[3425] in Privacy_Forum
[ PRIVACY Forum ] "How a Google Headhunter's E-Mail Unraveled a
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Wed Oct 24 12:23:59 2012
Date: Wed, 24 Oct 2012 08:56:52 -0700
To: privacy-list@vortex.com
Message-ID: <20121024155652.GG14898@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
"How a Google Headhunter's E-Mail Unraveled a Massive Net Security
Hole" + my comments
http://j.mp/QXdOnZ (This message on Google+)
- - -
http://j.mp/QXeppK (Wired)
"The problem lay with the DKIM key (DomainKeys Identified Mail) Google
used for its google.com e-mails. DKIM involves a cryptographic key
that domains use to sign e-mail originating from them - or passing
through them - to validate to a recipient that the header information
on an e-mail is correct and that the correspondence indeed came from
the stated domain. When e-mail arrives at its destination, the
receiving server can look up the public key through the sender's DNS
records and verify the validity of the signature."
- - -
Well, what appeared to be mail from a headhunter anyway. But the
irony here is that DKIM is much less useful in preventing these kinds
of (spam-related, human engineering) attacks than might be thought,
since (a) most sites -- including legit ones -- don't routinely
support it, and (b) most email recipients are largely oblivious to any
associated warnings. So, while DKIM indicating a problem with mail
from the citi.com domain might be noticed by some users running
compatible MUAs (Message User Agents), mail coming from a forged,
non-DKIM supporting domain like citi-banking.com would probably be
accepted as reasonable by many or most recipients.
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
- Data Wisdom Explorers League: http://www.dwel.org
- Global Coalition for Transparent Internet Performance: http://www.gctip.org
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://vortex.com/g+lauren / Twitter: http://vortex.com/t-lauren
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
