Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c > #59474 > unrolled thread

Jacob changes provider

Back to article view | Back to comp.lang.c

Contents

  Jacob changes provider jacobnavia <jacob@jacob.remcomp.fr> - 2015-04-02 19:15 +0200
    Re: Jacob changes provider Kaz Kylheku <kaz@kylheku.com> - 2015-04-02 19:20 +0000
      Re: Jacob changes provider Noob <root@127.0.0.1> - 2015-04-02 21:50 +0200
        Re: Jacob changes provider Ian Collins <ian-news@hotmail.com> - 2015-04-03 09:05 +1300
          Re: Jacob changes provider Noob <root@127.0.0.1> - 2015-04-02 22:57 +0200

#59474 — Jacob changes provider

I have managed to get the "eternal september" account working now, and I 
will post all my messages from there. I hope that server doesn't allow 
people to post in my name, and fake messages can be then be detected easily.

jacob

[toc] | [next] | [standalone]

#59486

On 2015-04-02, jacobnavia <jacob@jacob.remcomp.fr> wrote:
> I have managed to get the "eternal september" account working now, and I 
> will post all my messages from there. I hope that server doesn't allow 
> people to post in my name, and fake messages can be then be detected easily.

A decent news posting client can be scripted to add a signature which contains
a URL like:

  ---
  Check this posting's validity with the following URL:
  http://www.jacob-navia.example.com/validate-msgid?<message-id-string>

The URL leads back to your server. If it resolves, it validates the message ID.
If the message ID in the URL in the signature matches the one in the article
headers, we can have a high confidence that it's genuine.

Without hijacking the web server or the domain, the forger has to resort to
message ID re-use, in order to forge signature URL's that resolve.

But the page to which a URL resolves can show a small summary of the emessage:
like the date and subject line. If some old message-ID is fraudulently re-used
by a forger for a new posting, it will be obvious because the URL page will
show an old date.

The forger could register a typo-squatting domain:

  Check this posting's validity with the following URL:
  http://www.jacob-nevia.example.com/validate-msgid?<message-id-string>

that would only fool a few people for a little while.

[toc] | [prev] | [next] | [standalone]

#59488

On 02/04/2015 21:20, Kaz Kylheku wrote:

> A decent news posting client can be scripted to add a signature which
> contains a URL like:
> 
>   ---
>   Check this posting's validity with the following URL:
>   http://www.jacob-navia.example.com/validate-msgid?<message-id-string>

Why not sign the messages with GPG?

https://en.wikipedia.org/wiki/GNU_Privacy_Guard
https://addons.mozilla.org/en-us/thunderbird/addon/enigmail/

Regards.

[toc] | [prev] | [next] | [standalone]

#59490

Noob wrote:
> On 02/04/2015 21:20, Kaz Kylheku wrote:
>
>> A decent news posting client can be scripted to add a signature which
>> contains a URL like:
>>
>>    ---
>>    Check this posting's validity with the following URL:
>>    http://www.jacob-navia.example.com/validate-msgid?<message-id-string>
>
> Why not sign the messages with GPG?

Because it's a really good way to piss people off on Usenet!

-- 
Ian Collins

[toc] | [prev] | [next] | [standalone]

#59491

On 02/04/2015 22:05, Ian Collins wrote:
> Noob wrote:
>> On 02/04/2015 21:20, Kaz Kylheku wrote:
>>
>>> A decent news posting client can be scripted to add a signature which
>>> contains a URL like:
>>>
>>>    ---
>>>    Check this posting's validity with the following URL:
>>>    http://www.jacob-navia.example.com/validate-msgid?<message-id-string>
>>
>> Why not sign the messages with GPG?
> 
> Because it's a really good way to piss people off on Usenet!

I don't think Jacob could piss me off more than he already does! ;-)

</tongue_in_cheek>

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.c

csiph-web