|
 | | Re: E-mail authentication during posting
|
| (...) Wouldn't that allow a determined spoofer to wait till it was obvious that someone known to be a member was logged in (say if he saw a flurry of posts from you in .pirate within a few min of each other) and then spoof as you, at least as long (...) (23 years ago, 18-Jun-01, to lugnet.admin.nntp)
| |
|  
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Wouldn't that allow a determined spoofer to wait till it was obvious that someone known to be a member was logged in (say if he saw a flurry of posts from you in .pirate within a few min of each other) and then spoof as you, at least as long (...) (23 years ago, 18-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) My idea was provide a link to a place where I can more easily confirm a bunch of messages, perhaps on my login screen or something. In any case, you would only be able to get to the pending messages for the user your browser is logged into. (23 years ago, 18-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Todd, I know you didn't ask for suggestions and probably don't want any, but I'm going to throw one out anyway. Would it be possible to concatenate the confirmation messages for a given time-period into one message? It would remove the instant (...) (23 years ago, 18-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) but by doing that, you'll be breaking the whole authentication process - If I know that you have such a rule that auto authorizes posts by you, I can spoof posts as you with no problem... your auto-reply will authorize them without (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Not currently, no. Let me think about IP-based authentication for a while. (...) This I can definitely do, but it will have to be at least somewhat interactive so that someone doesn't accidentally cause a message to get posted simply by (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) IP addresses can easily be spoofed, as long as you don't need an interactive session... as in, if I just need to send an HTTP POST, and don't need to read the reply, I can spoof the source ip with no problem. :/ (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Personally, I am not a big fan of doing anything IP based. There are far too many problems. AOL dials, multiple computers (I regularly use three myself) and many other issues have made me decide against this method time and time again. <END (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| Hi Todd - I'd also like to thank you for this. Now LUGNET is more secure. I do want to continue to voice the concerns a few others have had here though. I also use a newsreader 90% of the time to post, and its an inconvenience. It would be great if (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) I think that's a concern we all share, including Todd. I know that he has been very concerned about that every time the issue has come up in the past. What we have to do is work towards a system which is as painless as possible, which does not (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Not to mention the fact that many businesses and ISP's (Roadrunner for one) use DHCP so peoples IP's can and do change from day to day. I agree with Jake in his view that IP based authentication just won't work. Eric Kingsley (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) Some tricks could be played to make it more secure. One would be to scan the message for the user's password and if it found it, but it didn't seem to be part of an authenticator, bounce the message. It could also use a fuzzy match for the (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) you can't have the server scan for the users password in the message, since passwords arn't usually saved anywhere on the server at all. So to check for the password, each word, or combination of chars actually (since space can be part of the (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| |
|
mail
(score: 1.408)
|
|
| | Re: E-mail authentication during posting
|
| (...) I'm not either -- at least not as something that can be relied upon for everyone. (...) Ya, it's fine for short-term login things when mixed with a password, but HTTP proxy servers really complicate the equation. Basically you can't trust the (...) (23 years ago, 19-Jun-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| |
|
mail
(score: 1.408)
|
|
| | Re: E-Mail Confirmations Working?
|
| (...) I didn't get a confirmation email to my test post (interface) just now, but more than that, I haven't received any posts by email from the groups to which I subscribe since sometime yesterday. Should I unsubscribe so I don't get a huge batch (...) (23 years ago, 25-Sep-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
|
| | Re: e-mail delay
|
| (...) The web interface seemed to be down for a while today also, looks like it's back up. Hopefully the rest is up. I kinda got a clue when I looked at the posts for the last 12 hours a couple hours ago and there were _THREE_... (23 years ago, 26-Sep-01, to lugnet.admin.nntp)
| |
|
mail
(score: 1.408)
|
