4 ms·
Email is an incredibly weak form of validation. Mix a lack of DMARC policy with some social engineering and you have a dox.
by woodman 10y ago
Email is an incredibly weak form of validation. Mix a lack of DMARC policy with some social engineering and you have a dox.
- toast0 10y agoOk, so you spoof mail from totallyanofficer@yourlocalpoliceforce.gov, and they respond with 'yeah, that number is totally a google number, you should serve them any requests at legal at google dot com (or whatever it)' and totallyandofficer is confused and you didn't get your information.
- patrickg_zill 10y agomore likely the email server is compromised; so as soon as the doxxer sees the email come in, they copy and then delete from the Officer Friendly's inbox.
- woodman 10y agoAn email has at least three fields that can both influence the address to which a reply goes and isn't necessarily visible to the recipient's MUA. Even if the recipient where to look into the headers, there are plenty of games to play with deceptively constructed international domain names. There is also the social engineering aspect I mentioned.