Problem - Kevin Tafuro

Discussion
The most common use for confirmation requests is to ensure that an email address
actually belongs to the person requesting membership on some kind of mass mailing
list (whether it’s a mailing list, newsletter, or some other type of mass mailing). Joining
a mass mailing list typically involves either sending mail to an automated recipient
or filling out a form on a web page.
The problem with this approach is that it is trivial for someone to register someone
else’s email address with a mailing list. For example, suppose that Alice wants to
annoy Bob. If mailing lists accepted email addresses without any kind of confirmation,
Alice could register Bob’s email address with as many mailing lists as she could
find. Suddenly, Bob would begin receiving large amounts of email from mailing lists
with which he did not register. In extreme cases, this could lead to denial of service
because Bob’s mailbox could fill up with unwanted email, or if Bob has a slow network
connection, it could take an unreasonable amount of time for him to download
his email.
The solution to this problem is to confirm with Bob that he really made the requests
for membership with the mailing lists. When a request for membership is sent for a
mailing list, the mailing list software can send an email to the address for which
membership was requested. This email will ask the recipient to respond with a confirmation
that membership is truly desired.
The simplest form of such a confirmation request is to require the recipient to reply
with an email containing some nonunique content, such as the word “subscribe” or
something similar. This method is easiest for the mailing list software to deal with
because it does not have to keep any information about what requests have been
made or confirmed. It simply needs to respond to confirmation responses by adding
the sender’s email address to the mailing list roster.
Unfortunately, this is not an acceptable solution either, because Alice might know
what response needs to be sent back to the confirmation request in order for the
mailing list software to add Bob to its roster. If Alice knows what needs to be sent,
she can easily forge a response email, making it appear to the mailing list software as
if it came from Bob’s email address.
Sending a confirmation request that requires an affirmative acknowledgement is a
step in the right direction, but as we have just described it, it is not enough. Instead
of requiring a nonunique acknowledgment, the confirmation request should contain
a unique identifier that is generated at the time that the request for membership is
made. To confirm the request, the recipient must send back a response that also contains
the same unique identifier.
Because a unique identifier is used, it is not possible for Alice to know what she
would need to send back to the mailing list software to get Bob’s email address on
the roster, unless she somehow had access to Bob’s email. That would allow her to
448 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.