Re: Transparent hijacking of SMTP submission...

2014-12-03 Thread Owen DeLong
There’s a big difference between illegal and civil liability for breech of contract. If I am paying someone for access to the internet, then I expect them not to modify, alter, rewrite, or otherwise interfere with my packets. If they do so, they may not have violated 47 USC 230, but they have

Re: Transparent hijacking of SMTP submission...

2014-12-03 Thread Owen DeLong
I suspect it isn’t comcast at all. I suspect it is the wifi operator and they happen to use comcast as an upstream. The RDNS points to the public address in front of the wifi. The proxy doing the rewriting is likely behind that. Owen On Nov 29, 2014, at 10:46 AM, Christopher Morrow

Re: Transparent hijacking of SMTP submission...

2014-12-03 Thread John R. Levine
There’s a big difference between illegal and civil liability for breech of contract. If I am paying someone for access to the internet, then I expect them not to modify, alter, rewrite, or otherwise interfere with my packets. If they do so, they may not have violated 47 USC 230, but they have

Re: Transparent hijacking of SMTP submission...

2014-12-01 Thread Livingood, Jason
On 11/29/14, 12:26 PM, Jean-Francois Mezei jfmezei_na...@vaxination.ca wrote: However, in the case of SMTP, due to the amount of spam, most ISPs break network neutrality by blocking outbound port 25 for instance Whatever Net Neutrality may mean this week, it is usually intended to allow for

Re: Transparent hijacking of SMTP submission...

2014-12-01 Thread Livingood, Jason
On 11/29/14, 3:17 PM, John Levine jo...@iecc.com wrote: PS: I know enough technical people at Comcast that I would be extremely surprised if it were Comcast doing this. There's plenty not to like about the corporation, but the technical staff are quite competent. Thanks, John! I can tell folks

Re: Transparent hijacking of SMTP submission...

2014-11-30 Thread William Herrin
n Sat, Nov 29, 2014 at 10:27 PM, joel jaeggli joe...@bogus.com wrote: The phenomena I reported was observed on a consumer cable service (not my own). it is now no-longer in evidence with that same source ip. In answer an intermediate observation, the cpe and the devices on it are sufficiently

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Randy Bush
I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread William Herrin
On Thu, Nov 27, 2014 at 9:51 PM, Jay Ashworth j...@baylink.com wrote: - Original Message - From: William Herrin b...@herrin.us I'm not sure I follow your complaint here. Are you saying that Comcast or a Comcast customer in Washington state stripped the STARTTLS verb from the

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Sander Steffann
Op 29 nov. 2014, om 19:37 heeft Randy Bush ra...@psg.com het volgende geschreven: i think of it as an intentional traffic hijack. i would be talking to a lawyer. randy, who plans to test next time he is behind comcast I am so glad that our Dutch net neutrality laws state that providers of

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Jean-Francois Mezei
On 14-11-29 11:07, Sander Steffann wrote: I am so glad that our Dutch net neutrality laws state that providers of Internet access services may not hinder or delay any services or applications on the Internet (unless [...], but those exceptions make sense) However, in the case of SMTP, due

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Christopher Morrow
backing up a bit in the conversation, perhaps this is just in some regions of comcastlandia? I don't see this in Northern Virginia... $ openssl s_client -starttls smtp -connect my-mailserver.net:587 CONNECTED(0003) depth=0 description = kVjtrCL8rUdvd00q, C = US, CN = my-mailserver.net,

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread John Levine
In article cal9jlay1q_rbkyb6kczkzuifr5b1r3kuvz8wivwr0rjj_oa...@mail.gmail.com you write: backing up a bit in the conversation, perhaps this is just in some regions of comcastlandia? I don't see this in Northern Virginia... I don't see it in New Jersey, either. Is this a direct connection, or a

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread John Levine
i think of it as an intentional traffic hijack. i would be talking to a lawyer. If the lawyer says anything other than that 47 USC 230(c)(2)(A) provides broad immunity for ISP content filtering, even if the filters sometimes screw up, you need a new lawyer. Filtering STARTTLS on port 587 is

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Larry Sheldon
On 11/29/2014 14:09, John Levine wrote: In article cal9jlay1q_rbkyb6kczkzuifr5b1r3kuvz8wivwr0rjj_oa...@mail.gmail.com you write: backing up a bit in the conversation, perhaps this is just in some regions of comcastlandia? I don't see this in Northern Virginia... I don't see it in New Jersey,

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Randy Bush
The STARTTLS filter was merely a tool used to divert and tap the traffic. It is the latter which is over the line. randy, on a teensy non-computer On Nov 29, 2014, at 15:17, John Levine jo...@iecc.com wrote: i think of it as an intentional traffic hijack. i would be talking to a lawyer.

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Marcin Cieslak
On Thu, 27 Nov 2014, joel jaeggli wrote: I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Christopher Morrow
On Sat, Nov 29, 2014 at 3:09 PM, John Levine jo...@iecc.com wrote: In article cal9jlay1q_rbkyb6kczkzuifr5b1r3kuvz8wivwr0rjj_oa...@mail.gmail.com you write: backing up a bit in the conversation, perhaps this is just in some regions of comcastlandia? I don't see this in Northern Virginia... I

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread joel jaeggli
On 11/29/14 6:32 PM, Christopher Morrow wrote: On Sat, Nov 29, 2014 at 3:09 PM, John Levine jo...@iecc.com wrote: In article cal9jlay1q_rbkyb6kczkzuifr5b1r3kuvz8wivwr0rjj_oa...@mail.gmail.com you write: backing up a bit in the conversation, perhaps this is just in some regions of

Re: Transparent hijacking of SMTP submission...

2014-11-29 Thread Christopher Morrow
On Sat, Nov 29, 2014 at 10:27 PM, joel jaeggli joe...@bogus.com wrote: On 11/29/14 6:32 PM, Christopher Morrow wrote: On Sat, Nov 29, 2014 at 3:09 PM, John Levine jo...@iecc.com wrote: In article cal9jlay1q_rbkyb6kczkzuifr5b1r3kuvz8wivwr0rjj_oa...@mail.gmail.com you write: backing up a bit

Transparent hijacking of SMTP submission...

2014-11-27 Thread joel jaeggli
I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27 Nov

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Mark Andrews
Which is why your MTA should always be setup to require the use of STARTTLS. Additionally the CERT presented should also match the name of the server. There is absolutely no reason for a ISP / hotspot to inspect submission traffic. The stopping spam argument doesn't wash with submission. Mark

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Suresh Ramasubramanian
Yes. Till that hotspots IP space gets blackholed by a major freemail because of all the nigerians and hijacked devices emitting bot traffic through stolen auth credentials. There's other ways to stop this but they take actual hard work and rather more gear than a rusted up old asa you pull out of

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Mark Andrews
In message CAArzuouvhnHo7BbAWUwiR3=m0x2O6Qe=2qlcvb29i07oax-...@mail.gmail.com , Suresh Ramasubramanian writes: Yes. Till that hotspots IP space gets blackholed by a major freemail because of all the nigerians and hijacked devices emitting bot traffic through stolen auth credentials. Why

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread William Herrin
On Thu, Nov 27, 2014 at 2:54 PM, joel jaeggli joe...@bogus.com wrote: I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Suresh Ramasubramanian
No. He is a comcast customer. And some third party wifi access point blocked his smtp submission over TLS by setting up an asa device to inspect 587 as well. On Nov 28, 2014 6:16 AM, William Herrin b...@herrin.us wrote: On Thu, Nov 27, 2014 at 2:54 PM, joel jaeggli joe...@bogus.com wrote: I

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Suresh Ramasubramanian
Oh it depends on the numbers. Just how many legitimate smtp submission attempts do you get from say an access point at Joes diner in nowhere, OH? Versus just how many password cracking and malware relay attempts across how many of your users, from an unpatched xp box the guy is using for a

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Jay Ashworth
- Original Message - From: William Herrin b...@herrin.us that's essentially a downgrade attack on my ability to use encryption which seems to be in pretty poor taste frankly. I'm not sure I follow your complaint here. Are you saying that Comcast or a Comcast customer in

Re: Transparent hijacking of SMTP submission...

2014-11-27 Thread Jay Ashworth
- Original Message - From: William Herrin b...@herrin.us I'm not sure I follow your complaint here. Are you saying that Comcast or a Comcast customer in Washington state stripped the STARTTLS verb from the IPv4 port 587 SMTP submission connection between you and a third party?