Re: Verifying E-Mail Addresses

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2006-10-24 Mister Dookie wrote:
> Is there a way to verify that an e-mail address
> (e.g."johnsmith () company com") is valid and exists or does not exist
> (is a fake e-mail address) without actually sending a message to that
> address and awaiting the response?

You can try VRFY:

cobalt@xenon:~ $ telnet mail.planetcobalt.net 25
Trying 217.10.9.49...
Connected to mail.planetcobalt.net.
Escape character is '^]'.
220 mail.planetcobalt.net ESMTP Postfix
VRFY bugtraq () planetcobalt net
252 2.0.0 bugtraq () planetcobalt net
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
cobalt@xenon:~ $ _

However, not all mailservers have the command enabled.

> Here's why this is a security issue. Our company administers a small
> "municipal-type" 802.11 network where for limited open-access the only
> form of ID we require is an e-mail address and a password. We simple
> don't have the resources to send out e-mails and then have
> verification and so forth. We are trying to prevent users from
> entering fake addresses into our system. We want at least a small
> amount of accountability.

Where does the password come into play here? If you assign the password
and the users have to register with their e-mail address, why don't you
simply send out a mail with the password to the registered address? If
the mail bounces the address was invalid, else the owner of the (valid)
address received the password. That should meet the requirements you
lined out above. Or did I miss something?

cu
59cobalt
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------