4 ms·

So 1,700 out of 1,000,000, i.e. around 0.2%. "Not common" is one way of putting it, I guess.

by unwind 2y ago

croemer 2y ago
Those 1,700 are easy to find though, just need to dig a bunch of domain names and you'll find plenty vulnerable ones that you can spoof. Yahoo Mail has a market share on the order of 3%. So a black hat could then target a decent chunk of users with @yahoo addresses specifically. Has anyone heard of this being exploited in the wild? Would be interesting to find out whether there are some reputable domains among the 1.7k vulnerable ones.
- elif 2y ago
  Your claim that yahoo uses a 512bit key are counterfactual. Please adhere to honesty and good faith arguments.
  - croemer 2y ago
    I never suggested that Yahoo uses 512bit keys, that's a misunderstanding. The article clearly states that Yahoo is one of the 3 clients that didn't reject 512bit keys the way they should per RFC. Yahoo Mail inbox users are vulnerable _receivers_ of spoofed emails.
    - 1oooqooq 2y ago
      remember when yahoo mail was the first one to implement DKIM validation and then all mailing list owners added a footer telling their subscribers not to use yahoo mail because it was broken, instead of calling their mailing list providers to upload a key? yeah nobody remembers, but yahoo probably do. i doubt they will err on the side of security again.
      - jaza 2y ago
        The Yahoo that built Yahoo Mail no longer exists, so actually they probably don't remember.
awulf 2y ago
I agree, but to be precise, it was 1,726 out of 476,617 DKIM keys found across those 1M domains, or about 0.36%. Since it's impossible to determine all DKIM records a domain might have from the outside, I used a list of commonly used selectors (e.g., "default' or 'key1") for the search. It's likely there are additional short keys under selectors I didn't check.
philipwhiuk 2y ago
The top million domains are more likely to be on top of their security than less prominent domains. 0.2% is therefore a fairly strict lower bound for the overall internet.

So 1,700 out of 1,000,000, i.e. around 0.2%. "Not common" is one way of putting it, I guess.

by unwind 2y ago

So 1,700 out of 1,000,000, i.e. around 0.2%. "Not common" is one way of putting it, I guess.

Those 1,700 are easy to find though, just need to dig a bunch of domain names and you'll find plenty vulnerable ones that you can spoof. Yahoo Mail has a market share on the order of 3%. So a black hat could then target a decent chunk of users with @yahoo addresses specifically. Has anyone heard of this being exploited in the wild? Would be interesting to find out whether there are some reputable domains among the 1.7k vulnerable ones.

elif 2y ago
Your claim that yahoo uses a 512bit key are counterfactual. Please adhere to honesty and good faith arguments.
- croemer 2y ago
  I never suggested that Yahoo uses 512bit keys, that's a misunderstanding. The article clearly states that Yahoo is one of the 3 clients that didn't reject 512bit keys the way they should per RFC. Yahoo Mail inbox users are vulnerable _receivers_ of spoofed emails.
  - 1oooqooq 2y ago
    remember when yahoo mail was the first one to implement DKIM validation and then all mailing list owners added a footer telling their subscribers not to use yahoo mail because it was broken, instead of calling their mailing list providers to upload a key? yeah nobody remembers, but yahoo probably do. i doubt they will err on the side of security again.
    - jaza 2y ago
      The Yahoo that built Yahoo Mail no longer exists, so actually they probably don't remember.

awulf 2y ago

I agree, but to be precise, it was 1,726 out of 476,617 DKIM keys found across those 1M domains, or about 0.36%. Since it's impossible to determine all DKIM records a domain might have from the outside, I used a list of commonly used selectors (e.g., "default' or 'key1") for the search. It's likely there are additional short keys under selectors I didn't check.

philipwhiuk 2y ago

The top million domains are more likely to be on top of their security than less prominent domains. 0.2% is therefore a fairly strict lower bound for the overall internet.