Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Steve Freegard via mailop
Chris, On 22/03/2020 20:41, Chris via mailop wrote: > On 2020-03-22 16:20, Nick Stallman via mailop wrote: >> I got one of these the other day and I'm scratching my head about it as what's in the report cannot possibly be correct. >> >> The report was for a domain we host the website for, but

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Chris via mailop
On 2020-03-24 06:36, Steve Freegard via mailop wrote: I have great respect for you, but I didn't spend a considerable amount of development time without actually being absolutely certain about what I was doing.  Your experience is not relevant because you do not have experience with

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread micah anderson via mailop
Steve Freegard via mailop writes: > On 24/03/2020 15:10, Chris via mailop wrote: >> On 2020-03-24 06:36, Steve Freegard via mailop wrote: >> >>> I have great respect for you, but I didn't spend a considerable >>> amount of development time without actually being absolutely certain >>> about

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Steve Freegard via mailop
Hi Micah, On 24/03/2020 16:10, micah anderson wrote: FWIW, we got a couple of these Abusix reports, checked them out and determined they were all false positives. Every single one of them was either an account that hasn't existed for years, or wasn't even a valid account (like mailing list

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread micah anderson via mailop
Steve Freegard via mailop writes: > I included the partial SHA-1 to be compatible with automation and > tooling around the HaveIBeenPwned API - see > https://haveibeenpwned.com/API/v3#PwnedPasswords I understand that desire, but I wish the HaveIBeenPwned things were better. As a provider,

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Steve Freegard via mailop
On 24/03/2020 15:10, Chris via mailop wrote: On 2020-03-24 06:36, Steve Freegard via mailop wrote: I have great respect for you, but I didn't spend a considerable amount of development time without actually being absolutely certain about what I was doing.  Your experience is not relevant

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Atro Tossavainen via mailop
On Tue, Mar 24, 2020 at 10:58:14AM -0500, Al Iverson via mailop wrote: > I'm not understanding how this intersects with spamtraps. What does > this alert actually notify a network owner of? > Failed SMTP auth attempt from my IP space? > Or a failed SMTP auth attempt from someplace else TO my IP

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Steve Freegard via mailop
Hi Al, On 24/03/2020 15:58, Al Iverson via mailop wrote: I'm not understanding how this intersects with spamtraps. What does this alert actually notify a network owner of? Failed SMTP auth attempt from my IP space? Or a failed SMTP auth attempt from someplace else TO my IP space? Or door #3?

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Al Iverson via mailop
On Tue, Mar 24, 2020 at 11:27 AM Atro Tossavainen via mailop wrote: > > On Tue, Mar 24, 2020 at 10:58:14AM -0500, Al Iverson via mailop wrote: > > I'm not understanding how this intersects with spamtraps. What does > > this alert actually notify a network owner of? > > Failed SMTP auth attempt

[mailop] List archive TLS cert expired

2020-03-24 Thread Mark E. Jeftovic via mailop
PSA: SSL for list archive site has expired Websites prove their identity via certificates, which are valid for a set time period. The certificate for chilli.nosignal.org expired on 2/27/2020.   Error code: SEC_ERROR_EXPIRED_CERTIFICATE -- Mark E. Jeftovic Co-founder & CEO, easyDNS

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Chris via mailop
On 2020-03-24 11:48, Steve Freegard via mailop wrote: thraxisp@:16472 Sure - that's a totally useless password and I'm happy to report I haven't seen that particular username, but without an IP - it's a bit meaningless as I can't tell you if we're seeing traffic on it or not. I checked.

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Michael Peddemors via mailop
On 2020-03-24 9:35 a.m., micah anderson via mailop wrote: Steve Freegard via mailop writes: I included the partial SHA-1 to be compatible with automation and tooling around the HaveIBeenPwned API - see https://haveibeenpwned.com/API/v3#PwnedPasswords I understand that desire, but I wish the

Re: [mailop] List archive TLS cert expired

2020-03-24 Thread Graeme Fowler via mailop
On 24 Mar 2020, at 16:48, Mark E. Jeftovic via mailop wrote: > PSA: SSL for list archive site has expired Not the first time; hoepfully the last. We are, albeit slowly, moving onto a new platform but world and personal events have thrown a large spanner in the time available to deal with it.

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Rob McEwen via mailop
On 3/24/2020 6:36 AM, Steve Freegard via mailop wrote: Rob should have done the same Steve, The last time I even mentioned "invaluement" at MailOp - and it was an on-topic post - I got very harshly criticized for allegedly being too promotional and spammy. Someone had complained about a

Re: [mailop] Abusix Potentially Compromised Account Report

2020-03-24 Thread Graeme Fowler via mailop
On 24 Mar 2020, at 16:52, Michael Peddemors via mailop wrote: > Like others on the list pointed out, if you send 'noise' then people will > simply 'tune out' to your reports. While I commend you for looking at ways to > help address the problem, you might want to have a smaller set of more >