full-disclosure - Re: [Mailman-Developers] mailman email harvester

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200502120334.j1C3YRBj007792@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Re: [Mailman-Developers] mailman email
	harvester 

On Sat, 12 Feb 2005 02:48:56 +0100, Bernhard Kuemel said:

> If hashcash (http://www.hashcash.org/) gets integrated in our mail
> systems we no longer need to hide or obfuscate our email addresses.

On the other hand, widespread distribution of hashcash will probably mean
the end of many mailing lists, because you can't trust users to actually
whitelist everything they subscribe to.  And remember that the whole *idea*
of hashcash is that you make it impractical for somebody to send 3,000 pieces
of mail.  I'm sure netsys.com wouldn't want to keep full-disclosure if they had
to do hashcash for even 10% of their users.

I'll go out on a limb and predict that if hashcash catches on, most major
mailing list packages will quickly acquire features to auto-unsub and
auto-blacklist all addresses from domains that present a hashcash challenge,
just out of self-defense. (And yes, unsub and blacklist *the entire domain* -
if foo.com is bouncing mail that hasn't been whitelisted, you have to
ban foo.com from all your lists.  Otherwise you can be DoS'ed (either
intentionally or accidentally) by simply subscribing 15 or 20 addresses
and "forgetting" to whitelist the mailing list...

I'll overlook the issues caused when you *dont know* what to whitelist.
For instance - many mailing lists (including this one) have a "confirmation
of subscription" check.  For bonus points - should you have whitelisted:

a) full-disclosure@...ts.netsys.com    (the actual list name)
b) full-disclosure-request@...ts.netsys.com (the rfc822 header on my confirm)
c) full-disclosure-admin@...ts.netsys.com (the rfc821 MAIL FROM:)
d) mailman@
e) majordomo@
f) listserv@

(One or more answers may or may not be correct.  Remember that at the time
you send your subscription request, you probably have not actually seen any
mail from the site, so you can't say "whitelist the address this mail came from"...)

There's also all the stuff that things like amazon, ebay, your bank,
your insurance company, your utility companies, etc... all send out,
that users will forget to whitelist.

But yeah, other than all those minor details, hashcash is a fine solution. ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050211/4ba18678/attachment.bin