bugtraq - Re: Privacy leak in VeriSign's SiteFinder service #2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 25 Sep 2003 11:37:54 +0200 (MEST)
From: Henning Rust <Henning.Rust@...d.uni-hannover.de>
To: Marco Ivaldi <raptor@...eadbeef.info>
Cc: "BUGTRAQ@...URITYFOCUS. COM" <BUGTRAQ@...urityfocus.com>
Subject: Re: Privacy leak in VeriSign's SiteFinder service #2

On Wed, 24 Sep 2003, Marco Ivaldi wrote:

> What if Verisign is planning to open more similar TCP/IP services on that
> host? What if they're going to further modify the existing ones, to better
> invade individuals' privacy?

Up to now, e-mails addressed to misspelled mail domains will not be sent
to Verisign's Fake-SMTP-service as MX records are used for mail-domain
resolving. Verisign did not set up wildcard MX records.

However, if you configure your E-Mail-Program or local
Mail-Transfer-Agent and misspell the hostname of the SMTP-Server for
outgoing mail, all outgoing mail will be sent to their Fake-SMTP service.

What if Versign is planning to add wildcard MX records as well, so that
any mail addressed to mistyped/non-existant mail domains like
"foobar@...sgggdfasfasdf.com" will be sent to their fake SMTP service?

Expect the worst!

hepp...
        Henning

--