Users leave comments on other users \"walls\". What I would like to do is to all

Question

Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without logging in Buddypress.

My idea was this one: each comment generates an email notification, and the notification has a Reply-To field filled with a long unique identifier (UUID). I would keep in a table the tuples (UUID, messageId, notifiedUser)

On the server side, when I receive an email in, say, Postfix, I would parse the recipient to see if there is a previously generated UUID, and check if the emitter is the person which the notification was sent to. If I find a match, I parse the email body in search of the reply, then I call some buddyPress PHP code to insert the text inside the database.

My question is: is it secure, and what attacks is this vulnerable to ?

Clearly, somebody sniffing (UUID, recipient) could immediately send garbage by impersonating the original recipient (i.e sending an email with a forged From: field, equal to the To: field of the email he just sniffed). But is it a real concern ? Which paths used by emails are encrypted ?

Explanation / Answer

This is no more or less secure than sending a link in the e-mail that allows responding without having to login. It is not particularly secure, but it is a supported feature. There is already a post by E-mail feature provided in WordPress that you may want to look in to. I'm not 100% sure that it will work for posting comments, but if you do have to write your own stuff, you could base it off the existing mail to post functionality.

Just be aware that e-mail can easily be spoofed and is sent completely unencrypted, so anything you e-mail may be intercepted and anyone could send an e-mail appearing to be from any address unless you use some kind of e-mail signing and verification.

Related Questions

Navigate

• Browse (All)
• Browse U
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.