🚀 go-pugleaf

"Asger Jorgensen" <Junk@Asger-P.dk> wrote in message 
news:MPG.21531d5bf5132a7e9897f1@newsgroups.borland.com...
> Hi there
>
> Is there anyway that I can make sure that an email comes from
> the address in the from field ?
>
Not really. At least not without help from the supposed sender's e-mail 
server.

> And is it be possible for somebody else to send an email
> where the from field is filled with my email ?
>
Yes, these fields are easily faked.

-- 
Bruce 

"Asger Jorgensen" <Junk@Asger-P.dk> wrote in message
news:MPG.21531d5bf5132a7e9897f1@newsgroups.borland.com...

> Is there anyway that I can make sure that an email
> comes from the address in the from field ?

About the only thing you can do is track through the "Received" headers of
the message to see which server(s) the message has passed through.  That
will at least give you an idea of which ISP it was sent from.  Some servers
wil also include the IP address of the original client that sent the
message.  But there is no single direct way to validate the email address of
the sender, without access to the server-side logs.

> And is it be possible for somebody else to send an email
> where the from field is filled with my email ?

Yes.  Spammers fake that all the time.


Gambit

Thanks Bruce and Remy

Not the answer I hoped for, but better to know the truth though.;-)

The situation is:
I write the sending mail-client and I also write the recieving
mail-client and I always know the name of the outgoing mailserver.

Can You then give me some advice as to how I can make it so that 
no one can fake a message without me knowing it ?

Thanks in advance
Asger 

"Asger J�rgensen" <junk@Asger-P.dk> wrote in message
news:MPG.2155477b312ea08f9897f6@newsgroups.borland.com...

> Can You then give me some advice as to how I can make
> it so that no one can fake a message without me knowing it ?

There is no way to prevent faking, and about the only way to detect that it
has happened is if you receive a bounced message for an email you did not
send.  Otherwise, there is no other way to detect it, as it can happen
completely outside of your system.


Gambit

Asger J�rgensen wrote:

>Can You then give me some advice as to how I can make it so that 
>no one can fake a message without me knowing it ?

PGP the message in a signature block.

Thanks Bob

In article <rbcme31o00a553r39ug6pb65rcbtd11ogl@4ax.com>, 
notbg@notmindspring.invalid says...
> Asger Jørgensen wrote:
> 
> >Can You then give me some advice as to how I can make it so that 
> >no one can fake a message without me knowing it ?
> 
> PGP the message in a signature block.

What is PGP ?

Thanks in advance
Asger

Thanks Remy

In article <46eb31f1$1@newsgroups.borland.com>, no.spam@no.spam.com 
says...
> There is no way to prevent faking, and about the only way to detect that it
> has happened is if you receive a bounced message for an email you did not
> send.  Otherwise, there is no other way to detect it, as it can happen
> completely outside of your system.

I have many points on the net for both sending and recieving
so I will not be able to catch a bouncing mail.
I was thinking more in the line of adding some kind of date
to the header or the body that could not be faked, witch 
I then could check when recieving.
But I am a real newbee when it comes to securety, so any
advice will be greatly apreciated.

Thanks in advance
Asger

"Asger J�rgensen" <junk@Asger-P.dk> wrote in message
news:MPG.2155798594fb7d3f9897fa@newsgroups.borland.com...

> I have many points on the net for both sending and
> recieving so I will not be able to catch a bouncing mail.
> I was thinking more in the line of adding some kind of
> date to the header or the body that could not be faked,
> witch I then could check when recieving.

Anything in an email message can be faked.  There is a hole in the SMTP
protocol that allows clients to send whatever email data they want and it
gets delivered as-is.

The only way you are going to be able to generate something that you can
verify that can't be easily forged is if you use encryption.


Gambit

"Asger J�rgensen" <junk@Asger-P.dk> wrote in message
news:MPG.21557824ae777c5d9897f9@newsgroups.borland.com...

What is PGP ?

PGP = "Pretty Good Privacy"

http://en.wikipedia.org/wiki/Pretty_Good_Privacy


Gambit

Thanks Remy

In article <46eb5f74$1@newsgroups.borland.com>, no.spam@no.spam.com 
says...
> Anything in an email message can be faked.  There is a hole in the SMTP
> protocol that allows clients to send whatever email data they want and it
> gets delivered as-is.
> 
> The only way you are going to be able to generate something that you can
> verify that can't be easily forged is if you use encryption.

What if I atatch a file that include a key, that changes 
every day and then on arivel I check if the key is the right 
one for the day.
And istead of relying on the email date I write the date 
in the subject.
The mail client could then download the new keys from a 
server that required logon

Could that work ?

I am a little afraid of that encryption stuff it looks
very difficult.

Thanks in advance
Kind regards
Asger

"Asger J�rgensen" <junk@Asger-P.dk> wrote in message
news:MPG.215597a7800f1e0f9897fc@newsgroups.borland.com...

> What if I atatch a file that include a key, that changes
> every day and then on arivel I check if the key is the
> right one for the day.

That would only work if you can guarantee that the algorithm used to
generate the key is never discovered.

You don't need an attachment, though.  Putting the key in the headers is
enough, and is less intrusive.

The problem with relying on the date, though, is that it does not handle
situations where delivery is delayed a day or more, unless the original date
is stored in the message as well.

> And istead of relying on the email date I write the date
> in the subject.

Use headers for anything that is private to the message that should not be
displayed to the user.

> The mail client could then download the new keys
> from a server that required logon

And if the client can't download a key?

> I am a little afraid of that encryption stuff it looks
> very difficult.

Not really.  There are plenty of libraries that hide the complexities for
you.  You really should be using real security instead of trying to invent
your own.  It will never be as secure.


Gambit

Thanks Remy

In article <46eb8c28$1@newsgroups.borland.com>, no.spam@no.spam.com 
says...
 
> Use headers for anything that is private to the message that should not be
> displayed to the user.

Would that be in the Headers or the ExtraHeaders of the
TIdMessage ?

> And if the client can't download a key?

You always think of every thing.;-)

> Not really.  There are plenty of libraries that hide the complexities for
> you.  You really should be using real security instead of trying to invent
> your own.  It will never be as secure.

Could You point me to a simple one that works well 
with BCB5. ?

Thanks again
Kind regards
Asger

"Asger J�rgensen" <junk@Asger-P.dk> wrote in message
news:MPG.2155b79b986d3bbe9897fe@newsgroups.borland.com...

> Would that be in the Headers or the ExtraHeaders
> of the TIdMessage ?

If you create a new message from scratch, use the ExtraHeaders property.
When a message a received, only the Headers property is filled in


Gambit