4 ms·

"In an email to CBC News, Eastlink spokesperson Jill Laing said "noreply@xxxxx.ca" business response email addresses have become commonplace across businesses a

by nikanj 9y ago

"In an email to CBC News, Eastlink spokesperson Jill Laing said "noreply@xxxxx.ca" business response email addresses have become commonplace across businesses and industries. The company believes that email may lead some to "believe that information coming from this address is from Eastlink." Sounds like this Eastlink person doesn't know most mail servers receive mail quite happily from anything@any.domain, as anyone who's ever received spam knows.

firethief 9y ago
I'm not sure what you mean, but the problem would be that noreply@ZZZ is often used by the company that runs ZZZ; using "noreply" for a personal address presents the same problems as registering other commonly-reserved addresses like postmaster@ZZZ or admin@ZZZ. It doesn't have anything to do with the ability to actually receive mail on an account named "noreply".
- NathanOsullivan 9y ago
  The parent is quoting EastLink's justification from the article
sheepdestroyer 9y ago
I think that at least gmail usually flags these kind of spoofed addresses. But in this case, being sent by valid servers, gmail or others would just acknowledge it as the valid email address that it is. Thus leading to a possible misunderstanding for the receiver.
slantyyz 9y ago
>> The company believes that email may lead some to "believe that information coming from this address is from Eastlink." The problem with their argument is that any email ending in @eastlink.ca will lead some to believe that information is from Eastlink. If you're giving customers an eastlink.ca email adddress, how can anyone tell if an email from emailname@eastlink.ca is from an Eastlink employee or not?
- nickfromseattle 9y ago
  It's not easy for the average consumer. Comcast offers free consumer Comcast.net email addresses, but their corporate emails are something like @corp.comcast.com.
  - ryanlol 9y ago
    Yes! And this makes it tremendously easy to phish comcast employees in case you need to do CPE lookups or such.
  - slantyyz 9y ago
    It's less about the average consumer than the individual ISP's approach to giving out email addresses. Given that Eastlink wanted to take back noreply@eastlink.ca (sans subdomain) and that they're a smaller, regional Canadian ISP, I would guess their process for handing out email addresses is less sophisticated than Comcast's.
endorphone 9y ago
Eastlink publishes an SPF record, so such emails would be classified as spam by any decent mail system. This guy, sending through Eastlink's hardware, would get tagged as legitimate (because it was).
nthcolumn 9y ago
It is a security issue. If he were to lose his credentials then others could use his account to send genuine looking phishing e-mails. If you were defrauded and had checked the email address as genuinely being from that address you might be minded to sue them. He could be targeted explicitly for this purpose now. Furthermore, he admitted to having read mail not intended for him and took no action to address the issue indicating that he understood that his address coincided with a namespace commonly intended for provider usage. It is unfortunate that the usage of 'noreply' has become so commonplace as to render his account a security issue. Perhaps they should give him some more time but he cannot keep it.

by nikanj 9y ago

firethief 9y ago

I'm not sure what you mean, but the problem would be that noreply@ZZZ is often used by the company that runs ZZZ; using "noreply" for a personal address presents the same problems as registering other commonly-reserved addresses like postmaster@ZZZ or admin@ZZZ. It doesn't have anything to do with the ability to actually receive mail on an account named "noreply".

NathanOsullivan 9y ago
The parent is quoting EastLink's justification from the article

sheepdestroyer 9y ago

I think that at least gmail usually flags these kind of spoofed addresses. But in this case, being sent by valid servers, gmail or others would just acknowledge it as the valid email address that it is. Thus leading to a possible misunderstanding for the receiver.

slantyyz 9y ago

>> The company believes that email may lead some to "believe that information coming from this address is from Eastlink." The problem with their argument is that any email ending in @eastlink.ca will lead some to believe that information is from Eastlink. If you're giving customers an eastlink.ca email adddress, how can anyone tell if an email from emailname@eastlink.ca is from an Eastlink employee or not?

nickfromseattle 9y ago
It's not easy for the average consumer. Comcast offers free consumer Comcast.net email addresses, but their corporate emails are something like @corp.comcast.com.
- ryanlol 9y ago
  Yes! And this makes it tremendously easy to phish comcast employees in case you need to do CPE lookups or such.
- slantyyz 9y ago
  It's less about the average consumer than the individual ISP's approach to giving out email addresses. Given that Eastlink wanted to take back noreply@eastlink.ca (sans subdomain) and that they're a smaller, regional Canadian ISP, I would guess their process for handing out email addresses is less sophisticated than Comcast's.

endorphone 9y ago

Eastlink publishes an SPF record, so such emails would be classified as spam by any decent mail system. This guy, sending through Eastlink's hardware, would get tagged as legitimate (because it was).

nthcolumn 9y ago

It is a security issue. If he were to lose his credentials then others could use his account to send genuine looking phishing e-mails. If you were defrauded and had checked the email address as genuinely being from that address you might be minded to sue them. He could be targeted explicitly for this purpose now. Furthermore, he admitted to having read mail not intended for him and took no action to address the issue indicating that he understood that his address coincided with a namespace commonly intended for provider usage. It is unfortunate that the usage of 'noreply' has become so commonplace as to render his account a security issue. Perhaps they should give him some more time but he cannot keep it.