Posterous allowed posting of content directly to one's blog via e-mail, choosing where to put the content based on the return address of the e-mail. While this feature was very convenient, return e-mail addresses are easily spoofed, allowing for malicious users to post unwanted content on another person's blog. Posterous claimed that they could filter out messages not actually sent by the account holder through other means besides the return address. They did not publish their methods, but it appears that they used a combination of
SPF-checking and filters on e-mail headers to verify that the e-mail client or machine from which the e-mails were sent are similar to previously verified e-mails. Posterous did not offer any options for the user to require confirmation on all posts, no matter who sends them. In June 2008, a blog post on
TechCrunch challenged its readers to try to spoof the author's Posterous blog. Three posters were successful, out of quite a few attempts, but Posterous quickly fixed the security hole which allowed these posts to go through. == Mobile ==