3 ms·
I did a little digging into the source and discovered that every email sent by your email alias to your main email, includes a password capable of deactivating
by nabakin 4y ago
I did a little digging into the source and discovered that every email sent by your email alias to your main email, includes a password capable of deactivating that email alias. Imagine you want to forward an email sent to you through an alias, to someone else. You've now given that person control over your email alias.
Every email from an email alias includes a link. That link is used to look at the details of that email alias and gives you the option to deactivate it. You'd think there would be some login verification to prevent just anyone from using that link, but no, anyone that has this link, can now deactivate your email alias. The password itself is formatted in json, compressed with deflate, and simply tacked on to the end of the link's URL. When you click on the link, the destination webpage takes the end of the URL, decompresses the deflate, and serves a deactivate button to deactivate the email alias. When you click on that button, the email alias's address and password are sent to DDG's API and your email alias is disabled.
- myuzio 4y agoAnother thing that worries me is that you can pretty much direct email to anybody without their consent, no verification is required from their side. Dream work for spammers and scammers.
- nabakin 4y agoYou mean, if you format the email in the right way, you can get your email alias to send an email to someone, before they send a single email to you?
- myuzio 4y agoLet's say I have made an alias from bob@duck.com to bob@example.com, I don't need any verification from Bob to be allowed to do that. Therefore I can do stuff with that email now, including registering in websites with the duck email, and send emails to Bob from that website. Well I can't tell in how many ways that can be harmful, but for example if Bob is tricked to click to the legit link from the website and enter his personal information, then I can change the alias to my own email, reset the password and have full access to Bob's verified account, so yeah, that's one big flaw IMO.
- Vinnl 4y agoBut that's only if someone knows that your email is bob@duck.com, right? (And the same would happen if someone knew your true email address was bob@example.com - they could just send emails there.) I think the intended use case is that you use a different and unique alias, e.g. randchars83@duck.com, for every service. At least, that's how we intend Firefox Relay to be used. Then you can just throw away that alias if it starts getting used for unwanted messages.
- nabakin 4y agoIf DDG wants to fix this problem, I suggest either: 1. Deactivation requires email verification 2. Email aliases are tied to your DDG account and you can only use the email link when you are logged into your account