Hacker News Reader

Comment by nikanj | Hacker News Reader

"In an email to CBC News, Eastlink spokesperson Jill Laing said "noreply@xxxxx.ca" business response email addresses have become commonplace across businesses and industries.

The company believes that email may lead some to "believe that information coming from this address is from Eastlink."

Sounds like this Eastlink person doesn't know most mail servers receive mail quite happily from anything@any.domain, as anyone who's ever received spam knows.

View on HN

>> The company believes that email may lead some to "believe that information coming from this address is from Eastlink."

The problem with their argument is that any email ending in @eastlink.ca will lead some to believe that information is from Eastlink.

If you're giving customers an eastlink.ca email adddress, how can anyone tell if an email from emailname@eastlink.ca is from an Eastlink employee or not?

It's not easy for the average consumer. Comcast offers free consumer Comcast.net email addresses, but their corporate emails are something like @corp.comcast.com.

It's less about the average consumer than the individual ISP's approach to giving out email addresses.

Given that Eastlink wanted to take back noreply@eastlink.ca (sans subdomain) and that they're a smaller, regional Canadian ISP, I would guess their process for handing out email addresses is less sophisticated than Comcast's.

Yes! And this makes it tremendously easy to phish comcast employees in case you need to do CPE lookups or such.

It is a security issue. If he were to lose his credentials then others could use his account to send genuine looking phishing e-mails. If you were defrauded and had checked the email address as genuinely being from that address you might be minded to sue them. He could be targeted explicitly for this purpose now. Furthermore, he admitted to having read mail not intended for him and took no action to address the issue indicating that he understood that his address coincided with a namespace commonly intended for provider usage. It is unfortunate that the usage of 'noreply' has become so commonplace as to render his account a security issue. Perhaps they should give him some more time but he cannot keep it.

I think that at least gmail usually flags these kind of spoofed addresses. But in this case, being sent by valid servers, gmail or others would just acknowledge it as the valid email address that it is. Thus leading to a possible misunderstanding for the receiver.

I'm not sure what you mean, but the problem would be that noreply@ZZZ is often used by the company that runs ZZZ; using "noreply" for a personal address presents the same problems as registering other commonly-reserved addresses like postmaster@ZZZ or admin@ZZZ. It doesn't have anything to do with the ability to actually receive mail on an account named "noreply".

The parent is quoting EastLink's justification from the article

Eastlink publishes an SPF record, so such emails would be classified as spam by any decent mail system. This guy, sending through Eastlink's hardware, would get tagged as legitimate (because it was).

Reply on news.ycombinator.com