Thoughts on the Posterous hack
blog.dustincurtis.com
Thoughts on the Posterous hack
1–10 of 62 posts
Re: Thoughts on the Posterous hack
#2couldn't they do something like the email address is yourusernameatyourdomain.comandanextrabityoutset@posterous.com which would be an id you could remember?
Re: Thoughts on the Posterous hack
#3couldn't they do something like the email address is yourusernameatyourdomain.comandanextrabityoutset@posterous.com which would be an id you could remember?
[deleted]
Re: Thoughts on the Posterous hack
#4Sounds like a security issue to me.
Re: Thoughts on the Posterous hack
#5couldn't they do something like the email address is yourusernameatyourdomain.comandanextrabityoutset@posterous.com which would be an id you could remember?
or just a random noun@posterous.com? Or make it user-configurable?
Re: Thoughts on the Posterous hack
#6http://news.ycombinator.com/item?id=1442163
The compromise I suggested here addresses both concerns (ease of use and security)
Re: Thoughts on the Posterous hack
#7Of course somebody is interested in spamming his mother's blog. A script doesn't care whose blog it spams. Now that the word is out, I expect it will only be a matter of time until such scripts emerge.
It's the typical false assumption non-technical users have about security: who would be interested in hacking me anyway? Automated scripts, that is who.
Also, how are the email posts interpreted by posterous - is it possible to post custom html snippets and javascripts via email? This would be scammer's heaven, as they could probably even hide that a blog has been spammed.
Re: Thoughts on the Posterous hack
#8Here's the deal - as soon as your blog reaches any level of popularity, people are going to want to deface it / hack it any way they can just because it's that much bigger of a prize. If Posterous is this easy to hack, once you have a decent sized blog you're going to have a constant field day until they implement something better.
If you want to keep security simple enough that it doesn't strangle the service then hand out a unique email like post-45h231sxax23s1@posterous.com and have the user add that to their address book - viola, you've managed to add a layer of obscurity to posterous' posting mechanism at least, even though it's still not really a strong one.
Re: Thoughts on the Posterous hack
#9He says there is no interest to post to his moms posterous, but is that really true?
I can imagine quite a lot of spammers who would love to have a blog-post on an otherwise reputable blog. If spammers manage to abuse this system they could get their blogposts, filled with links and instructions to buy medication, all over all posterous blogs.
Re: Thoughts on the Posterous hack
#10There's an even easier solution... require confirmation via email. You send the post as an email, you get an email back immediately asking for post confirmation.
edit:
It looks like this is already standard functionality (if turned on, and even if not there is still an email sent with a delete link).
I don't think dustin does a good job explaining why "It is OK" in this blog post, but I think I agree with his conclusion, this doesn't seem like a big deal if a user has opted for the more optimistic workflow rather than the more precautionary one.