Security Basics mailing list archives

Re: Verifying E-Mail Addresses


From: "Jeffrey F. Bloss" <jbloss () tampabay rr com>
Date: Thu, 16 Nov 2006 22:06:02 -0500

Andrew Wheeler wrote:


Just a thought O'Reilly have a book "Building wireless community
Networks" and in it they discuss a captive portal system.
When someone connects to the wireless system they are directed to a
Log-in page. I would think you could modify the system to show a code
in a graphic image (like you see when applying for a hotmail account)
and require them to send an email with this code to you before
allowing access to the Internet. This could be automated so you would
not need to validate each user individually.
You would need to allow them to send one email before the system
blocks them. 

Why waste time with an email and allowing limited access which could be
abused, when it's just as secure and even easier to simply have them
submit the code to a form processor/CGI/etc?

Then again, this doesn't really address the problem at hand anyway,
which is keeping real humans with bad intentions from accessing your
public access point. An evil doer can read and type in a few characters
just the same as a good guy, and the evil doer is the one whose more
likely to have a "bogus" email account he could use to gain access with
none of even the limited accountability a real email would afford.

-- 
Hand crafted on 16 November, 2006 at 21:59:30 EST using
only the finest domestic and imported ASCII.

I'd like to meet the guy who invented beer, and see what 
he's working on now.

Attachment: signature.asc
Description:


Current thread: