09-20-07 06:14 PM
With the current discussion about a global remailer address block, it
reminded me of a possible loophole with address blocking in general.
This is nothing new introduced with the discussed global block but a
problem that exists with the current system too.
It is standard in many mail servers to accept the form:
username+whatever@domain.com and deliver that to 'username'. It can be
disabled, but it works in many (most?) mail servers.
Way before services popped up allowing aliases to be used for spam
prevention purposes, people would use this form of email address so
they could see who was selling their email address for example. I used
to do this about 10 years ago and give an individual +name to anyone I
gave my email address to.
Currently, if a user requests their email address username@domain.com
to be blocked and a remop obliged, an abuser could send to
username+blah@domain.com and still get it through.
As there is talk of updating the way remailers block addresses, I
thought it would be a good time to mention it. Ideally, the remailer
software should simply remove the +whatever part as removing it won't
affect mail delivery because the end mail server ignores that part
anyway. It would also ensure any blocks can't be bypassed.
[ Post a follow-up to this message ]
| 
