It's ridiculously easy to forge email headers. Headers are manually created whenever programmatically sending email messages. That's how messages can be sent from addresses that don't exist, like devnull@example.com or noreply@yourdomain.com. They don't even send a confirmation email that you have to approve before stuff is posted?
To clarify this a little, in case anyone isn't familiar, to send an email message programmatically, you basically just send a string with some headers and body content to the email server. Here are what the headers look like:
Date: Sat, 13 Jun 2009 06:53:06 -0400
From: Mail Delivery Subsystem <MAILER-DAEMON>
Message-Id: <200906131053.n5DAr2Nv025105@jclinux>
To: <root@jclinux>
From: Steve Jobs <sjobs@apple.com>
http://en.wikipedia.org/wiki/DKIM
As far as I understand it, you can't fake being an SMTP server sending mail from such a domain because their emails get signed with a private key whose matching public key is published by DNS.
That doesn't sound like "works 99% of the time" to me, that sounds like an epic fail.
EDIT: It appears that this was more of a configuration issue, so the above only applies if you set up your account this way.
Usually, Posterous catches this stuff and sends an email asking you to confirm that you really are you. They analyze the headers more closely than just looking at the name. For some reason, this didn't work in this case.
Edit: dcurtis edited his comment. Originally he claimed there was some kind of secret algorithm that prevents spoofing.
Access to a message or a mailing list post by them won't provide any further advantage.
Yes, someone did figure out how to post to Dustin's site today. This security hole is now fixed.
We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing.
For the vast majority of users who use gmail, hotmail or other services, this was never an issue.
Since our launch on day one, we have taken email spoof detection very seriously. It's one of our core differentiators: to be able to securely post to your blog by emailing a single, easy to remember address. We don't want to do secret addresses or secret words.
Over the past 2 years, we've developed robust spoof detection ip and spend a ton of time trying to stay a step ahead of hackers. Fortunately, we've only had a few very specific, isolated cases where one of our sites was spoofed and each time we have improved our system.
Thanks for bringing this to our attention. We always need to be one step ahead of the hackers/spoofers, and we thank the Hacker News community for keeping us on our toes!
Is it possible to publish the algorithms and technique you are using to prevent spoofing. It would really be a big help to us as well as every body else.
Thanks,
Al
I realise Posterous requires you to "confirm" the post, I just wanted to see if you had defaulted that requirement to off.
$ /usr/sbin/sendmail -f dustin@dustincurtis.com
dustin@posterous.com
Subject: hi
Spam spam spam
^DOne quick whois lookup, and I found the email he was likely sending from. His site has another email listed, so I did a little digging.
$ telnet mailhost.com 25
HELO myserver.hostname.com
MAIL FROM: dustin@dustincurtis.com
RCPT TO: post@posterous.com
DATA
Subject: Hello
spam spam
.
QUITUpdate: Not sure why I got downvoted, but here is the reference from Google News:
http://www.google.com/support/news_pub/bin/answer.py?hl=en&#...
I can't figure out why though. It sounds like an incredibly stupid rule.
Of course someone who received an email from the blog owner could use that to fake all those headers but at least it would prevent people posting by simply guessing the email address.
Of course, not using such full blown solutions will mean that posterous' heuristics techniques will be susceptible to all sorts of attacks, such as man-in-the-middle, relay attacks and so forth.
On the other hand, looking for solutions that are resilient to more sophisticated attacks, mostly considering IBE schemes, is quite convoluted (it involves provable security models, such as http://www.google.com/#hl=en&q=provable+security+signatu... ). There are even variations on IBE, such as certificateless, which require you to trust even less people.
This is of course, assuming you are not willing to inconvenience users by making them reply a email you send them after they tried to poste. Such email would contain a custom made url (the secret) that would enable the post to actually be posted. On the other hand, this solution feels more inconvenient than using OAuth methods.
Nonetheless, not all users care about security/privacy (those that do, will always have the usual login scheme). If you chose to go other way, good luck to you. After all, people still use MD5 for security applications nowadays.
1. Change from "Contributors can post" to "Anyone can post". Counterintuitive, but the first is based on email FROM, the second is moderated.
2. Make a hash as your FROM address. Add it as an alias to send from in Gmail (or whatever you use). Send to posterous from the hash address. Your email address becomes your password.
Sounds somewhat mislabelled then.
http://posterous.com/help/private_sites
"You can set a password on your Posterous site so only the readers you want can see it. To see your site, a user must go to your site url and also enter the correct password for your site."
Technically, it's the same problem as email spam, and most of the same tools can be used to combat it. Posterous should flag posts that they aren't sure of and make users confirm them before putting them up, etc.
EDIT:
The other fix would be to use an email address that can't be guessed from the blog address. In other words, the email address is the password.
Multiply (http://multiply.com) does something similar. You set your post-by-email id. And, then email your posts to the post-by-email-id@your-multiply-id.multiply.com. You decide how complicated or easy you want your post-by-email-id to be.
As someone said, this is not 100% secure as the email address is sent as clear text as it passes through mail servers, but it's more difficult for someone to guess it.
They do perform additional checks on the message sent to make sure it came from you, perhaps similar to those that Posterous does.
You'd still be sending your password in the clear, possibly through other peoples mail servers. Not great security.
There is a trade-off here between security and usability. 99% security is good enough for a lot of purposes and has its place.