4 ms·
Isn't it easy to send an email and put whatever email we want as the sender? I was just wondering, does it means anyone could post on the post of someone else?
by d0m 16y ago
Isn't it easy to send an email and put whatever email we want as the sender? I was just wondering, does it means anyone could post on the post of someone else?
- dcurtis 16y agoI think they do some checking in the headers. It's not impossible to masquerade as someone. But how many people want to maliciously post to some random person's Posterous blog? Probably not too many.
- josefresco 16y agoIf the system was ever adopted widely (which I presume the founders desire) I would imagine that spoof posting would be a huge problem if someone could pull it off.
- stuntmouse 16y agoAll of the black hats who want to abuse numerous holes in your browser of choice? They wouldn't necessarily even have to get you to click on a link. There have been numerous attacks against image processing libraries.
- alex_c 16y agoI suspect blackhat SEOs would be all over it.
- robinduckett 16y agoActually, I hadn't read this comment! XD
- MrGamma 16y agoI don't think blackhats would be all over it, the links are completely invisible to a search engine... Maybe Smear Campaign artists might take to it. Or spammers...
- robinduckett 16y agoOr people trying to prove a point, check the front page :P
- alex_c 16y agoI'm not too familiar with Posterous, are all links nofollowed? Can't you post arbitrary HTML to your own blog?
- icey 16y agoLet's find out. I've just created a posterous account at http://pmn.posterous.com http://pmn.posterous.com The email that I've authorized is paul@pmn.org I've put one post on there, any other posts that appear are not from me. (I should note, I use Posterous for some personal stuff and love the service. This isn't something I've been terribly concerned about yet.)
- fierarul 16y agoI see two posts already.
- icey 16y agoSorry about that; that was a mistake I made when creating the blog. I sent an email prior to creating an account - the system was smart and merged them. I've removed the extra one, so it should be back down to one.
- brlewis 16y agoMy welcome email from July 2008 has a prominent box that says, "Setting a password for your account is easy. It's optional, but here's why you should..." What did you welcome email say?
- icey 16y agoYep, my welcome email has the same box suggesting I add a password. I think they're going to end up just as safe as every other blogging service out there.
- icey 16y agoI just got this email from Posterous: ATTENTION: We noticed you're sending this from a different computer or location, so it won't get posted until we're sure it's you. Please confirm that you sent this. So, it looks like they've thought about this problem already.
- kirubakaran 16y ago
- davi 16y agoTechCrunch had a contest about this when Posterous launched: http://techcrunch.com/2008/06/28/posterous-beats-tumblr-in-simplicity/ http://techcrunch.com/2008/06/28/posterous-beats-tumblr-in-s... Michael Arrington posted the results here: http://techcrunch.posterous.com/lots-of-fake-post-attempts-onl http://techcrunch.posterous.com/lots-of-fake-post-attempts-o...
- snprbob86 16y ago3 fake posts made it through. I'd consider > 0 a failure. I guess you could use a super secret From email address?
- mcobrien 16y ago"Apparently You don’t need a password. Posterous fail." http://blog.dustincurtis.com/apparently-765 http://blog.dustincurtis.com/apparently-765