full-disclosure - a question about e-mails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: lists at venom600.org (Ben Nelson)
Subject: a question about e-mails

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It probably ought to be stripping those headers out of the email before
sending it.  Wouldn't you think so?  Kinda defeats the purpose of a
*blind* carbon copy.

Although, as several folks have pointed out, the RFC's don't require
this, so maybe 'broken' is an unfair description.  'Poorly configured'
may be a better choice of words.

- --Ben

Nico Golde wrote:
| Hallo Ben,
|
| * Ben Nelson <lists@...om600.org> [2004-02-27 22:28]:
|
|>Hash: SHA1
|>
|>Sounds like a broken MTA to me.
|
|
| why?
| regards nico
|
|
|
|>Nico Golde wrote:
|>| Hallo Chris,
|>|
|>| * Chris Smith <chris.rs@...a.co.nz> [2004-02-26 13:50]:
|>|
|>|>>I have a question for it experts. I want to learn if there is any
way of
|>|>>understanding/finding the e-mail addresses at BCC part on an e-mail
|>that is
|>|>>send to you.
|>|>>
|>|>>Thanks for your consideration.
|>|>
|>|>Um, AFAIK the headers are stripped by the MTA on delivery to recipients
|>|>(except perhaps the recipient who was listed in the BCC field, but I'm
|>not
|>|>sure and will most likely vary between MTA).
|>|>
|>|>I'm sure the SMTP RFC would probably help out on this.
|>|
|>|
|>| I tested it on my system.
|>| i send a mail to nico and bcc root.
|>| here is the mail header:
|>| 	From nion@....net Thu Feb 26 14:28:30 2004
|>| 	Return-Path: nion@....net
|>| 	Received: by
|>| 	        via sendmail from stdin
|>| 	        id <m1AwLZ0-001n35C@...lde.de> (Debian Smail3.2.0.114)
|>| 	        Thu, 26 Feb 2004 14:28:30 +0100 (CET)
|>| 	Date: Thu, 26 Feb 2004 14:28:30 +0100
|>| 	From: Nico Golde <nion@....net>
|>| 	To: nico
|>| 	Bcc: root
|>|
|>| ^^^^^^^^^
|>| here is the bcc line
|
|
| _______________________________________________
| Full-Disclosure - We believe in it.
| Charter: http://lists.netsys.com/full-disclosure-charter.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAP8qS3cL8qXKvzcwRAvCxAJ9YePy2IreEAVWmJqAM5KYcoPnMvgCg6pFt
5QgfAyp8aMcwzy64pzC4IQI=
=f2EL
-----END PGP SIGNATURE-----