4 ms·
How is this a vulnerability? 1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they alwa
by bramblerose 10y ago
How is this a vulnerability?
1) Email addresses added to the 'send from' list in Gmail are used to send emails with an alternative From: address, but they always contain a correct envelope-from header, so the emails will typically show up as 'Google (sent by: SuperHacker@gmail.com)', or something along those lines.
2) gmail.com doesn't have a forced-fail SPF record, so one could just send emails From: google@gmail.com using /any/ mail server, as long as the receiving mail server doesn't interpret softfail as fail -- and it shouldn't.