Controversies

Email address spoofing vulnerability

Posterous's email-based posting system initially treated the return address as an important signal for deciding where a message should be published. Because return addresses can be forged, outside testers demonstrated unauthorized posts on another user's blog. Posterous fixed the reported weakness and said it used additional sender and header checks, although it did not disclose all implementation details.