LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-18-2005, 11:39 PM   #1
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,288

Rep: Reputation: 52
email address validation


Is it a realistic proposition to check, when a user enters his or her email address in a form, if this email address is the same than the one that created the connection?

If it is then how can this be done?

Unless there are ethical reasons not to do this, I would anticipate that there is probably plenty of known software or scripts to do it and I'd like to be able to mark an email address as authentic, if possible at all.

Thank you for your help.
 
Old 09-19-2005, 12:06 AM   #2
spooon
Senior Member
 
Registered: Aug 2005
Posts: 1,755

Rep: Reputation: 51
Re: email address validation

Quote:
Originally posted by rblampain
if this email address is the same than the one that created the connection?
This doesn't make any sense. Email addresses don't create connections (am I missing something here?). Computers create connections. You can find the IP address where the form request came from, for example. But this doesn't have anything to do with the email address of the person using it.
 
Old 09-19-2005, 03:58 AM   #3
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,288

Original Poster
Rep: Reputation: 52
My question seems badly constructed.

"But this doesn't have anything to do with the email address of the person using it."

Using what?

Anyway, you seem to have understood what I meant:
"You can find the IP address where the form request came from, for example."
Yes, that is what I want.
 
Old 09-19-2005, 04:05 AM   #4
tkedwards
Senior Member
 
Registered: Aug 2004
Location: Munich, Germany
Distribution: Opensuse 11.2
Posts: 1,549

Rep: Reputation: 52
Quote:
Anyway, you seem to have understood what I meant:
"You can find the IP address where the form request came from, for example."
Yes, that is what I want.
Well that's a completely different thing to finding the email address of someone

Anyway it should be fairly easy - it'll be in the HTTP headers. Look at the documentation for whatever scripting language you're using to process the results of your form, there'll be a variable or something for getting the information that was passed in via the http headers.
 
Old 09-19-2005, 08:55 AM   #5
TruckStuff
Member
 
Registered: Apr 2002
Posts: 498

Rep: Reputation: 30
Quote:
Originally posted by rblampain
Anyway, you seem to have understood what I meant:
"You can find the IP address where the form request came from, for example."
Yes, that is what I want.
As already pointed out, the IP address of the client has nothing to do with an email address that they enter. I think what you are wanting to do is validate the IP that the request came from against the IP of the mail server for the domain of the email address provided? Unless someone is filling out the form from there mail server, the IP address of the email domain will *always* be different than where the client is. For example, if I fill out your form from home, but give you my gMail address, you will be trying to compare my dynamic IP from SBC against the IP of one of Google's servers. And this is only assuming that there is a single incoming and outgoing mail server for the domain in question, which is rarely the case when dealing with large email outfits like gMail, Yahoo or Hotmail.

If this isn't what you are trying to do, you need to state your question more clearly.

Last edited by TruckStuff; 09-19-2005 at 08:57 AM.
 
Old 09-19-2005, 11:08 PM   #6
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,288

Original Poster
Rep: Reputation: 52
Thank you all. My question may have lacked clarity but my reply to spooon really stuffed it up. What I thought was this:
If the real e-mail address of the sender can somehow be compared to the e-mail address in the form then it can be marked as authenticated.
Is this possible? I suspect the answer is no.
My sincere apologies for having confused the question.
 
Old 09-20-2005, 12:30 AM   #7
tkedwards
Senior Member
 
Registered: Aug 2004
Location: Munich, Germany
Distribution: Opensuse 11.2
Posts: 1,549

Rep: Reputation: 52
Quote:
If the real e-mail address of the sender can somehow be compared to the e-mail address in the form then it can be marked as authenticated.
Is this possible? I suspect the answer is no.
I'm still not sure what you're trying to do. How does the user submit this form to you:

Do they goto a webpage, type in their details and then some script on your webserver emails the data to you? If so then the answer is no, there is no way to find out the user's real email address that way.

or

Do they download a word doc or something that contains the form, fill it in, then send it to you in an email from their email account? If so yes you obviously already have the email address, but since your asking the question I'm guessing this is not how you are doing it?

Last edited by tkedwards; 09-20-2005 at 12:31 AM.
 
Old 09-20-2005, 03:03 AM   #8
J.W.
LQ Veteran
 
Registered: Mar 2003
Location: Boise, ID
Distribution: Mint
Posts: 6,642

Rep: Reputation: 87
The "sender's real Email address" is an ambiguous term. To illustrate, like most people here at LQ, I have multiple Email addresses, all of which are valid, and as long as I have an Internet connection (whether it's from my home DSL connection, my office, my girlfriend's apartment, a wireless connection at the coffeeshop, etc) I can go to a website and fill in a form with any one of those Email addresses - they're all valid, and they're all real. My point is that an attempt to make a guess as to whether or not the supplied Email is "real" or not would likely end up rejecting a lot of valid ones.

If you want to be sure that people give you a working Email address, then you could require something like what LQ uses in the registration process, where the user supplies an Email address, an Email is sent to that address, and then the user needs to click on a link within that Email to activate the account, etc. Craigslist, a popular community website, employs something similar when people post on its boards.

I don't know of any of the above commentary is helpful, but I'll toss it out there anyway -- J.W.
 
Old 09-21-2005, 02:20 AM   #9
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,288

Original Poster
Rep: Reputation: 52
Thank you both, your info is very useful. What I'm doing:
A user fills in a form in which the user's e-mail address is entered. A CGI routine reads the submitted data (post) and commit it to (disk) file. My intention was not the validation of the email address as such but lightening the load on other routines if there was a way to compare the e-mail address entered in the form with the (detected) e-mail address of the sender. If these match, then the process of sending a confirmation e-mail can be skipped.

It looks like it's not a good proposition, from your info, I get the impression the valid e-mail address is not to be found, unlike an IP address and is probably like a password, it exists only when it is provided by the user. If so then I've got to dump the idea.
Thank you again.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how do i change to my new email address? ChrisRob General 2 01-16-2005 03:07 PM
Creating A Second Email Address For Email Account On Sendmail treedstang Linux - Software 1 04-27-2004 10:31 PM
email to more address at once mairul Linux - Newbie 4 03-18-2004 12:19 AM
Forge email address vittibaby Linux - Security 1 11-19-2003 06:21 PM
sending an email to a email address after a perl operation meluser Programming 9 04-07-2003 01:26 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:02 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration