<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 14/04/17 17:29, Singletime wrote:<br>
</div>
<blockquote
cite="mid:s26bKOGDX7rJ8z18XuS4d1erH43wBa2pt3PLBBjsos4mpIge9Yiykm2hMECc4-DzOhGvT0Jz6jUbztkWN1oAa54zerC5jzZTHN6NxUzJfZ4=@protonmail.com"
type="cite">
<div>Hello list,<br>
</div>
<div><br>
</div>
<div>I am affected by a Kolab security problem:<br>
</div>
<div><br>
</div>
<div>I was a KolabNow user for some time. In July 2016 I deleted
my account. In October 2016, I tested whether it was possible to
create a new account with the same email address as before, and
surprisingly it worked!<br>
</div>
<div><br>
</div>
<div> This means that after at most three months someone else
could take over the email address of a deleted account. This
exposes ex-users to identity theft, e.g.:<br>
</div>
<div>a) by replying to mails of contacts that by mistake still use
the old address;<br>
</div>
<div>b) by catching password recovery emails, when people forget
to update their email address in all online accounts.<br>
</div>
<div><br>
</div>
<div>This problem is already known as the hidden entry <a
moz-do-not-send="true"
href="https://issues.kolab.org/show_bug.cgi?id=4125">https://issues.kolab.org/show_bug.cgi?id=4125</a>:
In <a moz-do-not-send="true"
href="https://issues.kolab.org/show_bug.cgi?id=4124#c5">https://issues.kolab.org/show_bug.cgi?id=4124#c5</a>,
bug 4125 is called "the requested functionality of preventing
signup for deleted accounts". According to the date of the
"neighboring" bugs, this is already known since at least
December 2014.<br>
</div>
<div><br>
</div>
<div>To fix this problem, I suggest that Kolab instances should
block addresses of deleted accounts "forever".<br>
</div>
<div><br>
</div>
<div> I have already contacted the KolabNow technical support
about this in November 2016, but they answered: "We cannot
reserve email addresses after they've been removed from our
systems."<br>
</div>
<div>I also told them that I will disclose this problem after a
sensible time interval, so that's what I am doing now, such that
Kolab users are warned, and Kolab developers are informed.<br>
</div>
<div><br>
</div>
<div>Best regards,<br>
</div>
<div>Singletime<br>
</div>
<div><br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:users@lists.kolab.org">users@lists.kolab.org</a>
<a class="moz-txt-link-freetext" href="https://lists.kolab.org/mailman/listinfo/users">https://lists.kolab.org/mailman/listinfo/users</a></pre>
</blockquote>
<p>Hi,</p>
<p><br>
</p>
<p>that is not such a problem as this require domain name
redirection to kolab instance after account has been removed and
there are two scenarios</p>
<p>1) domain mail has been moved to another provider in which case
simply creating account with the same email achieves nothing (you
can as well set it up on your home server)</p>
<p>2) domain is still redirected to the same instance in which case
domain administrator have authority over creating and deleting
email accounts.</p>
<p>So the only problem I can see is when you are using providers
domain which has number of repercussion security and otherwise.</p>
<p>Best regards</p>
<p>Paul<br>
</p>
</body>
</html>