4 ms·

I checked DKIM records and they did pass. Many emails did not have DKIM headers, but I never found one that contained DKIM headers, and failed validation.

by Judson 9y ago

Operyl 9y ago
Hmm, interesting. I'm now downloading the archive and going to run through and check again. Edit: Huh, guess Wikileaks has a hard 40Mbit down limit for downloads, this might take a while. Edit 2: Not sure if this is due to time since leaks, and weirdness, but one such email I found was https://wikileaks.org/podesta-emails/emailid/41063 https://wikileaks.org/podesta-emails/emailid/41063 dkim.ValidationError: body hash mismatch (got xYeNHE1y7S7c90FEmj0Clvuu8UkskqNWL3LiuMxCrsc=, expected SFTNrt5rWQXzb3TEj9vxbo/FLGDSOiYFg+04PjFRv3A=) While I'm finding valid headers, I'm finding a good portion of negatives too. I have to sort through the spam emails in his inbox first though (lots of irrelevant DKIM failures). Edit 3: Just some numbers (which are definitely inflated from the spam emails I found, by how much I'm not sure): root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat output | wc -l 9981 root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat totest | wc -l 28024 root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# ls out/ | wc -l 50887 Edit 4 (and the last): The quick script thrown together to put numbers together, https://gist.github.com/Omeryl/c6cbe603721f5671b9056ca127399946 https://gist.github.com/Omeryl/c6cbe603721f5671b9056ca127399.... I don't have the time to go through and see how many of those messages are spam that are just failing to validate, etc. It's worth noting that some messages may be failing to validate because x= is past, etc, as well.
- deleted 9y ago
  [deleted]
deleted 9y ago
[deleted]
tzs 9y ago
Someone tested several on Reddit using two different validators. There were some that failed validation with one of the validators. Details are in the document linked to in the Reddit submission. Here is the Reddit submission: https://www.reddit.com/r/WikiLeaks/comments/58w8nh/the_podesta_emails_dkim_verifier_results/ https://www.reddit.com/r/WikiLeaks/comments/58w8nh/the_podes...
- aesh2Xa1 9y ago
  Yeah, but the author claims that they are valid at the end of the post. Also see: https://www.reddit.com/r/DNCleaks/comments/58v1if/dkim_verification_on_emails_response_to_something/ https://www.reddit.com/r/DNCleaks/comments/58v1if/dkim_verif...
  - Operyl 9y ago
    I mean, you can go verify it yourself. This is the way I feel: even if some of them are valid, what prevents someone from adding in a bunch that aren't? Just because some are valid, doesn't make the entire dump valid imo.

I checked DKIM records and they did pass. Many emails did not have DKIM headers, but I never found one that contained DKIM headers, and failed validation.

by Judson 9y ago

I checked DKIM records and they did pass. Many emails did not have DKIM headers, but I never found one that contained DKIM headers, and failed validation.

Operyl 9y ago

Hmm, interesting. I'm now downloading the archive and going to run through and check again. Edit: Huh, guess Wikileaks has a hard 40Mbit down limit for downloads, this might take a while. Edit 2: Not sure if this is due to time since leaks, and weirdness, but one such email I found was https://wikileaks.org/podesta-emails/emailid/41063 https://wikileaks.org/podesta-emails/emailid/41063 dkim.ValidationError: body hash mismatch (got xYeNHE1y7S7c90FEmj0Clvuu8UkskqNWL3LiuMxCrsc=, expected SFTNrt5rWQXzb3TEj9vxbo/FLGDSOiYFg+04PjFRv3A=) While I'm finding valid headers, I'm finding a good portion of negatives too. I have to sort through the spam emails in his inbox first though (lots of irrelevant DKIM failures). Edit 3: Just some numbers (which are definitely inflated from the spam emails I found, by how much I'm not sure): root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat output | wc -l 9981 root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# cat totest | wc -l 28024 root@ubuntu-512mb-nyc1-01:/mnt/volume-nyc1-01# ls out/ | wc -l 50887 Edit 4 (and the last): The quick script thrown together to put numbers together, https://gist.github.com/Omeryl/c6cbe603721f5671b9056ca127399946 https://gist.github.com/Omeryl/c6cbe603721f5671b9056ca127399.... I don't have the time to go through and see how many of those messages are spam that are just failing to validate, etc. It's worth noting that some messages may be failing to validate because x= is past, etc, as well.

deleted 9y ago
[deleted]

deleted 9y ago

[deleted]

tzs 9y ago

Someone tested several on Reddit using two different validators. There were some that failed validation with one of the validators. Details are in the document linked to in the Reddit submission. Here is the Reddit submission: https://www.reddit.com/r/WikiLeaks/comments/58w8nh/the_podesta_emails_dkim_verifier_results/ https://www.reddit.com/r/WikiLeaks/comments/58w8nh/the_podes...

aesh2Xa1 9y ago
Yeah, but the author claims that they are valid at the end of the post. Also see: https://www.reddit.com/r/DNCleaks/comments/58v1if/dkim_verification_on_emails_response_to_something/ https://www.reddit.com/r/DNCleaks/comments/58v1if/dkim_verif...
- Operyl 9y ago
  I mean, you can go verify it yourself. This is the way I feel: even if some of them are valid, what prevents someone from adding in a bunch that aren't? Just because some are valid, doesn't make the entire dump valid imo.