full-disclosure - VeriSign's fake SMTP server for SiteFinder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: ppatters at cbnco.com (Pamela Patterson)
Subject: VeriSign's fake SMTP server for SiteFinder

On Mon, 2003-09-22 at 15:13, Richard M. Smith wrote:
<snip>
> I've attached an early email from Verisign that gives a bit more
> information about how this fake SMTP server operates but not why it is
> needed.

If they had no mail server there at all, mail sent to non-existent
domains would sit in limbo as the upstream machine tried to deliver it
to the Verisign machine.  How many times it would try and how long it
would wait would depend on the MTA configuration, but it could be days. 
If email sent to misspelled domains took 5 days (the sendmail default)
to bounce due to Verisign's domain squatting, people would be very upset

-- 
There are two kinds of sysadmins: paranoids and losers.
I'm both kinds.