|
|
BugTraq
Privacy leak in VeriSign's SiteFinder service Sep 23 2003 09:04PM Richard M. Smith (rms computerbytesman com) (2 replies) Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 06:00PM Mark Coleman (markc uniontown com) (3 replies) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:45PM der Mouse (mouse Rodents Montreal QC CA) (1 replies) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 08:58PM Jay D. Dyson (jdyson treachery net) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:26PM Hugo van der Kooij (hvdkooij vanderkooij org) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 07:00PM Marco Ivaldi (raptor 0xdeadbeef info) (2 replies) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 25 2003 09:37AM Henning Rust (Henning Rust stud uni-hannover de) (1 replies) Re: Privacy leak in VeriSign's SiteFinder service #2 Sep 24 2003 08:05PM Diego Bitencourt Contezini (diego redesul net) |
|
Privacy Statement |
> Up to now, e-mails addressed to misspelled mail domains will not be
> sent to Verisign's Fake-SMTP-service as MX records are used for
> mail-domain resolving. Verisign did not set up wildcard MX records.
Wrong. Mail transfer agents fall back to A records if no MX records
exist for a given entry. That's why Snubby was running in the first
place - to keep mail from accumulating in everybody's queues for a week
where at first it would've been discarded immediately.
> However, if you configure your E-Mail-Program or local Mail-Transfer-
> Agent and misspell the hostname of the SMTP-Server for outgoing mail,
> all outgoing mail will be sent to their Fake-SMTP service.
And rejected with an incorrect error message leading - again - to faulty
diagnostics. The Internet Architecture Board has written a good
document about the operational impact of Verisign's move:
http://www.iab.org/documents/docs/2003-09-20-dns-wildcards.html
> What if Versign is planning to add wildcard MX records as well, so that
> any mail addressed to mistyped/non-existant mail domains like
> "foobar (at) sdfsgggdfasfasdf (dot) com [email concealed]" will be sent to their fake SMTP service?
As said, that won't change much. Someone proposed Verisign added "* IN
MX 0 ." as an additional wildcard but testing has shown that MTAs keep
mail spooled instead, so this won't work either.
> Expect the worst!
How much worse can it get? On second thoughts, don't give Verisign any
ideas...
-- Niels.
--
"The time of getting fame for your name on its own is over. Artwork that
is only about wanting to be famous will never make you famous. Any fame
is a bi-product of making something that means something. You don't go to
a restaurant and order a meal because you want to have a shit." -- Banksy
[ reply ]