4 ms·
Does it just post to the correct page based on the from email? If so, how do you protect against email spoofing?
by benstopics 4y ago
Does it just post to the correct page based on the from email? If so, how do you protect against email spoofing?
- npilk 4y agoYes, it parses based on the from email. The short answer is that it doesn't protect against email spoofing. I do have some filtering set up, but it hasn't been effective in my testing. However, you do receive a confirmation email after every new post. So if someone spoofed your email to make a post, you would get a notification email about that post. In the notification, you'd see what had been posted and could easily delete it. (Note that the email address associated with an account isn't made public anywhere, so someone would need to have doxxed you in this scenario.) Of course, it would be pretty easy for a determined attacker to set up a mailbomb that flooded someone's page with hundreds of spoofed posts. At that point I would have to disable email posting for that account to stop the attack. I'd be interested if you have any suggestions!
- benstopics 4y agoI think a pin number might be an easy solution. Just sign with #1234 at the bottom of the email.