4 ms·

I'm not sure I would have contacted Apple about this, given their penchant for punishing security researchers who bring problems to their attention. What I don

I'm not sure I would have contacted Apple about this, given their penchant for punishing security researchers who bring problems to their attention. What I don't fully understand is if the attacker doesn't need access to the email account in question, why would they even use valid email addresses? Wouldn't it be less risky to use bogus addresses?

jon2512chua 15y ago
It's because most registration form not only checks that the email address you entered is valid but also whether it exists. This is done by using nslookup to query for a domain's MX record and then checking the specific address. Here's a post I found detailing how to use it: http://www.webdigi.co.uk/blog/2009/how-to-check-if-an-email-address-exists-without-sending-an-email/ http://www.webdigi.co.uk/blog/2009/how-to-check-if-an-email-...