I'VE BEEN SPOOFED !

Hold on!!! Don't answer that. "My server requires authentication" so I entered my own (Telefonica) user name and password and tried again. I get it. At last! Just received an e-mail from my mate, but he didn't send it to me.  I just spammed myself, using my mate's e-mail address. Oh, what fun!

 Just trying to familiarise myself with Windows Live Mail, still using Outlook Express . I have set up san account myself  with no password.

The outgoing server will be smtp and incoming will be pop. Once you lick the Next button, it is set up but will ask for a password. Ignore that and close. You can now send compose an email as John Doe and a spoofed address and send it. The mail should stay in your outbox until you close Mail when it will be sent, if you areconcted to the Telefonica network. The only time it will ask for a password in this instance, is if you try to collect email as you need a password to retriev it. Here are the header details (with some sensitive stuff removed) of the email I sent myself:

edit: B+gger, Roberto beat me!!

Now I know how, I can set up a new fake account in seconds. You didn't mention that you still have to log in using your own username and password! Now - next question: following your example, I decided to leave my mate out of it, and I set up an account as the famous Mr John Doe - johndoe@example.com, to be precise, same as you, clearly a non-existent e-mail address. And I sent a message to myself, and received it, from johndoe@example.com. So my question is this: if a spammer can just use a made up address, why use mine? What exactly is the whole point of this?

 Not really 100% sure on that Roberto. I think that it is because if they use a proper address, the failed deliveries will be bounced to an inbox of some poor unsuspecting person, which means the end of the message. If you send from a fake address and it goes to a "duff" email address, there is nowhere for the mail to go and ends up going back and forth around the email servers indefintitely. This gives those 'orrible spammers more chance of being found quickly and being blocked.

Mark

edit to ad: The only reason you have to log in and use password Roberto is that your isp requires authenticated email. This is so that TF can be sure it is you using their mail server and not someone else. Some isp's won't let you use their mail server unless you are physically connected to their network by adsl or dial up. I have my own web hosting account which doesn't need authentication, thus I can send from any pc, on any network, Worldwide if I wanted to (but so could someone else hacking into my account!!). ISP's also usually use something called tarpitting. e.g. You may be allowed to send up to 30 emails in one go, if you send 31, the 31st may be queued to go after 5 minutes. So, if you were sending out 10,000 spams, it could conceivably take you days to do it this way.