Hacker News Reader

Comment by regecks | Hacker News Reader

You can do the same thing with Fastmail. Completely indistinguishable from a legitimate email - all signatures look exactly the same. Any user can impersonate any other user. Not considered a vulnerability.

What's especially frustrating is that Fastmail have a special opaque sender header that only they can interpret, and they put a little "verified" icon on email that actually comes from them. So it's a vulnerability if I impersonate them, but not any other Fastmail user. Sigh. I'm a happy FM user, apart from that. But I'm going to keep bringing it up until they do something about it. At least let me blacklist my domain from being used by other accounts jfc.

View on HN

This is not true for custom domains for some time. The DKIM signature is only added for users in the account that has the domain, and similarly mail is sent via different outbound servers that are not included in our recommended SPF record if another a user outside of this account tries to send mail from that domain. For Fastmail domains the situation is more complicated for historical reasons (we've been around over 20 years and customers have set up workflows that we need to transition) but we are working on it.

Thank you!

How recently was this change made? I could still do it in 2018, but I wasn't able to do it just now. As you say, no signature on the message, which makes my DMARC record do something useful. That's really great, a huge relief.

(Wish I could modify my original post now).

Have you got a thread/ticket number or something so that I, and other Fastmail users, can put our names behind "Please fix this"?

Email is an absolute disaster for security and privacy. Its a shame we will never see a real alternative because the age of open and decentralized standards is over. Matrix shows hope but I doubt it will come anywhere close to the popularity of email and SMS

Meh, we've continuously built stuff on top of older protocols and have made them very usable.

It seems shortsighted to say email as a whole is a disaster for security and privacy.

So was the web until ~ a decade ago. (Well, parts of it still are a disaster but it’s getting better every year provided you’re not running chrome.)

Reply on news.ycombinator.com