Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only safe email is text-only email

theconversation.com

Post reply on HN
Print view View original

101–110 of 123 posts

Re: The only safe email is text-only email

#101

Post by icelancer »

simias wrote: post #56
eveningcoffee wrote: post #39

Earlier quoted context omitted.

Second link points out a problem I was afraid of existing - big providers just stump on personal email servers. > Hotmail is typically deleting all emails that I am sending. ... Monopolists like gmail.com won't accept any messages sent from my mail server.

I feel like I'm making this comment once a week on HN but I host my own email and I haven't had any major issue so far with "big email". The main caveat is that you will have a very hard time getting your email accepted if it comes from a home connection IP range instead of some host provider but if you do have a dedicated server and follow the guidelines (SMTPS, DKIM, SPF etc...) it just works, at least in my experi…

I've gotten DKIM, SPF, DMARC, etc all verified on my Digital Ocean droplet (and removed from various greylists) but still get spam checked by AT&T / SBC Global, who is the main offender of keeping a private list.

I've been removed for now from their lists... but they tend to re-add IPs from previous ranges for no reason.

Re: The only safe email is text-only email

#102

Post by Sir_Cmpwn »

tscs37 wrote: post #100
Sir_Cmpwn wrote: post #60

Earlier quoted context omitted.

The proof of work approach is better.

How much work would you propose is sufficient that grandma doesn't mind but spammers will be severely hampered in their sending and in a manner that doesn't require the receiver to store too much state?

Only a small amount is necessary. There is a protocol called hashcash (used by Bitcoin but generally applicable) that can be easily used with email [1]. You basically get a header like this:

X-Hashcash: 0:030626:adam@cypherspace.org:6470e06d773e05a8

You can choose how much work you want to do and the recepient can specify thresholds for minimum work required. This header is all they have to store, and it's easily stored through existing email infrastructure. Your mail server can do it without your client's help, too. If you spent a second on a proof I'm sure grandma wouldn't notice, but it would be very difficult for spammers to do the same.

[1] http://www.hashcash.org/

Re: The only safe email is text-only email

#103

Post by mmagin »

Every time I use some kind of graphical/web email client, I'm appalled by how hard it is for me to find the "show me all the headers" feature. In mutt when I have doubts about something I just hit "h".

Admittedly this requires a level of knowledge that the average user may be missing. But I find it really helps inform my opinion of any borderline-suspicious emails.

Re: The only safe email is text-only email

#104

Post by discreditable »

I use plaintext mail heavily. My only complaint is clients that don't support format=flowed[1] wrap text weirdly and make it look bad. The biggest ones are Outlook and the Windows 10 Mail app, though some webmail handles it poorly too. It gets bad when conversations start accumulating nested quotes.

I've found a quick tell if someone uses Outlook is if I send them a text/plain message, they'll send one back and there's no format=flowed. At that point I'll usually send them HTML mail.

1. https://joeclark.org/ffaq.html

Re: The only safe email is text-only email

#105

Post by paultopia »

and to get there, we need email clients with usable UIs. Is there a way to make outlook or apple mail or the gmail web app grab the equivalent of `document.innerText` on every piece of email? Who can tell, without spending hours hunting through increasingly obscure menu forests?

Re: The only safe email is text-only email

#106

Post by hippich »

andyjohnson0 wrote: post #25
TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> External images are regularly abused to track if the email has been viewed, which I consider creepy. My understanding was that external images are automatically fetched and cached on their servers by Google, so they can't be reliably used to track message views [1]. Has this changed? [1] https://gmail.googleblog.com/2013/12/images-now-showing.html

I am in the process of learning everything-marketing and sending my own emails from my own server using my own hosted software.

I can confirm that every time you open email, open is get tracked. (what is not get tracked is your IP/OS/etc)

So in fact Gmail made online marketers job easier.

Re: The only safe email is text-only email

#107

Post by j_s »

dozzie wrote: post #75
Belphemur wrote: post #71

Earlier quoted context omitted.

First step when getting an ip for a server that will be a mail server is to check if the ip is not already blacklisted. You can always get it unlisted. After that don't start to send hundred of email by day. You need to build a reputation for your domain and ip. As the parent comment says, set up directly spf, dkim and dmarc (also arc if you can). Rspamd can help you do that. I've been running a personal mail server…

I've been running a personal mail server for twice as long with simply following those rules and my e-mail is still tagged as spam in Gmail when it's me who initiates contact (once the other party sends me an e-mail, reply or otherwise, I no longer get tagged as spam). As I said, it's totally opaque crapshot.

There have been a few discussions regarding deliverability:

Why does Gmail hate my domain? | https://news.ycombinator.com/item?id=9855030

How to Avoid Spam Filters | https://news.ycombinator.com/item?id=10465639

Hotmail | https://news.ycombinator.com/item?id=14210939

ESP | https://news.ycombinator.com/item?id=14201704

If there are others I'd appreciate a link as I try to connect them!

Re: The only safe email is text-only email

#109

Post by JetSpiegel »

bovine3dom wrote: post #80
bo1024 wrote: post #72

Earlier quoted context omitted.

Many (most?) emails can be read in plain-text format even if they were written in HTML. The email often comes encoded with an "alternative" plain text version; of course you need a client that will show you that version instead. In my experience most personal email (i.e. not automated/form mails) I receive has a plain text alternative version that works fine. For emails sent by an evil client that doesn't provide a p…

Similar to the other child comment: elinks can format HTML as plaintext. I have this as my .mailcap and it Just Works (TM) with mutt: text/html; elinks -dump %s; nametemplate=%s.html; copiousoutput

You can also use pandoc, I had better results with this:

> text/html; iconv -f %{charset} -t UTF-8 | pandoc -f html -t plain --wrap=preserve; copiousoutput; nametemplate=%s.html; description="HTML eMail";

Re: The only safe email is text-only email

#110

Post by j_s »

dozzie wrote: post #90
cyberpunk wrote: post #88

Earlier quoted context omitted.

Hmm well, I've found it to be pretty straightforward, I'm curious why this is happening to you though and there must be a solution... I mean.. If you get a solid result from dkimvalidator but google is still shitlisting you then I'd definitely consider moving to another host/dc/isp at least. Depending on your size, it might be best just to make this someone else's problem (if you can) -- like google, o365, etc..

I'm definitely not giving to somebody else my /var/log/mail.log, IMAP/Mutt access, sieve rules, nor ad hoc dedicated aliases for every website account I create. And on top of that, I would land on some US-based server for ease of illegal spying and my mail would be harvested for some advertising crap, all to solve something that is not a problem for me. Not happening.

> I would land on some US-based server for ease of illegal spying and my mail would be harvested for some advertising crap

Does this not happen when you send your emails to someone else? Mad props if everyone you email uses encryption!

Post reply on HN