Thursday, February 17, 2005, 7:57:01 PM, you wrote:
> It seems to be required that programs that automatically discard
> duplicate messages have to use a checksum over the body and part of the
> header of the emails instead of relying on the message ID.
Very interesting indeed Adrian.
So to sum it all up just for now, the advisories are two.
One for users, one for developers of MUAs.
Users: Beware of the fact that automatic discarding of duplicated messages
may result in you not getting the original mail in case someone exploits
the effect Adrian depicted.
Developers: Consider using checksum of the email messages, not only the
Message-ID to distinguish between duplicated messages.
Am I correct?
Fortunately I was never using this MUA feature - I just take care of the
duppies manually, which is not a big chore for me I must say.
Thursday, February 17, 2005, 7:57:01 PM, you wrote:
> It seems to be required that programs that automatically discard
> duplicate messages have to use a checksum over the body and part of the
> header of the emails instead of relying on the message ID.
Very interesting indeed Adrian.
So to sum it all up just for now, the advisories are two.
One for users, one for developers of MUAs.
Users: Beware of the fact that automatic discarding of duplicated messages
may result in you not getting the original mail in case someone exploits
the effect Adrian depicted.
Developers: Consider using checksum of the email messages, not only the
Message-ID to distinguish between duplicated messages.
Am I correct?
Fortunately I was never using this MUA feature - I just take care of the
duppies manually, which is not a big chore for me I must say.
--
Best regards,
Maciej Soltysiak
[ reply ]