Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #58396 > unrolled thread

Forged messages:the answer from aioe.org

Back to article view | Back to comp.lang.c

Contents

  Forged messages:the answer from aioe.org jacob navia <jacob@jacob.remcomp.fr> - 2015-03-18 09:38 +0100
    Re: Forged messages:the answer from aioe.org James Kuyper <jameskuyper@verizon.net> - 2015-03-18 11:07 -0400
      Re: Forged messages:the answer from aioe.org Keith Thompson <kst-u@mib.org> - 2015-03-18 09:15 -0700
        Re: Forged messages:the answer from aioe.org James Kuyper <jameskuyper@verizon.net> - 2015-03-18 12:54 -0400
          Re: Forged messages:the answer from aioe.org Keith Thompson <kst-u@mib.org> - 2015-03-18 10:29 -0700
          Re: Forged messages:the answer from aioe.org glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2015-03-18 17:30 +0000
          Re: Forged messages:the answer from aioe.org David Brown <david.brown@hesbynett.no> - 2015-03-19 09:04 +0100
            Re: Forged messages:the answer from aioe.org Richard Damon <Richard@Damon-Family.org> - 2015-03-19 22:25 -0400
        Re: Forged messages:the answer from aioe.org Kaz Kylheku <kaz@kylheku.com> - 2015-03-18 18:22 +0000
          Re: Forged messages:the answer from aioe.org asetofsymbols@gmail.com - 2015-03-18 11:41 -0700
          Re: Forged messages:the answer from aioe.org asetofsymbols@gmail.com - 2015-03-18 11:41 -0700
          Re: Forged messages:the answer from aioe.org asetofsymbols@gmail.com - 2015-03-18 11:41 -0700
          Re: Forged messages:the answer from aioe.org Melzzzzz <mel@zzzzz.com> - 2015-03-18 20:28 +0100
            Re: Forged messages:the answer from aioe.org Kaz Kylheku <kaz@kylheku.com> - 2015-03-18 19:37 +0000
              Re: Forged messages:the answer from aioe.org Melzzzzz <mel@zzzzz.com> - 2015-03-18 23:22 +0100
          Re: Forged messages:the answer from aioe.org raltbos@xs4all.nl (Richard Bos) - 2015-03-21 22:48 +0000
    Re: Forged messages:the answer from aioe.org raltbos@xs4all.nl (Richard Bos) - 2015-03-21 22:47 +0000
      Re: Forged messages:the answer from aioe.org Keith Thompson <kst-u@mib.org> - 2015-03-21 16:14 -0700
        Re: Forged messages:the answer from aioe.org raltbos@xs4all.nl (Richard Bos) - 2015-03-30 09:52 +0000
          Re: Forged messages:the answer from aioe.org Keith Thompson <kst-u@mib.org> - 2015-03-30 09:14 -0700

#58396 — Forged messages:the answer from aioe.org

They answered my complaint (very quickly). Here is their message:
<quote>
-----------------------------------------------------
Il 17/03/2015 22:12, jacob navia ha scritto:
 > Please what can I do to avoid this?
 > Is it possible to stop this?

you don't own your name but your email address only

if jacob@spamsink.net is a valid address and if it's owned by you, you 
can complaint against people who use it. If that address isn't valid, 
you should change it with a valid one.
-------------------------------------------------------
<end quote>

That means I was right when I changed my "nospam" address for my real 
address. At least I can now complain that somebody is using my email 
address!

[toc] | [next] | [standalone]

#58413

On 03/18/2015 04:38 AM, jacob navia wrote:
> They answered my complaint (very quickly). Here is their message:
> <quote>
> -----------------------------------------------------
> Il 17/03/2015 22:12, jacob navia ha scritto:
>  > Please what can I do to avoid this?
>  > Is it possible to stop this?
> 
> you don't own your name but your email address only
> 
> if jacob@spamsink.net is a valid address and if it's owned by you, you 
> can complaint against people who use it. ...

That's only useful if you can identify those people. Can you?

[toc] | [prev] | [next] | [standalone]

#58416

James Kuyper <jameskuyper@verizon.net> writes:
> On 03/18/2015 04:38 AM, jacob navia wrote:
>> They answered my complaint (very quickly). Here is their message:
>> <quote>
>> -----------------------------------------------------
>> Il 17/03/2015 22:12, jacob navia ha scritto:
>>  > Please what can I do to avoid this?
>>  > Is it possible to stop this?
>> 
>> you don't own your name but your email address only
>> 
>> if jacob@spamsink.net is a valid address and if it's owned by you, you 
>> can complaint against people who use it. ...
>
> That's only useful if you can identify those people. Can you?

aioe.org might be able to identify the IP address(es) they post
from, even if it's not included in the headers of the articles that
reach the rest of us.  They do restrict connections and posts by
IP address, so they must keep track.

Using a real e-mail address doesn't make it any more difficult to
post forgeries, but apparently it does make it easier to deal with
them after the fact (something I hadn't considered).

As someone else mentioned, eternal-september.org requires
username/password authentication.  I don't know how secure it is,
or how or whether they prevent header modifications, but it might
make forgeries more difficult.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

[toc] | [prev] | [next] | [standalone]

#58417

On 03/18/2015 12:15 PM, Keith Thompson wrote:
...
> As someone else mentioned, eternal-september.org requires
> username/password authentication.  I don't know how secure it is,
> or how or whether they prevent header modifications, but it might
> make forgeries more difficult.

That would make forgeries more easily detectable, because they would
have the wrong server, but it wouldn't prevent them. Also, how often do
you check the message headers to determine the server?

[toc] | [prev] | [next] | [standalone]

#58418

James Kuyper <jameskuyper@verizon.net> writes:
> On 03/18/2015 12:15 PM, Keith Thompson wrote:
> ...
>> As someone else mentioned, eternal-september.org requires
>> username/password authentication.  I don't know how secure it is,
>> or how or whether they prevent header modifications, but it might
>> make forgeries more difficult.
>
> That would make forgeries more easily detectable, because they would
> have the wrong server, but it wouldn't prevent them. Also, how often do
> you check the message headers to determine the server?

Rarely, but I sometimes do when an article looks suspicious.

A skillfully written forgery that isn't pointed out by the actual user
is likely to escape detection.  A forgery that either looks suspicious
or is pointed out as a possible forgery invites closer scrutiny.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

[toc] | [prev] | [next] | [standalone]

#58419

James Kuyper <jameskuyper@verizon.net> wrote:
> On 03/18/2015 12:15 PM, Keith Thompson wrote:
> ...
>> As someone else mentioned, eternal-september.org requires
>> username/password authentication.  I don't know how secure it is,
>> or how or whether they prevent header modifications, but it might
>> make forgeries more difficult.
 
> That would make forgeries more easily detectable, because they would
> have the wrong server, but it wouldn't prevent them. Also, how often do
> you check the message headers to determine the server?

When someone says that there are forged posts!

I suppose also when they look suspicious.  Maybe it looks like
someone posting under a different name, and you wonder if it is
the same person.

-- glen

[toc] | [prev] | [next] | [standalone]

#58435

On 18/03/15 17:54, James Kuyper wrote:
> On 03/18/2015 12:15 PM, Keith Thompson wrote:
> ...
>> As someone else mentioned, eternal-september.org requires
>> username/password authentication.  I don't know how secure it is,
>> or how or whether they prevent header modifications, but it might
>> make forgeries more difficult.
>
> That would make forgeries more easily detectable, because they would
> have the wrong server, but it wouldn't prevent them. Also, how often do
> you check the message headers to determine the server?
>

There are relatively few big newsservers these days, and I imagine the 
administrators have a certain amount of contact and cooperation.  It 
should be a relatively simple matter for aioe.org to have rules in place 
to automatically delete any post that claims it is from 
eternal-september.org but actually comes from elsewhere - it would just 
be another in their list of checks for spam, malware, binary files in 
text groups, etc.  If the big servers check each other, then there 
should be small chance of forged messages appearing from servers that 
require authentication.

[toc] | [prev] | [next] | [standalone]

#58464

On 3/19/15 4:04 AM, David Brown wrote:
> On 18/03/15 17:54, James Kuyper wrote:
>> On 03/18/2015 12:15 PM, Keith Thompson wrote:
>> ...
>>> As someone else mentioned, eternal-september.org requires
>>> username/password authentication.  I don't know how secure it is,
>>> or how or whether they prevent header modifications, but it might
>>> make forgeries more difficult.
>>
>> That would make forgeries more easily detectable, because they would
>> have the wrong server, but it wouldn't prevent them. Also, how often do
>> you check the message headers to determine the server?
>>
>
> There are relatively few big newsservers these days, and I imagine the
> administrators have a certain amount of contact and cooperation.  It
> should be a relatively simple matter for aioe.org to have rules in place
> to automatically delete any post that claims it is from
> eternal-september.org but actually comes from elsewhere - it would just
> be another in their list of checks for spam, malware, binary files in
> text groups, etc.  If the big servers check each other, then there
> should be small chance of forged messages appearing from servers that
> require authentication.
>

The problem is that, unless you are referring to just the last hop, it 
is actually very hard to tell where the message originally came from (if 
it was easy, then forgeries with false paths would be hard).

Forged paths occur because some servers don't enforce limitations on 
preloading the path before injections. (One problem with preloading a 
path is that the servers you preloaded to fake the path may well just 
drop the message figuring they must have already processed it). If a 
server causes too much trouble like this, its peers might cut it off, 
but this is a major action and isn't taken lightly.

In this case, it sounds like there might not have been an faking of the 
path, just of the From address and using the same injection server. Many 
servers, for privacy reasons, do not limit the ability of customers to 
post under aliases, but many do have rules against using someone else's 
ID, but this is very often limited to "Real" ids, not to someone using 
the same alias as you (since you really don't own that).

[toc] | [prev] | [next] | [standalone]

#58420

On 2015-03-18, Keith Thompson <kst-u@mib.org> wrote:
> James Kuyper <jameskuyper@verizon.net> writes:
>> On 03/18/2015 04:38 AM, jacob navia wrote:
>>> They answered my complaint (very quickly). Here is their message:
>>> <quote>
>>> -----------------------------------------------------
>>> Il 17/03/2015 22:12, jacob navia ha scritto:
>>>  > Please what can I do to avoid this?
>>>  > Is it possible to stop this?
>>> 
>>> you don't own your name but your email address only
>>> 
>>> if jacob@spamsink.net is a valid address and if it's owned by you, you 
>>> can complaint against people who use it. ...
>>
>> That's only useful if you can identify those people. Can you?
>
> aioe.org might be able to identify the IP address(es) they post
> from, even if it's not included in the headers of the articles that
> reach the rest of us.  They do restrict connections and posts by
> IP address, so they must keep track.

I believe that all news servers should tag all postings with an IP address.

[toc] | [prev] | [next] | [standalone]

#58421

Kaz wrote:
> I believe that all news servers
> should tag all posting 
> with ip address

Why ip address?
So all the world know where post
is sent?

 It is enough 
they tag all posting of
one user with a unsigned 
32 bit

[toc] | [prev] | [next] | [standalone]

#58422

Kaz wrote:
> I believe that all news servers
> should tag all posting 
> with ip address

Why ip address?
So all the world know where post
is sent?

 It is enough 
they tag all posting of
one user with a unsigned 
32 bit

[toc] | [prev] | [next] | [standalone]

#58423

Kaz wrote:
> I believe that all news servers
> should tag all posting 
> with ip address

Why ip address?
So all the world know where post
is sent?

 It is enough 
they tag all posting of
one user with a unsigned 
32 bit

[toc] | [prev] | [next] | [standalone]

#58424

On Wed, 18 Mar 2015 18:22:25 +0000 (UTC)
Kaz Kylheku <kaz@kylheku.com> wrote:

> On 2015-03-18, Keith Thompson <kst-u@mib.org> wrote:
> > James Kuyper <jameskuyper@verizon.net> writes:
> >> On 03/18/2015 04:38 AM, jacob navia wrote:
> >>> They answered my complaint (very quickly). Here is their message:
> >>> <quote>
> >>> -----------------------------------------------------
> >>> Il 17/03/2015 22:12, jacob navia ha scritto:
> >>>  > Please what can I do to avoid this?
> >>>  > Is it possible to stop this?
> >>> 
> >>> you don't own your name but your email address only
> >>> 
> >>> if jacob@spamsink.net is a valid address and if it's owned by
> >>> you, you can complaint against people who use it. ...
> >>
> >> That's only useful if you can identify those people. Can you?
> >
> > aioe.org might be able to identify the IP address(es) they post
> > from, even if it's not included in the headers of the articles that
> > reach the rest of us.  They do restrict connections and posts by
> > IP address, so they must keep track.
> 
> I believe that all news servers should tag all postings with an IP
> address.

It is pretty trivial to set up anonymous SOCKS proxy...

[toc] | [prev] | [next] | [standalone]

#58425

On 2015-03-18, Melzzzzz <mel@zzzzz.com> wrote:
> On Wed, 18 Mar 2015 18:22:25 +0000 (UTC)
> Kaz Kylheku <kaz@kylheku.com> wrote:
>
>> On 2015-03-18, Keith Thompson <kst-u@mib.org> wrote:
>> > James Kuyper <jameskuyper@verizon.net> writes:
>> >> On 03/18/2015 04:38 AM, jacob navia wrote:
>> >>> They answered my complaint (very quickly). Here is their message:
>> >>> <quote>
>> >>> -----------------------------------------------------
>> >>> Il 17/03/2015 22:12, jacob navia ha scritto:
>> >>>  > Please what can I do to avoid this?
>> >>>  > Is it possible to stop this?
>> >>> 
>> >>> you don't own your name but your email address only
>> >>> 
>> >>> if jacob@spamsink.net is a valid address and if it's owned by
>> >>> you, you can complaint against people who use it. ...
>> >>
>> >> That's only useful if you can identify those people. Can you?
>> >
>> > aioe.org might be able to identify the IP address(es) they post
>> > from, even if it's not included in the headers of the articles that
>> > reach the rest of us.  They do restrict connections and posts by
>> > IP address, so they must keep track.
>> 
>> I believe that all news servers should tag all postings with an IP
>> address.
>
> It is pretty trivial to set up anonymous SOCKS proxy...

And that doesn't have an IP address which says "I'm in the IP block of
an anonymous proxy?"

And is that not informative?

[toc] | [prev] | [next] | [standalone]

#58427

On Wed, 18 Mar 2015 19:37:07 +0000 (UTC)
Kaz Kylheku <kaz@kylheku.com> wrote:

> On 2015-03-18, Melzzzzz <mel@zzzzz.com> wrote:
> > On Wed, 18 Mar 2015 18:22:25 +0000 (UTC)
> > Kaz Kylheku <kaz@kylheku.com> wrote:
> >
> >> On 2015-03-18, Keith Thompson <kst-u@mib.org> wrote:
> >> > James Kuyper <jameskuyper@verizon.net> writes:
> >> >> On 03/18/2015 04:38 AM, jacob navia wrote:
> >> >>> They answered my complaint (very quickly). Here is their
> >> >>> message: <quote>
> >> >>> -----------------------------------------------------
> >> >>> Il 17/03/2015 22:12, jacob navia ha scritto:
> >> >>>  > Please what can I do to avoid this?
> >> >>>  > Is it possible to stop this?
> >> >>> 
> >> >>> you don't own your name but your email address only
> >> >>> 
> >> >>> if jacob@spamsink.net is a valid address and if it's owned by
> >> >>> you, you can complaint against people who use it. ...
> >> >>
> >> >> That's only useful if you can identify those people. Can you?
> >> >
> >> > aioe.org might be able to identify the IP address(es) they post
> >> > from, even if it's not included in the headers of the articles
> >> > that reach the rest of us.  They do restrict connections and
> >> > posts by IP address, so they must keep track.
> >> 
> >> I believe that all news servers should tag all postings with an IP
> >> address.
> >
> > It is pretty trivial to set up anonymous SOCKS proxy...
> 
> And that doesn't have an IP address which says "I'm in the IP block of
> an anonymous proxy?"
> 
> And is that not informative?

True. That way one can recognize forgery.

[toc] | [prev] | [next] | [standalone]

#58614

Kaz Kylheku <kaz@kylheku.com> wrote:

> On 2015-03-18, Keith Thompson <kst-u@mib.org> wrote:
> > aioe.org might be able to identify the IP address(es) they post
> > from, even if it's not included in the headers of the articles that
> > reach the rest of us.  They do restrict connections and posts by
> > IP address, so they must keep track.
> 
> I believe that all news servers should tag all postings with an IP address.

What, including Russian ones?

Nice and safe for comrade Josif Vissarionovich Putin...

Richard

[toc] | [prev] | [next] | [standalone]

#58613

jacob navia <jacob@jacob.<censored>.fr> wrote:

> That means I was right when I changed my "nospam" address for my real 
> address. At least I can now complain that somebody is using my email 
> address!

True, but I think you have it the wrong way 'round. You should put your
fake address in your From: header, and your real one in your Reply-To.
See, for example, my own headers. Both addresses are mine, as should be
obvious; but they're treated differently.
The From: header, which is sent in newsgroup header lists and therefore
easily collected by spammers, goes straight to my spam box. If you send
a message to it and I see it, you got lucky. This address can safely be
broadcast all over the 'net; I don't care how much spam I get to it. You
should put your spamsink.net address there.
The Reply-To: is only collected when you get the complete message, body
and all. Spammers rarely bother to get this, which is why it's safer.
Mail sent to it does get passed through my provider's spam filter, but
the survivors arrive in my main mail box. This address should _not_,
please, be put on web sites or displayed in clear; only legitimate mail
clients should use it. This is where you put your main mail address, and
that is why I've censored it above.

In short: you have the right solution, but for your spam filter's sanity
you should swap the two addresses. Unless I'm mistaken and you really
_do_ use spamsink.net as your main mail host.

Richard

[toc] | [prev] | [next] | [standalone]

#58618

raltbos@xs4all.nl (Richard Bos) writes:
> jacob navia <jacob@jacob.<censored>.fr> wrote:
>> That means I was right when I changed my "nospam" address for my real 
>> address. At least I can now complain that somebody is using my email 
>> address!
>
> True, but I think you have it the wrong way 'round. You should put your
> fake address in your From: header, and your real one in your Reply-To.
> See, for example, my own headers. Both addresses are mine, as should be
> obvious; but they're treated differently.
> The From: header, which is sent in newsgroup header lists and therefore
> easily collected by spammers, goes straight to my spam box. If you send
> a message to it and I see it, you got lucky. This address can safely be
> broadcast all over the 'net; I don't care how much spam I get to it. You
> should put your spamsink.net address there.
> The Reply-To: is only collected when you get the complete message, body
> and all. Spammers rarely bother to get this, which is why it's safer.
> Mail sent to it does get passed through my provider's spam filter, but
> the survivors arrive in my main mail box. This address should _not_,
> please, be put on web sites or displayed in clear; only legitimate mail
> clients should use it. This is where you put your main mail address, and
> that is why I've censored it above.
>
> In short: you have the right solution, but for your spam filter's sanity
> you should swap the two addresses. Unless I'm mistaken and you really
> _do_ use spamsink.net as your main mail host.

I think the point is not spam filters, but how aioe.org will respond to
forged messages.  jacob had been using a fake e-mail address in his
posts.  Because it's not an address he owns (he won't receive messages
sent there), aioe.org does not officially consider fake messages
appearing to be from that address as forgeries.  (This is not to suggest
that the forgeries were in any way legitimate, merely that aioe.org
might not be able to *act* on them.)

aoie.org might be more willing and able to respond to complaints about
forged messages falsely using jacob's legitimate address.  They could
track down the IP address used to post them (which they presumably have
in their logs, even though it wasn't included in the forged articles)
and block that address from posting through their servers.

The question is whether aioe.org pays attention to the "To:" header or
the "Reply-To:" header.  I have no idea; you'd have to ask them.

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

[toc] | [prev] | [next] | [standalone]

#59254

Keith Thompson <kst-u@mib.org> wrote:

> raltbos@xs4all.nl (Richard Bos) writes:
> > jacob navia <jacob@jacob.<censored>.fr> wrote:
> >> That means I was right when I changed my "nospam" address for my real 
> >> address. At least I can now complain that somebody is using my email 
> >> address!
> >
> > True, but I think you have it the wrong way 'round. You should put your
> > fake address in your From: header, and your real one in your Reply-To.
> > See, for example, my own headers. Both addresses are mine, as should be
> > obvious; but they're treated differently.

> > In short: you have the right solution, but for your spam filter's sanity
> > you should swap the two addresses. Unless I'm mistaken and you really
> > _do_ use spamsink.net as your main mail host.
> 
> I think the point is not spam filters, but how aioe.org will respond to
> forged messages.  jacob had been using a fake e-mail address in his
> posts.  Because it's not an address he owns (he won't receive messages
> sent there), aioe.org does not officially consider fake messages
> appearing to be from that address as forgeries.  (This is not to suggest
> that the forgeries were in any way legitimate, merely that aioe.org
> might not be able to *act* on them.)

That's true, and if made about jacob's original posts it is even a valid
argument on aioe's part. However...

> The question is whether aioe.org pays attention to the "To:" header or
> the "Reply-To:" header.  I have no idea; you'd have to ask them.

...any Usenet server which _only_ looks at the To: and not at the
Reply-To: is not worth the name. If this were the case, they'd be
forcing jacob to do the Wrong Thing.

Richard

[toc] | [prev] | [next] | [standalone]

#59288

raltbos@xs4all.nl (Richard Bos) writes:
> Keith Thompson <kst-u@mib.org> wrote:
[...]
>> The question is whether aioe.org pays attention to the "To:" header or
>> the "Reply-To:" header.  I have no idea; you'd have to ask them.
>
> ...any Usenet server which _only_ looks at the To: and not at the
> Reply-To: is not worth the name. If this were the case, they'd be
> forcing jacob to do the Wrong Thing.

That should be "From:" rather than "To:".

-- 
Keith Thompson (The_Other_Keith) kst-u@mib.org  <http://www.ghoti.net/~kst>
Working, but not speaking, for JetHead Development, Inc.
"We must do something.  This is something.  Therefore, we must do this."
    -- Antony Jay and Jonathan Lynn, "Yes Minister"

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.c

csiph-web