Regarding "Free Willy"

[Mark]

>I'm sorry to have to confess this, but I don't understand how I as 
>a mere user receiving mail am supposed to know that the Free Willy 
>message did not come from the President. 

You just have to learn to read mail headers to get the gist of what
they are saying.

>> Return-Path: <President at whitehouse.gov>
>> Received: from [144.92.136.35] by toad.com id AA13485; 
>>   Sun, 19 Dec 93 14:16:03 PST

This says toad.com was connected to by telgate.adp.wisc.edu[144.92.104.20]


>Then charliemerritt offers another solution.
> 
>> Return-path: President at whitehouse.gov
>> Received: from delphi.com by bix.com (CoSy3.31.1.45) id
>>  <9312191740.memo.19248 at BIX.com>; Sun, 19 Dec 1993 17:40:07 -0500 (EST)
>> Received: from relay2.UU.NET by delphi.com (PMDF V4.2-11 #4520) id
>> <01H6O7JJ9BJK94H43Q at delphi.com>; Sun, 19 Dec 1993 17:37:58 EDT
>> Received: from toad.com by relay2.UU.NET with SMTP
>>  (5.61/UUNET-internet-primary) id AA10179; Sun, 19 Dec 93 17:37:09 -0500
>> Received: by toad.com id AA13572; Sun, 19 Dec 93 14:19:04 PST
>> Received: by toad.com id AA13552; Sun, 19 Dec 93 14:17:31 PST
>> Received: from [144.92.136.35] by toad.com id AA13485; Sun,
>>  19 Dec 93 14:16:03 PST
>> From: President at whitehouse.gov
>> Date: Sun, 19 Dec 1993 14:13:02 -0800 (PST)
>> To: charliemerritt at bix.com
>> Message-id: <9312192216.AA13485 at toad.com>
>> Content-transfer-encoding: 7BIT
>> X-Envelope-to: bix.com!charliemerritt
>> Apparently-To: Cypherpunks

Read from the bottom up, it's to charliemerrit at bix.com.

It *says* from president at whitehose.gov.

toad got it from good old telgate.adp.wisc.edu It looks like it tried
to deliver it a couple of times before succeeding.

then it went thru uunet, to delphi.com and then to bix.com...
obviously bix gets it's mailfeed via delphi. (they provide commercial
ip and usenet/mail feeds)

It was faked basically. A big clue is when it has "Apparently-To:" in
the header...

Mark