Live data from Hacker News

You don’t need a password. Posterous fail.

blog.dustincurtis.com

81–84 of 84 posts

Re: You don’t need a password. Posterous fail.

#81
post #9

Earlier quoted context omitted.

As I understand it, they send you a mail telling you about the post and letting you remove it. Not perfect, but probably works 99% of the time.

99% of the time? So if someone decides to trash my reputation they can just post a bunch of stupid blog entries as me and it is on me to (a) detect that this even happened by checking my mail, (b) go do whatever work needed to remove the post and (c) try to explain to everyone what happened (likely causing even more people to do it when they realize how ridiculous the system I'm using is) and salvage my reputation? T…

Clarification: by 99%, I meant it works for 99% of users, whom no one will ever try and attack. Obviously it's just my opinion.

Re: You don’t need a password. Posterous fail.

#82
Strange that none noted that identity based encryption (IBE for the acquainted ones)solves this problem quite easily (more on http://www.voltage.com/technology/ibe.htm). Boneh and Franklin scheme was the first proposed one, but nowadays this is not only on crypto papers, but they are even RFCS for such schemes: http://www.rfc-editor.org/rfc/rfc5409.txt. There are even some non-commercial implementations around: http://crypto.stanford.edu/ibe/.

Of course, not using such full blown solutions will mean that posterous' heuristics techniques will be susceptible to all sorts of attacks, such as man-in-the-middle, relay attacks and so forth.

On the other hand, looking for solutions that are resilient to more sophisticated attacks, mostly considering IBE schemes, is quite convoluted (it involves provable security models, such as http://www.google.com/#hl=en&q=provable+security+signatu... ). There are even variations on IBE, such as certificateless, which require you to trust even less people.

This is of course, assuming you are not willing to inconvenience users by making them reply a email you send them after they tried to poste. Such email would contain a custom made url (the secret) that would enable the post to actually be posted. On the other hand, this solution feels more inconvenient than using OAuth methods.

Nonetheless, not all users care about security/privacy (those that do, will always have the usual login scheme). If you chose to go other way, good luck to you. After all, people still use MD5 for security applications nowadays.

Re: You don’t need a password. Posterous fail.

#83
post #58

Earlier quoted context omitted.

There are several ways to defeat DKIM here: • If you can break DNS, you can get an NXDOMAIN reply, making recipients think there aren't any domainkeys • If the domainkey private key is small, you can factor it. There's an article on HN's frontpage right now about this. • If the server uses domainkeys, but it doesn't specifically verify the From: header, an attacker can still forge a message if they share a popular ma…

An auto-response confirmation would make posterous suck.

and yet DKIM is insecure for sender authentication.

Re: You don’t need a password. Posterous fail.

#84

Hey guys. I'm the cofounder of Posterous. Yes, someone did figure out how to post to Dustin's site today. This security hole is now fixed. We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing. For the vast majority of users who use gmail, hotmail or…

Hi,

Is it possible to publish the algorithms and technique you are using to prevent spoofing. It would really be a big help to us as well as every body else.

Thanks,

Al

Post reply on HN