Re: Verifying E-Mail Addresses

[Roman Shirokov <insecure () yandex ru>]

Hello,

Wednesday, October 25, 2006, 1:02:32 AM, you wrote:

> Hello list,

> Is there a way to verify that an e-mail address
> (e.g."johnsmith () company com") is valid and exists or does not exist
> (is a fake e-mail address) without actually sending a message to that
> address and awaiting the response?

> Here's why this is a security issue. Our company administers a small
> "municipal-type" 802.11 network where for limited open-access the only
> form of ID we require is an e-mail address and a password. We simple
> don't have the resources to send out e-mails and then have
> verification and so forth. We are trying to prevent users from
> entering fake addresses into our system. We want at least a small
> amount of accountability.

> We would like to be able to do a quick check, say query an IMAP, POP3,
> or SMTP and check to see if there is actually an account at that
> address without sending a verification e-mail and waiting for users to
> click on a link or get something that bounces back. Does something
> like that exist?

> I do recognize that somebody can enter a valid e-mail address that
> does not belong to them, but we are trying to address one issue at a
> time. At this point we are just trying to prevent people who give us
> "dude () dude com" from getting on to our network.

> Thanks,
> John

If the mail  server supports it you can use such smtp commands as VRFY and
EXPN (i.e. VRFY username) and look for the answer (+200 Success).


-- 

 Roman Shirokov
 e-mail: insecure () yandex ru
 http://securitybox.org.ru
  Òàê, ñ òðàâîé íàäî çàâÿçûâàòü. Ôèãíÿ êàêàÿ-òî â ãîëîâó ëåçåò! (Î. Õàéÿì)


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------