I reported an insecure DKIM key to Deutsche Telekom / T-Systems.

[diziet@mastodon.me.uk]

@badrihippo @badkeys Yes.

Everyone should be doing the same (rotating DKIM keys and publishing the old private keys). Here's my blog post on the subject:

https://diziet.dreamwidth.org/16025.html

[x0r@mamot.fr]

@badkeys Modern DKIM implementations should not accept signatures made with RSA keys smaller than 1024 bits, nowadays, so it seems unlikely to me that you could do anything nefarious with a key this weak. The verifier would be equally faulty if it accepts weak keys.

See also: https://www.rfc-editor.org/rfc/rfc8301#section-3.2

[woffs@fe.disroot.org]

@badkeys hot take: dkim does not matter anyway

[wpalant@infosec.exchange]

@badkeys Way to go Telekom! Last time I found a 320 bit RSA key it was “protecting” people’s private information (https://palant.info/2023/01/25/ipinside-koreas-mandatory-spyware/#how-is-this-data-protected) and I even had a little difficulty finding a cryptography library that wouldn’t refuse working with a key so short.

[trpalesz@mastodon.social]

@16af93 @q @badkeys iirc BSA recommends at least 3000bits

[varx@infosec.exchange]

@yama @badkeys Out of curiosity, what year are you posting from?

[yama@tech.lgbt]

@varx @badkeys Im not arguing with internet strangers. Go dive off a bridge mate

[j_r@social.jugendhacker.de]

@momo @bekopharm das dreisteste ist es hängt scheinbar stark davon ab welchen Support Mitarbeiter man erreicht. Hab Jahre lang damit gelebt einfach keine E-Mails an t-online senden zu können. Wurde irgendwann dann aber doch zu nervig und ich habe sie nochmal kontaktiert. Dann haben sie ohne große Nachfrage einfach meine IP freigeschaltet

[momo@social.linux.pizza]

@j_r
War bei mir ähnlich. Wer seinen Mailkram dann bei der Telekom hatte, hatte halt Pech. Zwischendrin hatte ich deren ASN im Spamfilter geblockt, weil ja, dann halt auch in beide Richtungen. Dann schlug aber der WAF Alarm und da blieb mir keine Wahl mehr... ich hab aber dann wohl beim Support-Lotto das falsche Ticket, gezogen.

(WAF= Wife Acceptance Factor)
@bekopharm

[stellated@mastodon.sdf.org]

@Bebef @kkarhan @momo @badkeys
Do y'all have any docs on this you could link? Is it a blanket automated check a la DKIM and SPF or is it something that's reviewed when appealing an anti-spam listing? My search queries aren't turning up much.

[bebef@mastodon.social]

@stellated @kkarhan @momo @badkeys It works like this: send an email to a Telekom recipient. Mail bounces with

<xxxxx@t-online.de>: host mx03.t-online.de[194.25.134.73] refused to talk to

me: 554 IP=1.2.3.4 - None/bad reputation. Ask your postmaster for help

or to contact tobr@rx.t-online.de for reset. (NOWL)

Send an email to tobr@rx.t-online.de, hilarity ensues.

(They send a reply pointing you to https://postmaster.t-online.de/#t4.1)

[bebef@mastodon.social]

@stellated @kkarhan @momo @badkeys Bit more discussion in German to be found here: https://borncity.com/blog/2025/02/25/merkwuerdige-vorschriften-bei-der-telekom-fuer-e-mail-versand/

[crispycat@mastodon.calitabby.net]

@badkeys i didn't know anything below rsa-1024 even existed!