Hello bats, on Fri, 26. Mar 2004 at 15:52:18 +0000 Marck D Pearlstone wrote:
JH>> I find this pretty weak evidence of 'zero presence' from mail JH>> archive. JH>> <form METHOD="POST" ACTION="/cgi-bin/Nomailto.pl"> JH>> <input TYPE="HIDDEN" NAME="user" VALUE="marck"> JH>> <input TYPE="HIDDEN" NAME="host" VALUE="silverstones.com"> JH>> <input TYPE="HIDDEN" NAME="subject" VALUE="Archive expiry test"> JH>> <input TYPE="HIDDEN" NAME="msgid" VALUE="[EMAIL PROTECTED]"> JH>> Reply via email to<br> JH>> <input TYPE="SUBMIT" VALUE=" Marck D Pearlstone "> > 1) That is an indirect exposure > 2) It only appears in a one-off response form > 3) It only ever provides access to a single email address at a time > 4) that puts it beyond the reach of any kind of spam harvest. > Zero exposure. From spam harvesters - that's the context. But it could be better by either just posting an ID that would then be looked up for the real address or encrypting the VALUEs and decrypting them after receiving. I do not think that it's really necessary, but we should not wait until someone writes a script to get this bunch of emails, too. Symmetric encryption of the POST values looks like a simple and powerful method. Plus it could include another hidden value that is random and has influence on the (en|de)cryption. > Also, as a list administrator I have a duty to reassure other > readers that there is no need to panic. Because there is no need. You're right. For now. Better safe than sorry.. Regarding other mail archives is probably one of the bests, according to email protection, but it would only be a simple step to make it a lot more secure. -- shinE! http://www.thequod.de ICQ#152282665 GnuPG/PGP key: http://thequod.de/danielhahler.asc Using The Bat! v2.05 Beta/12 on Windows XP 5.1 Build 2600 Service Pack 1 with POPFile 0.21.1 and avast Mar2004 (4.1.357). ________________________________________________________ Current beta is 2.05 beta 12 | 'Using TBBETA' information: http://www.silverstones.com/thebat/TBUDLInfo.html IMPORTANT: To register as a Beta tester, use this link first - http://www.ritlabs.com/en/partners/testers/
