Any way users can unsubscribe without a password?
I've just finished implementing a more general confirmation scheme for Mailman 2.1. There are two aspects to this. When an operation requiring confirmation is performed, a confirmation email message is sent as before. However, the confirmation message will include both a confirming email command and a URL with a unique cookie, and the operation can be performed either by replying to the message or visiting the specified URL.
Currently only two confirmable operations are defined: subscribing and removing. The above works regardless of e.g. whether the removal request is coming from cgi or from an email command. This means a user can send the message "unsubscribe" to mylist-request with no address and no password, and they will receive a confirmation message. A reply to that message, or a hit on the URL will remove the user.
(Note that if the user actually knows their password, they can include it in the web page or email command for immediate removal.)
(Note also that the architecture is general enough that other confirmable operations could be added in the future.)
While this isn't exactly password-less accounts, I think it accomplishes basically the same intent. And it strikes a good balance between convenience and security. It means in practice that a user can get removed from a list without having to remember their password (or how to get it!), and the two-step removal in that case isn't too onerous (since most MUAs I suspect would let them click directly on the URL in the mail message).
Acks go to Les Niles who implemented a rough cut at this. My implementation was different, but similar in spirit.
-Barry
On Mon, Apr 02, 2001 at 01:38:11AM -0400, Barry A. Warsaw wrote:
While this isn't exactly password-less accounts, I think it accomplishes basically the same intent. And it strikes a good balance between convenience and security. It means in practice that a user can get removed from a list without having to remember their password (or how to get it!), and the two-step removal in that case isn't too onerous (since most MUAs I suspect would let them click directly on the URL in the mail message).
Two edged sword.
I'm trying to remember whose message it is, Slashdot's, I think, that says "don't get your panties in a twist because we included your password in clear".
This completely fails to take into account the "I use the same password many places" people.
Getting the passwords out of the mail is a good thing... but mail is *still* sniffable. Depends how much security you want people to have...
Cheers, -- jra
Jay R. Ashworth jra@baylink.com Member of the Technical Staff Baylink The Suncoast Freenet The Things I Think Tampa Bay, Florida http://baylink.pitas.com +1 727 804 5015
"JRA" == Jay R Ashworth <jra@baylink.com> writes:
JRA> Two edged sword.
JRA> I'm trying to remember whose message it is, Slashdot's, I
JRA> think, that says "don't get your panties in a twist because
JRA> we included your password in clear".
JRA> This completely fails to take into account the "I use the
JRA> same password many places" people.
JRA> Getting the passwords out of the mail is a good thing... but
JRA> mail is *still* sniffable. Depends how much security you
JRA> want people to have...The last step (to be added /eventually/) is to allow users to suppress password containing emails unless they specifically hit "Email My Password To Me". This means 1) allowing them to inhibit monthly reminders on a per-user basis; 2) allowing them to suppress the password in the welcome message; 3) adding confirmation emails for things like changing their options.
Shouldn't be hard to do, just takes time.
Still, we /tell/ users not to use important passwords for their Mailman accounts, but I understand the Pinball Machine Rule[1] applies here.
-Barry
[1] The PMR is the observation that it doesn't matter a wit if the instructions are printed clearly for all to see, nobody will read them. They'll just drop their quarter(s) and start pushing buttons like a Tommy.
On Fri, 30 Mar 2001, Bob Puff@NLE wrote:
I'm trying out Bob's unsub script on my Redhat system and haven't been able to get it working. Any idea why it would be returning this error?
----- Transcript of session follows ----- sh: unsub not available for sendmail programs 554 "|/home/mailman/bin/unsub testlist intemperance.net"... Service unavailable
As far as I can tell I've set everything up correctly. As you can see I've put the unsub file in /home/mailman/bin, but the testlist-remove alias does reflect that path correctly (and I've tried /home/mailman as well). I've made sure that the permissions on unsub are correct and that my site password is in the unsub script. Suggestions? Thanks for any ideas.
Jason Puckett / MisterRain@intemperance.net / www.intemperance.net Marge: "Were you or Lenny ever named Sexiest Man Alive?" Homer: "Well, I don't know about *Lenny*...."
ln -s /home/mailman/bin/unsub /etc/mail/smrsh/unsub
I think that will work.
--Neil
On 03 Apr 2001 11:32:09 -0400, Jason wrote:
On Fri, 30 Mar 2001, Bob Puff@NLE wrote:
I'm trying out Bob's unsub script on my Redhat system and haven't been able to get it working. Any idea why it would be returning this error?
----- Transcript of session follows ----- sh: unsub not available for sendmail programs 554 "|/home/mailman/bin/unsub testlist intemperance.net"... Service unavailable
As far as I can tell I've set everything up correctly. As you can see I've put the unsub file in /home/mailman/bin, but the testlist-remove alias does reflect that path correctly (and I've tried /home/mailman as well). I've made sure that the permissions on unsub are correct and that my site password is in the unsub script. Suggestions? Thanks for any ideas.
Jason Puckett / MisterRain@intemperance.net / www.intemperance.net Marge: "Were you or Lenny ever named Sexiest Man Alive?" Homer: "Well, I don't know about *Lenny*...."
Mailman-Users maillist - Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users
On 3 Apr 2001, Neil Cooler wrote:
ln -s /home/mailman/bin/unsub /etc/mail/smrsh/unsub
Ding! This was the piece I was missing. Clearly I'm not a sendmail expert. :) Thanks, everyone.
Jason Puckett / MisterRain@intemperance.net / www.intemperance.net Marge: "Were you or Lenny ever named Sexiest Man Alive?" Homer: "Well, I don't know about *Lenny*...."
I read the ~400 page O'reilly book on sendmail, have been adminstering sendmail boxen for over a year now, and i still dont feel like an expert.
Don't feel so bad :).
--Neil
On 03 Apr 2001 13:55:54 -0400, Jason wrote:
On 3 Apr 2001, Neil Cooler wrote:
ln -s /home/mailman/bin/unsub /etc/mail/smrsh/unsub
Ding! This was the piece I was missing. Clearly I'm not a sendmail expert. :) Thanks, everyone.
Jason Puckett / MisterRain@intemperance.net / www.intemperance.net Marge: "Were you or Lenny ever named Sexiest Man Alive?" Homer: "Well, I don't know about *Lenny*...."
Mailman-Users maillist - Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users
On Tuesday, April 3, 2001, at 11:01 AM, Neil Cooler wrote:
I read the ~400 page O'reilly book on sendmail, have been adminstering sendmail boxen for over a year now, and i still dont feel like an expert.
I used to support sendmail when I worked in Sun Tech Support 15 years ago, and I work with sendmail in my job now, and *I* am still learning about the bloody program. Don't feel bad.
(grin)
-- Chuq Von Rospach, Internet Gnome <http://www.chuqui.com> [<chuqui@plaidworks.com> = <me@chuqui.com> = <chuq@apple.com>] Yes, yes, I've finally finished my home page. Lucky you.
Some days you're the dog, some days you're the hydrant.
participants (6)
-
barry＠digicool.com -
Bob Puff＠NLE -
chuq von rospach -
Jason -
Jay R. Ashworth -
Neil Cooler