Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only safe email is text-only email

theconversation.com

Post reply on HN
Print view View original

11–20 of 123 posts

Re: The only safe email is text-only email

#11

Post by ameliaquining »

cozzyd wrote: post #10
ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high.

The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine in the file:// context. (Modern browsers have made the security consequences of this somewhat less dire than they once were, but it's still not something you want to do if you can help it.)

Re: The only safe email is text-only email

#12

Post by diggernet »

cozzyd wrote: post #10
ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

Also, I gather that non-text emails make it possible to disguise the link target when you hover over it to see where the link goes. Whether that is using css or js, I'm not sure.

Re: The only safe email is text-only email

#13

Post by diggernet »

jasonkostempski wrote: post #4
coldouthere wrote: post #2

Reminds me of the ascii ribbon campaign against non-human readable formats in email. I switched to a text only email client a few months back. I really don't think I am missing anything. HTML content tends to be chaff/advertising.

In my experience, for personal email, text-only is a non-issue; for work stuff, it's not even an option.

I've always had my work email client set to text only. Never been a problem for me (unless you consider missing out on a lot of unnecessary smilies, fonts, and colors a problem).

Re: The only safe email is text-only email

#14

Post by ameliaquining »

diggernet wrote: post #12
cozzyd wrote: post #10

Earlier quoted context omitted.

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

Also, I gather that non-text emails make it possible to disguise the link target when you hover over it to see where the link goes. Whether that is using css or js, I'm not sure.

You can't falsify the browser indicators of link targets (status bar on desktop, modal dialog from holding down the link on mobile) without JavaScript.

You can create a misleading tooltip in HTML: https://www.megabank.com.phishingattempt.io" title="https://www.megabank.com" rel="nofollow">https://www.megabank.com">https://www.megabank.com. But since modern browsers don't use tooltips to indicate link targets, users probably won't be looking there in the first place.

Re: The only safe email is text-only email

#15

Post by lwhsiao »

coldouthere wrote: post #2

Reminds me of the ascii ribbon campaign against non-human readable formats in email. I switched to a text only email client a few months back. I really don't think I am missing anything. HTML content tends to be chaff/advertising.

I recently switched to mutt and using plain-text email as well. So far there have been very few times that I've felt the need to jump back to the webmail to send something (e.g. inline images). Overall, I've thoroughly enjoyed the simplicity of plain text email using my text editor of choice.

Re: The only safe email is text-only email

#16

Post by savanaly »

TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

If nothing else, styling emails serves an economic purpose through facilitating signaling. The more a company expects that consumers will value it in the long run the more incentive it has to signal that fact, and a signal is only as good as it is expensive in appearance to the people being signaled to.

In this case, things like a marketing email or simply the follow-up email to signing up to some service provide that signal since the user can see how much effort was invested in making the communication look attractive.

Re: The only safe email is text-only email

#17

Post by lucaspiller »

cozzyd wrote: post #10
ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

I got a phising SMS today (please login to verify unusual account activity) with a link to mybank.online-eauth.co.uk. I knew from before even seeing that it was probably not legit, but I did check the domain whois as UK banks are rather arcane, and I wouldn't be surprised if they had a completely different domain for something like this. I know when I buy something online, my bank has a different domain for Verified by Visa.

Re: The only safe email is text-only email

#18

Post by CyberShadow »

stevekemp wrote: post #9

But even there you've got to be careful. For example if you're using GNU Emacs to read your email you could have been vulnerable to arbitrary code execution for the past few years: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350

The vulnerability is in the handling of text/enriched parts - not quite text/plain.

Re: The only safe email is text-only email

#19

Post by KGIII »

diggernet wrote: post #13
jasonkostempski wrote: post #4

Earlier quoted context omitted.

In my experience, for personal email, text-only is a non-issue; for work stuff, it's not even an option.

I've always had my work email client set to text only. Never been a problem for me (unless you consider missing out on a lot of unnecessary smilies, fonts, and colors a problem).

I too am confused. The only time I've used HTML in email was when I used the web interface and plain text wasn't an option.

Re: The only safe email is text-only email

#20

Post by toast0 »

diggernet wrote: post #12
cozzyd wrote: post #10

Earlier quoted context omitted.

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

Also, I gather that non-text emails make it possible to disguise the link target when you hover over it to see where the link goes. Whether that is using css or js, I'm not sure.

On mobile, there's no hover, so HTML mail means I just have to guess if I think the link will go where it says or not.
Post reply on HN