he eats it, or from under the heat lamps before the waiter could get to it. We can wait at the dumpster for the busboy to throw away the leftovers. We can pull the fire alarm and sneak in after everyone evacuates. We can even try to persuade the manager that we're some kind of celebrity who deserves a free breakfast, or maybe we can find a gullible patron and tal her into paying for our food. We could mug someone, nowhere near the restraunt, and buy the pancakes. We could forge a coupon for free pancakes. And there's always the time-honored tradition of pulling a gun and shouting, "Give me all your pancakes".

Post reply on HN