bugtraq - Re: Is predictable spam filtering a vulnerability? (silently drop ping messages)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 24 Jun 2004 11:52:09 -0700
From: Stephen Warren <swarren@...dotorg.org>
To: bugtraq@...urityfocus.com
Cc: "'David F. Skoll'" <dfs@...ringpenguin.com>,
	David Brodbeck <DavidB@...l.interclean.com>
Subject: Re: Is predictable spam filtering a vulnerability? (silently drop
	ping messages)


David Brodbeck wrote:

>As for rejecting invalid bounces, some people have been experimenting with
>adding a short crypto hash to the envelope sender address of each message.
>If a bounce comes in and the hash is wrong, it has to be invalid, so it's
>rejected.  Google for 'signed envelope sender' for more info.  This is an
>interesting idea because it doesn't require anyone else to do anything --
>you can implement it on your own domain and see immediate benefits.
>  
>
TMDA (http://www.tmda.net/) is a system that'll allow you to do this.

Yes, whilst TMDA is a challenge-response system which some won't like, 
you can (trivially) configure it not to ever challenge, and use it for 
other means, such as validating crypto-style envelope senders.

-- 
Stephen Warren, Software Engineer, Parama Networks, San Jose, CA
swarren@...dotorg.org                  http://www.wwwdotorg.org/