KrisFeb 17

RE: https://social.tchncs.de/@Lapizistik/116087161953914165

I can pull mail addresses out of thin air.

My mailer knows about

local_part_suffix = +* : -*
local_part_suffix_optional

so you can mail to kris@..., but also to kris+keks@... or kris-keks@...

They will all go to the kris user account,and there will be X-local-part-suffix: keks set for any mail to kris-keks@....

Of course, I don't want all of that in my inbox.

:0
* ^X-local-part-suffix:.*kris-\/[^@]+
$MAILDIR/.special.`echo $MATCH | sed -e 's!([^)]*)!!g' -e 's![^a-zA-Z0-9_-]!_!g' | tr A-Z a-z`/

The what:

Anything that matches X-local-part-suffix: kris-something@... will be caught by that rule.

We take something from the rule, lowercase it, and replace all characters that are not letters or numbers or _ or - with a _. We then push that into the folder INBOX/special/something or whatever that replacement produces.

So mail to kris-keks@... goes to the folder INBOX/special/keks. If it doesn't exist we create it.

Show threadKrisFeb 17

I merge all that together again in a single unread smart mailbox.

But the folder is indicated at the top right.

So I have a github mail in a github folder – likely legit.

Now, a bank mail that is in a supermarket folder – that's fishy. Without even opening it I know I can delete it.

Show threadKrisFeb 17

Yeah, about that US immigration requirement.

"List all your mail addresses"

How many lines does that form have?

$ ls -ld Maildir/.special* | wc -l
2369

Because I have a spreadsheet for you.

Show threadKrisFeb 17

I can do fun things with mail.

# unerwünschte Werbung
:0
* ^X-local-part-suffix: kris-macheist
{
EXITCODE=67

:0 i
$BOUNCELOG/
}

What is that Six-Seven there?

/usr/include/sysexits.h:#define EX_NOUSER 67 /* addressee unknown */

It is a user-unknown bounce, and a local copy.

MathisFeb 17
Show threadKris

"The mail you are sending your request from, [email protected], is not the mail that is registered for your account, [email protected]"

"That is correct. The mail you are sending your answer from, [email protected], is also not the mail address you want me to send my shit to, [email protected], so what exactly is the problem?"

Feb 17 at 6:08pmWeb
Show threadKrisFeb 17

So it's [email protected]?

Sweet summer child.

$ cat transform.pl
#! /usr/bin/perl -w

my $srcdomain = qw ( koehntopp.de );

my @domains = qw( koehntopp.info .... );
...

and

$ cat virtusertable.in
...
[email protected] kris
[email protected] kris
kristian.koehntopp@... kris
...

and

$ cat virtusertable
[email protected] kris
[email protected] kris
...

[email protected] kris
[email protected] kris
...

So that spreadsheet for US immigration. How many rows can it have?

Show threadUli KönigFeb 17
@isotopp
Same here. May be they accept regular expressions?
Show threadJanek BevendorffFeb 17
@uli @isotopp I wonder whether they've ever used GMail.
Show threadCybso  (he/him)Feb 17
@isotopp i know what you wanna say but I think you missed the point. They don't want to know all your email addresses. They want to find the one address you missed to write on the form, so they have a reason to arrest you if they want to.
Show threadMarcelFeb 18

@isotopp Oh my... this looks very much like Maildrop... good times.

I basically have the same setup but with multiple SQL maps on Postfix (makes it a bit easier for multi-tenancy because I am not the only person hosting multiple domains on my mail infra) and Sieve filters (via Dovecot LMTP), fun stuff.

Show threadJTIFeb 17

@isotopp Oh, and my personal favorite is those JS'd "input validations" rejecting my plus-addressed email-adresses as "invalid format" only to f... around with proper email handling and spamming later.

Led me to extending the local_part_suffix too.

Show threadElse, SomeoneFeb 17
@jti42
Same
@isotopp
Show threadronFeb 17

@isotopp Yeah, every time. 🙄

By the way, Mail Mate will automatically change the from address when composing a reply based on the address the original message was sent to.

https://freron.com/

MailMate

Show threadRaphaelFeb 19

@isotopp Hi. I run a company that also, mostly automatically, refuses to answer support requests if the mail address does not match exactly.

I know it's annoying, how else would you prevent social engineering by impersonating an account holder effectively? I can't know that your mailserver is configured for - to be an extension separator. For some it's only the +, for some it's both, for some neither. Surely I'm not taking the risk for guessing? And "guess from context" doesn't scale well.

Show threadKrisFeb 19
@rami Sure, but the other way around you expect me to handle noreply@... properly, or otherwise deal with the fact that the sender of a message is not what i should reply to, or otherwise expect "all senders from @company.com are legit".
Show threadRaphaelFeb 19
@isotopp Na, we're able to set useful From and Reply-To headers, but sure, not everyone is