🚀 go-pugleaf

In article <37d985c4.7783654@news.earthlink.net>, cultobill@earthlink.net
(Bill "Houdini" Weiss) wrote:

>>>I tried to run my address book through a link checker, which uses
>>>finger protocol to see if user exists.
>>>However it seems many ISPs have dropped finger daemons, so this is
>>>not very useful.
>>>Is this fingerd removal to stop spammers just fingering common names to
>>>build up their list of addresses or what?
>>>Secondly, is there another way of finding if e-mail address is still
>>>valid, apart from just sending a test message?
>
>I must remark on the spam scenario.  Many versions allow either
>"finger @host.net" or "fnger host.net" ( I can't honestly remember
>which), and that will list users on the system.  This is bad.  Whether
>for spam, or for the hacks, this is bad.
><snip>

So?

Easy as it may be to disable fingerd entirely, it is equally trivial to
install a version of fingerd which does not allow remote users do
finger-forwarding or to "finger @host"  or otherwise gather 'sensitive'
information.

There's no reason for fingerd to give away "sensitive" information to
remote users. There's also no reason to disable your vendor-supplied
fingerd just because you can't be bothered to install a secure
alternative.

(Check out the finger daemon on golem.ph.utexas.edu, if you want to see
what I mean.) 

As to the poster's original question, if the ISP has disabled fingerd, the
only thing you can do to verify an email address is to telnet to port 25
on his machine and use 
   VRFY joe@yourhost.net
or
   EXPN joe@yourhost.net
or go through the motions of sending a test message
   HELO myhost.net
   MAIL FROM: me@myhost.net
   RCPT TO: joe@yourhost.net
   QUIT

I am sure the ISP did not *intend* for you to have to diddle with his SMTP
daemon in order to verify an email address, but that is *exactly* what he
achieved by disabling fingerd.

Pity.

Jacques

-- 
PGP public key: http://golem.ph.utexas.edu/~distler/distler.asc