Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You don’t need a password. Posterous fail.

blog.dustincurtis.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: You don’t need a password. Posterous fail.

#51

Post by infinite8s »

tman wrote: post #31
axod wrote: post #27

Earlier quoted context omitted.

> "The other fix would be to use an email address that can't be guessed from the blog address. In other words, the email address is the password." You'd still be sending your password in the clear, possibly through other peoples mail servers. Not great security.

The perfect is the enemy of the good. There is a trade-off here between security and usability. 99% security is good enough for a lot of purposes and has its place.

Except that's more like 10% or even 1% security.

Re: You don’t need a password. Posterous fail.

#52

Post by adamsmith »

jcnnghm wrote: post #10
jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

Headers are manually created whenever programmatically sending email messages To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like: Date: Sat, 13 Jun 2009 06:53:06 -0400 From: Mail Delivery Subsystem Message-Id: To: To change the sender, all you'd…

But most major domains use domain keys / DKIM.

http://en.wikipedia.org/wiki/DKIM

As far as I understand it, you can't fake being an SMTP server sending mail from such a domain because their emails get signed with a private key whose matching public key is published by DNS.

Re: You don’t need a password. Posterous fail.

#54

Post by macrael »

isleyaardvark wrote: post #14
loewenskind wrote: post #13

Earlier quoted context omitted.

99% of the time? So if someone decides to trash my reputation they can just post a bunch of stupid blog entries as me and it is on me to (a) detect that this even happened by checking my mail, (b) go do whatever work needed to remove the post and (c) try to explain to everyone what happened (likely causing even more people to do it when they realize how ridiculous the system I'm using is) and salvage my reputation? T…

You can already post a bunch of stupid blog comments as someone else, as long as people realize Posterous has a similar problem, it's not going to ruin your life. (Plus, (a) doesn't seem to be that big of a problem for a service you're using your email to access.)

Commenting on someone's site using a different name is pretty different from being able to fake a post. I have no expectation that comments are written by who they say they are, but I do expect all the posts to be written by the same person.

Re: You don’t need a password. Posterous fail.

#55

Post by tman »

infinite8s wrote: post #51
tman wrote: post #31

Earlier quoted context omitted.

The perfect is the enemy of the good. There is a trade-off here between security and usability. 99% security is good enough for a lot of purposes and has its place.

Except that's more like 10% or even 1% security.

Oh really? I don't think you know what you mean.

In point of fact, I just sent myself a very important password in clear text. Hack me.

Re: You don’t need a password. Posterous fail.

#56

Post by ergo98 »

jcnnghm wrote: post #3

It's possible to forge headers in certain circumstances. It's not easy. And this is the first time this has happened. It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to…

I honestly am at a loss to understand how Dustin Curtis keeps getting linked from here.

Re: You don’t need a password. Posterous fail.

#57

Post by puredemo »

codeflo wrote: post #41
[deleted] wrote: post #40

Earlier quoted context omitted.

[deleted]

I guess nobody believed you, because it sounds so ridiculous. Do you have an idea why Google imposes that rule?

I'm not sure it's true. Do a quick search on Google news and click some links -- there are plenty of results that don't have numbers in the url.

Re: You don’t need a password. Posterous fail.

#58

Post by geocar »

adamsmith wrote: post #52
jcnnghm wrote: post #10

Earlier quoted context omitted.

Headers are manually created whenever programmatically sending email messages To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like: Date: Sat, 13 Jun 2009 06:53:06 -0400 From: Mail Delivery Subsystem Message-Id: To: To change the sender, all you'd…

But most major domains use domain keys / DKIM. http://en.wikipedia.org/wiki/DKIM As far as I understand it, you can't fake being an SMTP server sending mail from such a domain because their emails get signed with a private key whose matching public key is published by DNS.

There are several ways to defeat DKIM here:

• If you can break DNS, you can get an NXDOMAIN reply, making recipients think there aren't any domainkeys

• If the domainkey private key is small, you can factor it. There's an article on HN's frontpage right now about this.

• If the server uses domainkeys, but it doesn't specifically verify the From: header, an attacker can still forge a message if they share a popular mail provider with their target. I don't know if this is still practical.

• Stupidity. DKIM is difficult to test, and as a security measure it would need to be tested.

An autoreponse confirmation would be immune to all of these attacks and would be trivial to implement correctly.

Re: You don’t need a password. Posterous fail.

#59

Post by pg »

josefresco wrote: post #24

Sure active users will notice spam posts but what about the long tail of customers who no longer update their Posterous blog? What happens when a 'creative' link marketer finds a way to index those sites and inject posts?

Running a spam filter on posts should work well.

Re: You don’t need a password. Posterous fail.

#60

Post by [deleted] »

mitchellhislop wrote: post #36
codeflo wrote: post #30

While we're talking about Posterous, does anyone know why it adds a random number to the end of article URLs, as in http://blog.dustincurtis.com/apparently-765 ? I know it's not a big deal, but I find that aesthetically unpleasing, as it kind of ruins an otherwise beautiful URL.

It might be a namespace thing? I have seen that too, and that is the only thing that comes to mind.

[deleted]
Post reply on HN