[4194] in WWW Security List Archive
Re: Return Receipts and Security
daemon@ATHENA.MIT.EDU (David W. Morris)
Thu Jan 30 05:30:20 1997
Date: Thu, 30 Jan 1997 00:45:35 -0800 (PST)
From: "David W. Morris" <dwm@xpasc.com>
To: Pat_Noziska@gatekeeper.atlas.com
cc: www-security@ns2.rutgers.edu
In-Reply-To: <9701288544.AA854487301@smtplink>
Errors-To: owner-www-security@ns2.rutgers.edu
On Tue, 28 Jan 1997 Pat_Noziska@gatekeeper.atlas.com wrote:
>
> Would there be ANY security-related reason (other than privacy) for a mail host
> to NOT issue return receipt (or delivery notification) messages on incoming
> mail messages that request it using a "Return-Receipt-To: " header?
For sure the recipient should have control over whether the receipt is
sent. That should cover the privacy issue.
Beyond that, I would think a receipt would be a kind of probe response
which would reveal information about the recipient's current activity
with the system. Since we don't know anything more about your actual
implementation design, its hard to be sure, but consider:
Mail sent with reply requested.
No reply received.
Cracker assumes addressee is not logged and proceeds to crack their way
in as the addressee.
Having some level of assurance a user one wanted to surrogate for isn't
around would reduce the probability of timely detection.
Dave Morris
