mailing list archives
Does VeriSign's SiteFinder service violate the ECPA?
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Sat, 20 Sep 2003 12:55:30 -0400
Here's a question for the lawyers. In certain situations, does the
VeriSign SiteFinder service violate the Electronic Communications
Privacy Act (AKA, ECPA)?
Here's the actual text of the ECPA:
With my packet sniffer, I noticed that the VeriSign SiteFinder Web
server happily accepts POST form data which is intended for another Web
server. This situation will occur if the domain name is misspelled in
the action URL of a form.
Without SiteFinder in the picture, the HTTP POST operation is never done
since the DNS lookup fails.
Here's an example POST HTTP request which was misdirected by VeriSign:
POST /cgi-bin/mail.pl HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/msword, application/x-shockwave-flash, */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR
toaddr=rms () computerbytesman com&fromaddr=dbrown () lawyers com&message=Rich
And here's the misleading response from the SiteFinder server:
HTTP/1.1 302 Found
Date: Sat, 20 Sep 2003 16:29:41 GMT
Content-Type: text/html; charset=iso-8859-1
Richard M. Smith
- Does VeriSign's SiteFinder service violate the ECPA? Richard M. Smith (Sep 22)