Can you crack a Mailinator “Alternate Inbox Name?”

Question

From their FAQ:

What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate name is the same as emailing the regular name of the inbox. For example, the alternate name for "joe" is "M8R-yrtvm01" (all alternate names start with "M8R-").

So basically if you cracked the Alternate Inbox Names, you will have access to the URL of the original word used, in this case M8R-yrtvm01 will lead to joe.mailinator.com

Do you think it's possible or easy to crack? I think for that you should brute force attack their site, which will be sooner down due to heavy loads.

Answer 1

Yes it's possible. You have to send an HTML email to the public alternate address containing an embedded image that is hotlinked from your webserver. When the owner of the email address opens it (at the original address), your image will automatically loaded. Your web server log will contain a GET request for this image with the referrer field showing the original Mailinator address.

Answer 2

Perhaps... and perhaps not. The author of Mailinator is a pretty smart guy, and I imagine he did this right. But he's not publishing his source code, so you never know for certain.

For example, if here were to pad the original mailbox name to the appropriate size, encrypt using an undisclosed key, and then text-encode the result, he could come up with a reversible encoding that would be very difficult to break.

Easier still, it could simply refer to some internal key; a filesystem path or a database index or some other simple lookup reference that only has meaning if you're running that software. This would be completely irreversible without getting access to the server installation.

That's not to say this is what he's doing, but sufficient security is possible in this scenario.