0

I have a website running a social network Buddypress.

Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without logging in Buddypress.

My idea was this one: each comment generates an email notification, and the notification has a Reply-To field filled with a long unique identifier (UUID). I would keep in a table the tuples (UUID, messageId, notifiedUser)

On the server side, when I receive an email in, say, Postfix, I would parse the recipient to see if there is a previously generated UUID, and check if the emitter is the person which the notification was sent to. If I find a match, I parse the email body in search of the reply, then I call some buddyPress PHP code to insert the text inside the database.

My question is: is it secure, and what attacks is this vulnerable to ?

Clearly, somebody sniffing (UUID, recipient) could immediately send garbage by impersonating the original recipient (i.e sending an email with a forged From: field, equal to the To: field of the email he just sniffed). But is it a real concern ? Which paths used by emails are encrypted ?

2 Answers 2

1

This is no more or less secure than sending a link in the e-mail that allows responding without having to login. It is not particularly secure, but it is a supported feature. There is already a post by E-mail feature provided in WordPress that you may want to look in to. I'm not 100% sure that it will work for posting comments, but if you do have to write your own stuff, you could base it off the existing mail to post functionality.

Just be aware that e-mail can easily be spoofed and is sent completely unencrypted, so anything you e-mail may be intercepted and anyone could send an e-mail appearing to be from any address unless you use some kind of e-mail signing and verification.

4
  • There is no way I can ask users to cryptographically sign emails. Is there any way to know if an email actually comes from its real emitter? Jun 18, 2014 at 13:38
  • 1
    Yes, but you just ruled it out as a possibility. Signing is the only option. For some senders it MIGHT be possible if they use TLS and use some anti-spam features that validate the server, but not all senders do this, so it isn't reliable, nor is it particularly trivial to validate. Jun 18, 2014 at 13:39
  • May you give a reference on what can/cannot be done with email spoofing/forging, if that is the correct term ? Jun 18, 2014 at 13:47
  • 1
    I can send an e-mail from any address to any address and it will go through unless both the recipient and sender are following one or more optional security features. The full spectrum of those technologies is a couple questions worth of info, but look in to things like DKIM and SPF. Jun 18, 2014 at 13:56
0

The obvious issue with your scheme seems to be possibility for HTML/JS injection on client side or SQL injection on server side. However, you didn't mention any details about this, so maybe you do some input validation.

From the system you described, I guess malicious users will mostly be authenticated users.

There is also a possibility of implementation bugs to keep in mind.

1
  • I'm not sure right now how I'm going to do this, but I intend to use the same function PHP that is already used to post comments. So I'm pretty sure the function is already validating/escaping/cleaning the string received. Jun 18, 2014 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .