Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Re: Injection-Info, posting-account and posting-host
9 views
Skip to first unread message
Sn!pe
Nov 20, 2023, 6:45:33 AM11/20/23
to
Ottavio Caruso <ottavio2006...@yahoo.com> wrote:
> See the following header:
>
> Injection-Info: dont-email.me;
> posting-host="d423e3e72b55e1b13fe9668888872f01";
> logging-data="4142535";
> mail-complaints-to="ab...@eternal-september.org";
> posting-account="U2FsdGVkX18g39rL6dgrITuYA5Y1RxrjkY5q/fvHhWQ="
>
> This seems to be specific to ES.
>
>
> I have a filter in Betterbird:
>
> Header: "Injection-Info", contains: "posting-account=xxxxx"
>
> or:
>
> Header: "Injection-Info", contains: "posting-host=xxxxx"
>
> This filter catches something at first, but then it seems
> "posting-account" and "posting-host" get regenerated for the same user.
>
> Any hints on this?
>
I think (I'm no expert) that they're encrypted and AIUI the salt is
changed daily:
<https://crypto.stackexchange.com/questions/1776/what-is-a-cryptographic-salt#2010>
--
^Ï^. Sn!pe, PA, FIBS - Professional Crastinator.
My pet rock Gordon just is.
Google Groups articles not seen unless poster is whitelisted.
> See the following header:
>
> Injection-Info: dont-email.me;
> posting-host="d423e3e72b55e1b13fe9668888872f01";
> logging-data="4142535";
> mail-complaints-to="ab...@eternal-september.org";
> posting-account="U2FsdGVkX18g39rL6dgrITuYA5Y1RxrjkY5q/fvHhWQ="
>
> This seems to be specific to ES.
>
>
> I have a filter in Betterbird:
>
> Header: "Injection-Info", contains: "posting-account=xxxxx"
>
> or:
>
> Header: "Injection-Info", contains: "posting-host=xxxxx"
>
> This filter catches something at first, but then it seems
> "posting-account" and "posting-host" get regenerated for the same user.
>
> Any hints on this?
>
I think (I'm no expert) that they're encrypted and AIUI the salt is
changed daily:
<https://crypto.stackexchange.com/questions/1776/what-is-a-cryptographic-salt#2010>
--
^Ï^. Sn!pe, PA, FIBS - Professional Crastinator.
My pet rock Gordon just is.
Google Groups articles not seen unless poster is whitelisted.
Ray Banana
Nov 20, 2023, 7:02:04 AM11/20/23
to
* Ottavio Caruso wrote:
> Header: "Injection-Info", contains: "posting-account=xxxxx"
> or:
> Header: "Injection-Info", contains: "posting-host=xxxxx"
> This filter catches something at first, but then it seems
> "posting-account" and "posting-host" get regenerated for the same user.
>
> Any hints on this?
I can confirm your observation. More precise: the value changes
> Header: "Injection-Info", contains: "posting-account=xxxxx"
> or:
> Header: "Injection-Info", contains: "posting-host=xxxxx"
> This filter catches something at first, but then it seems
> "posting-account" and "posting-host" get regenerated for the same user.
>
> Any hints on this?
every 24 hours.
--
Пу́тін — хуйло́
http://www.eternal-september.org
Kaz Kylheku
Nov 20, 2023, 11:40:10 AM11/20/23
to
On 2023-11-20, Ray Banana <ray...@raybanana.net> wrote:
> * Ottavio Caruso wrote:
>> Header: "Injection-Info", contains: "posting-account=xxxxx"
>> or:
>> Header: "Injection-Info", contains: "posting-host=xxxxx"
>> This filter catches something at first, but then it seems
>> "posting-account" and "posting-host" get regenerated for the same user.
>>
>> Any hints on this?
>
> I can confirm your observation. More precise: the value changes
> every 24 hours.
Here is an example of two posting-account strings from the same user:
> * Ottavio Caruso wrote:
>> Header: "Injection-Info", contains: "posting-account=xxxxx"
>> or:
>> Header: "Injection-Info", contains: "posting-host=xxxxx"
>> This filter catches something at first, but then it seems
>> "posting-account" and "posting-host" get regenerated for the same user.
>>
>> Any hints on this?
>
> I can confirm your observation. More precise: the value changes
> every 24 hours.
1> (base64-decode-buf "U2FsdGVkX18br9eLCPVEW89ER/a9k/At")
#b'53616c7465645f5f 1bafd78b08f5445b cf4447f6bd93f02d'
2> (base64-decode-buf "U2FsdGVkX1+q9hzbg5+TKo3PAkDL7Qb8")
#b'53616c7465645f5f aaf61cdb839f932a 8dcf0240cbed06fc'
^^^^^^^^^^^^^^^^
"Salted__"
The first eight bytes are "Salted__", the rest churns.
--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazi...@mstdn.ca
NOTE: If you use Google Groups, I don't see you, unless you're whitelisted.
0 new messages