RE: CBV

> From: wayne
> Sent: Thursday, April 29, 2004 5:26 PM
>
>
> In <[email protected]>
> "Seth Goodman" <[email protected]> writes:
>
> >
> > The real question here is how easy is it to harvest a signed envelope
> > address, regardless of the signing protocol?

<...>

>
>
> When SRS is used by forwarders, they have quite a bit of control over
> who they send email to.  If you uses SES and send email to anyone who
> requests sales info, or whatever, signed envelope address harvesting
> is much more of a serious concern.

OK, that is reasonable.  Let's agree that loosely managed accounts, such as
general sales accounts, are a not-too-difficult way to get a signed return
path sent to you, and you then just need access to the mailer logs to
harvest the full signed return path.

I think I've addressed this exploit in my post

[email protected]

sent at 08:42:27 -500 April 30, 2004.

I would be interested in your critique to see if I've plugged the hole.

--

Seth Goodman