Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #58353 > unrolled thread

Changing my email address

Back to article view | Back to comp.lang.c

Contents

  Changing my email address jacob navia <jacob@jacob.remcomp.fr> - 2015-03-17 22:00 +0100
    Re: Changing my email address James Kuyper <jameskuyper@verizon.net> - 2015-03-17 17:31 -0400
      Re: Changing my email address jacob navia <jacob@jacob.remcomp.fr> - 2015-03-17 23:12 +0100
        Re: Changing my email address Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-18 01:30 +0000
          Re: Changing my email address Noob <root@127.0.0.1> - 2015-03-19 10:47 +0100
            Re: Changing my email address Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-19 15:12 +0000
        Re: Changing my email address Richard Damon <Richard@Damon-Family.org> - 2015-03-17 23:16 -0400
          Re: Changing my email address asetofsymbols@gmail.com - 2015-03-18 00:18 -0700
          Re: Changing my email address Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2015-03-18 09:57 -0400
            Re: Changing my email address Richard Damon <Richard@Damon-Family.org> - 2015-03-18 22:57 -0400
            Re: Changing my email address Noob <root@127.0.0.1> - 2015-03-19 10:55 +0100
    Re: Changing my email address Tim Rentsch <txr@alumni.caltech.edu> - 2015-03-24 12:00 -0700

#58353 — Changing my email address

Due to several posters writing nonsense in my name, I am forced to use 
my real mail addres and not jacob@spamsink.net

This will fill my mail with spam but.. what gives?


What strikes me is the cowardice of these people. When they have no 
arguments the only thing they have left is personal attacks or forgeries

[toc] | [next] | [standalone]

#58358

On 03/17/2015 05:00 PM, jacob navia wrote:
> Due to several posters writing nonsense in my name, I am forced to use 
> my real mail addres and not jacob@spamsink.net

One affect of this change is that you've bypassed by filters, so I
happened to see this message.

I don't understand why you think it would have any other beneficial
effect. Surely it's just as trivial to forge your real e-mail address as
it is to forge your spam bait address? I've never used a fake address,
and my real address was just as easily forged as anyone else's when we
had the sporger attack a few years ago.

[toc] | [prev] | [next] | [standalone]

#58361

Le 17/03/2015 22:31, James Kuyper a écrit :
> One affect of this change is that you've bypassed by filters, so I
> happened to see this message.

Sorry :-)

You are right actually. They can spoof the "From" field, since they have 
a machine that can inject ANY message into the USENET stream.


What is distressing is that there is no defence against it. At least 
within USENET/Internet configuration.

[toc] | [prev] | [next] | [standalone]

#58374

jacob navia <jacob@jacob.remcomp.fr> writes:

> Le 17/03/2015 22:31, James Kuyper a écrit :
>> One affect of this change is that you've bypassed by filters, so I
>> happened to see this message.
>
> Sorry :-)
>
> You are right actually. They can spoof the "From" field, since they
> have a machine that can inject ANY message into the USENET stream.

Allow me to add my name to those offering sympathy.  It's very
depressing, but this this is the world we live in.  People are often
jerks.

> What is distressing is that there is no defence against it. At least
> within USENET/Internet configuration.

There's no obvious way to stop it, but you can discourage it by making
your posts harder to forge.  The last time there was a spate of
forgeries here, I started adding a header to my posts that can be
checked by a simple script on a web site.  The effect is that, were it
ever to matter, anybody can be reasonably sure that a post seemingly
from me was written by the person who owns bsb.me.uk.  You could do the
same for any domain you control that can run PHP.

I would be happy to share the details (indeed the code) if this would be
of any help, though I can image it might seem like overkill.

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#58445

On 18/03/2015 02:30, Ben Bacarisse wrote:

> There's no obvious way to stop it, but you can discourage it by making
> your posts harder to forge.  The last time there was a spate of
> forgeries here, I started adding a header to my posts that can be
> checked by a simple script on a web site.  The effect is that, were it
> ever to matter, anybody can be reasonably sure that a post seemingly
> from me was written by the person who owns bsb.me.uk.  You could do the
> same for any domain you control that can run PHP.

You could also digitally sign your messages. That's what asymmetric
crypto is for, after all.

https://en.wikipedia.org/wiki/Digital_signature

Regards.

[toc] | [prev] | [next] | [standalone]

#58453

Noob <root@127.0.0.1> writes:

> On 18/03/2015 02:30, Ben Bacarisse wrote:
>
>> There's no obvious way to stop it, but you can discourage it by making
>> your posts harder to forge.  The last time there was a spate of
>> forgeries here, I started adding a header to my posts that can be
>> checked by a simple script on a web site.  The effect is that, were it
>> ever to matter, anybody can be reasonably sure that a post seemingly
>> from me was written by the person who owns bsb.me.uk.  You could do the
>> same for any domain you control that can run PHP.
>
> You could also digitally sign your messages. That's what asymmetric
> crypto is for, after all.

Yes, but the usual methods of transmitting it are frowned upon for
Usenet postings, hence my lightweight method involving only an extra
header.  The header could be a signature for the whole message but
that's also non-standard and makes checking it far more complicated.

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#58378

On 3/17/15 6:12 PM, jacob navia wrote:
> Le 17/03/2015 22:31, James Kuyper a écrit :
>> One affect of this change is that you've bypassed by filters, so I
>> happened to see this message.
>
> Sorry :-)
>
> You are right actually. They can spoof the "From" field, since they have
> a machine that can inject ANY message into the USENET stream.
>
>
> What is distressing is that there is no defence against it. At least
> within USENET/Internet configuration.
>

One defense is to habitually sign your messages (all of them), that way 
an unsigned (or mis-signed) message is obviously fake.

The normal way to sign is somewhat obnoxious in putting a bunch of 
"garbage" at the end of the message, but technically, it should be 
possible to put the signature into a header.

A second defense is to use as an injecting server one that has a strong, 
and enforced, policy against spoofing. While the spoofer could fake the 
message as coming from that server, there will tend to be anomalies in 
the path after that.

[toc] | [prev] | [next] | [standalone]

#58383

Yes sign the message with one 
32 bit number in function of
time/data, using a secret to other
function...

[toc] | [prev] | [next] | [standalone]

#58408

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday March 17 2015 23:16, in comp.lang.c, "Richard Damon"
<Richard@Damon-Family.org> wrote:

> On 3/17/15 6:12 PM, jacob navia wrote:
>> Le 17/03/2015 22:31, James Kuyper a écrit :
>>> One affect of this change is that you've bypassed by filters, so I
>>> happened to see this message.
>>
>> Sorry :-)
>>
>> You are right actually. They can spoof the "From" field, since they have
>> a machine that can inject ANY message into the USENET stream.
>>
>>
>> What is distressing is that there is no defence against it. At least
>> within USENET/Internet configuration.
>>
> 
> One defense is to habitually sign your messages (all of them), that way
> an unsigned (or mis-signed) message is obviously fake.

A PGP signature, appended to the msg, will do that handily. It is very
difficult to forge such a signature, making it an easily identifiable
attribution.

However, the absence of such a signature may not be an indication of a
forgery.

[snip]
- -- 
Lew Pitcher
"In Skills, We Trust"
PGP public key available upon request

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Armoured with GnuPG

iEYEARECAAYFAlUJhD4ACgkQagVFX4UWr649wwCeKx4hQ9OJlxjYv82Ic9LrLr8D
8ZAAoIuvVApSTwtFtQ4HyjlyNMcZ+B+C
=8OEC
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#58434

On 3/18/15 9:57 AM, Lew Pitcher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tuesday March 17 2015 23:16, in comp.lang.c, "Richard Damon"
> <Richard@Damon-Family.org> wrote:
>
>> On 3/17/15 6:12 PM, jacob navia wrote:
>>> Le 17/03/2015 22:31, James Kuyper a écrit :
>>>> One affect of this change is that you've bypassed by filters, so I
>>>> happened to see this message.
>>>
>>> Sorry :-)
>>>
>>> You are right actually. They can spoof the "From" field, since they have
>>> a machine that can inject ANY message into the USENET stream.
>>>
>>>
>>> What is distressing is that there is no defence against it. At least
>>> within USENET/Internet configuration.
>>>
>>
>> One defense is to habitually sign your messages (all of them), that way
>> an unsigned (or mis-signed) message is obviously fake.
>
> A PGP signature, appended to the msg, will do that handily. It is very
> difficult to forge such a signature, making it an easily identifiable
> attribution.
>
> However, the absence of such a signature may not be an indication of a
> forgery.
>
> [snip]
> - --
> Lew Pitcher

Yes, lack of a signature isn't "proof" of forgery, but is an indication 
of possible forgery. Some fake forgeries might be provable if the fake 
is done poorly, but some can be essentially impossible to prove.

[toc] | [prev] | [next] | [standalone]

#58447

On 18/03/2015 14:57, Lew Pitcher wrote:

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.15 (GNU/Linux)
> Comment: Armoured with GnuPG

v1.4.15 released 2013-10-04
v1.4.19 released 2015-02-27

https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html

Regards.

[toc] | [prev] | [next] | [standalone]

#58861

jacob navia <jacob@jacob.remcomp.fr> writes:

> Due to several posters writing nonsense in my name, I am forced to use
> my real mail addres and not jacob@spamsink.net

If you wouldn't mind a suggestion, you might want to set up an
alternate (real) email solely for the purpose of posting in
comp.lang.c (and perhaps other newsgroups).  Given the easy
availability of free email accounts, the cost is minimal (basically
the time to set one up), and it should be just as good for
dealing with posting abuse.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.c

csiph-web