Similar question with an amazing answer: How can PayPal spoof emails so easily to say it comes from someone else?
I hope that the title to this question is actually a lie... but, to my knowleage, I can actually very easily send an email using someone else's emal address without their premission.
Let me explain:
I was looking for a quick, easy and reliable way of sending math equations over email and came accross this site: Send an email containing math symbols and equations! (Beta)
It looked good enough so I decided to send an email to myself to test it.
To my surprise, the website only asked for the "Recipient's emai" and for "my email". And that was it! It sent the email and I did not have to authenticate anything.
So, this website can send emails with my email address without me ever authorizing it.
Sure... at the bottom of the email it says "This mail comes to you from the math mail system of Interactive Mathematics", but I'm assuming this is optional!
The website providing this service didn't do anything wrong and at the end of each email they have the quote:
This mail comes to you from the math mail system of Interactive Mathematics
Sender's IP address: xxx.xxx.xxx.xxx
but I'm assuming they don't have to do this. And that anyone can send an email using someone else's email address.
The point of this question is:
- to understand how is this possible
- how is this not a security issue?
- how can I tell if an email is infact being sent by someone and not some other entity?