5 ms·

Is this verified? 404 Media wrote that they got an email from the researcher impersonating Rabbit[0], but the unpaywalled part of that doesn't explicitly say th

Is this verified? 404 Media wrote that they got an email from the researcher impersonating Rabbit[0], but the unpaywalled part of that doesn't explicitly say that they verified the headers. I could spoof an email from president@whitehouse.gov to an email server that doesn't strictly enforce SPF etc., but that's a lot different than sending an email out via the actual whitehouse.gov mailserver. Given the other claims, I don't doubt that researchers can do this. I just haven't yet seen a strong verification of this claim. [0]https://www.404media.co/researchers-prove-rabbit-ai-breach-by-sending-email-to-us-as-admin/ https://www.404media.co/researchers-prove-rabbit-ai-breach-b...

Shank 2y ago
> but the unpaywalled part It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. In theory, I think you can register and bypass it for free.
- flutas 2y ago
  > It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. That's still a paywall. > In theory, I think you can register and bypass it for free. The price is your data and them spamming your email/selling it to whoever to spam.
  - KomoD 2y ago
    No, it's not a paywall, you aren't paying. It's in the name paywall
    - flutas 2y ago
      > Pay: to give in return for goods or service So, yes. A Paywall. By the very definition of the word. If you can't bypass it without giving something it is a pay wall.
Retr0id 2y ago
I was among those who received a demonstration email, and I can confirm that DKIM+DMARC+SPF all checked out. Someone else shared an .eml, which I haven't looked at personally, but presumably checks out: https://x.com/RhinozzCode/status/1805987021304820181 https://x.com/RhinozzCode/status/1805987021304820181
- kstrauser 2y ago
  Thanks for that! Again, it's not that I doubted it in the light of everything else, but wanted some verification before I talk about it to friends.

Shank 2y ago

> but the unpaywalled part It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. In theory, I think you can register and bypass it for free.

flutas 2y ago
> It's worth noting that as far as I'm aware, 404Media doesn't have a paywall, it has a sign-in wall. That's still a paywall. > In theory, I think you can register and bypass it for free. The price is your data and them spamming your email/selling it to whoever to spam.
- KomoD 2y ago
  No, it's not a paywall, you aren't paying. It's in the name paywall
  - flutas 2y ago
    > Pay: to give in return for goods or service So, yes. A Paywall. By the very definition of the word. If you can't bypass it without giving something it is a pay wall.

Retr0id 2y ago

I was among those who received a demonstration email, and I can confirm that DKIM+DMARC+SPF all checked out. Someone else shared an .eml, which I haven't looked at personally, but presumably checks out: https://x.com/RhinozzCode/status/1805987021304820181 https://x.com/RhinozzCode/status/1805987021304820181

kstrauser 2y ago
Thanks for that! Again, it's not that I doubted it in the light of everything else, but wanted some verification before I talk about it to friends.