5 ms·

Is the secrecy of the blog's email address the only thing protecting anyone from posting to a blog via email? "From" headers on emails are easy to spoof, and i

Is the secrecy of the blog's email address the only thing protecting anyone from posting to a blog via email? "From" headers on emails are easy to spoof, and it doesn't look like you're requiring digital signatures.

SkyLinx 5y ago
At the moment authorization relies on the secrecy of the unique address, yes. I wanted to keep it simple. As long as you don't share that address, which is close to impossible to guess, you should be fine. Is there something else you would recommend I implement, that doesn't impact on usability? Thanks!
- throwawayboise 5y ago
  I'm not an expert here, but I suppose that only processing emails that have pass all the SPF/DKIM/DMARC checks would help. This may be something your email server already does, before your app ever sees the emails. Otherwise, requiring a digital signature doesn't seem like a huge usability hurdle to me, most email clients support this pretty routinely.
  - ipaddr 5y ago
    That would be such a big hurdle for the average user. The risk is low and the subject(blog) makes this a low target.
    - SkyLinx 5y ago
      Yeah I think it would be a little overkill. The unique email addresses are almost impossible to guess so you just need to make sure you don't share them with anyone.
      - thepratt 5y ago
        Just thinking out loud here, what about having to attach a key as an attachment?
        SkyLinx 5y ago
        What kind of key? I am just afraid to make it "complicated" because now it's as simple as sending an email to some address. :)
        thepratt 5y ago
        You would provide this file for them to download alongside where you show the email address; the file would be equivalent to an API key - should be a symmetric key. It's sort of just swapping out an Authorization header for a file with an expected checksum/contents. If the barrier is technical abilities, trying to set up public/private keys and/or signing the emails could hinder adoption.
        SkyLinx 5y ago
        I'll think about it. For me keeping things simple is a priority. What are the chances that a user might share the unique email address by mistake?
        MathCodeLove 5y ago
        One more suggestion that would, IMO, be fairly simple. Tell the user to write in their subject line a {accessKey: 'someKey'}. The access key is given to them at the time of creation and can be regenerated as often, or rarely, as the user prefers. If they want update it weekly to provide an extra layer of security they can, or they could keep it the same forever with it just bein a handy backup in case they do link the random email. Just a thought.
        SkyLinx 5y ago
        For now I am taking notes but I need to think this through. I really don't want to compromise the ease of use :)
- ithkuil 5y ago
  Is it easy to regenerate that address when I want to?
  - SkyLinx 5y ago
    Not currently, but it would be a few minutes work to add that possibility. I'll take a note about it :)
- ihadfun 5y ago
  How about having an option to “approve” the post. For example, after I email the post the system sends an email to my registered address with “publish” and “deny” buttons. One click and it’s done.
  - SkyLinx 5y ago
    I'm taking a note. Shouldn't take too long to implement but I think this would be optional as some people could be happy with the just difficult to guess address. :)
spc476 5y ago
My blogging engine [1] also supports submission via email (and has for twenty years). I have a unique email address for it and it has never been spammed (or received anything from anybody except for me). The only check my software does is check the author field (in the body of the email [2]) is allowed. [1] https://github.com/spc476/mod_blog https://github.com/spc476/mod_blog [2] I could check the From: field, but the majority of the email processing is shared with the "local file submission" feature.
jonnydubowsky 5y ago
Evernote has a really cool email-to-note feature that relies on a secret custom email address. The additional requirement is that only the email addresses connected to the Evernote account can be used to send information into the system. I'm not sure how they do this under the hood, but if anyone knows, please let us know. The Evernote feature has an additional layer of awesomeness... As it is mainly used to email items into a specific Evernote notebook, you can choose which notebook to send this magic email to, by adding @notebookname to the email subject. Hashtags that follow the notebook are added to the note as well. Dynablogger is really cool! I'm signing up now and look forward to diving in. Great work!
- SkyLinx 5y ago
  Thank you! Looking forward to hearing from you with any feedback you may have. Hope you like it! :)

SkyLinx 5y ago

At the moment authorization relies on the secrecy of the unique address, yes. I wanted to keep it simple. As long as you don't share that address, which is close to impossible to guess, you should be fine. Is there something else you would recommend I implement, that doesn't impact on usability? Thanks!

throwawayboise 5y ago
I'm not an expert here, but I suppose that only processing emails that have pass all the SPF/DKIM/DMARC checks would help. This may be something your email server already does, before your app ever sees the emails. Otherwise, requiring a digital signature doesn't seem like a huge usability hurdle to me, most email clients support this pretty routinely.
- ipaddr 5y ago
  That would be such a big hurdle for the average user. The risk is low and the subject(blog) makes this a low target.
  - SkyLinx 5y ago
    Yeah I think it would be a little overkill. The unique email addresses are almost impossible to guess so you just need to make sure you don't share them with anyone.
    - thepratt 5y ago
      Just thinking out loud here, what about having to attach a key as an attachment?
      - SkyLinx 5y ago
        What kind of key? I am just afraid to make it "complicated" because now it's as simple as sending an email to some address. :)
        thepratt 5y ago
        You would provide this file for them to download alongside where you show the email address; the file would be equivalent to an API key - should be a symmetric key. It's sort of just swapping out an Authorization header for a file with an expected checksum/contents. If the barrier is technical abilities, trying to set up public/private keys and/or signing the emails could hinder adoption.
        SkyLinx 5y ago
        I'll think about it. For me keeping things simple is a priority. What are the chances that a user might share the unique email address by mistake?
        MathCodeLove 5y ago
        One more suggestion that would, IMO, be fairly simple. Tell the user to write in their subject line a {accessKey: 'someKey'}. The access key is given to them at the time of creation and can be regenerated as often, or rarely, as the user prefers. If they want update it weekly to provide an extra layer of security they can, or they could keep it the same forever with it just bein a handy backup in case they do link the random email. Just a thought.
        SkyLinx 5y ago
        For now I am taking notes but I need to think this through. I really don't want to compromise the ease of use :)
ithkuil 5y ago
Is it easy to regenerate that address when I want to?
- SkyLinx 5y ago
  Not currently, but it would be a few minutes work to add that possibility. I'll take a note about it :)
ihadfun 5y ago
How about having an option to “approve” the post. For example, after I email the post the system sends an email to my registered address with “publish” and “deny” buttons. One click and it’s done.
- SkyLinx 5y ago
  I'm taking a note. Shouldn't take too long to implement but I think this would be optional as some people could be happy with the just difficult to guess address. :)

spc476 5y ago

My blogging engine [1] also supports submission via email (and has for twenty years). I have a unique email address for it and it has never been spammed (or received anything from anybody except for me). The only check my software does is check the author field (in the body of the email [2]) is allowed. [1] https://github.com/spc476/mod_blog https://github.com/spc476/mod_blog [2] I could check the From: field, but the majority of the email processing is shared with the "local file submission" feature.

jonnydubowsky 5y ago

Evernote has a really cool email-to-note feature that relies on a secret custom email address. The additional requirement is that only the email addresses connected to the Evernote account can be used to send information into the system. I'm not sure how they do this under the hood, but if anyone knows, please let us know. The Evernote feature has an additional layer of awesomeness... As it is mainly used to email items into a specific Evernote notebook, you can choose which notebook to send this magic email to, by adding @notebookname to the email subject. Hashtags that follow the notebook are added to the note as well. Dynablogger is really cool! I'm signing up now and look forward to diving in. Great work!

SkyLinx 5y ago
Thank you! Looking forward to hearing from you with any feedback you may have. Hope you like it! :)