The only safe email is text-only email • Hacker News Board

Re: The only safe email is text-only email

#21

Post by stan_rogers » Tue, Sep 12, 2017, 6:08 AM UTC

ameliaquining wrote: post #11

cozzyd wrote: post #10

Earlier quoted context omitted.

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high. The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine…

That involves the rather large and utterly baseless assumption that users look at the address bar at all. You probably do. Does your somewhat less-savvy next-door neighbour?

Re: The only safe email is text-only email

#22

Post by astrobe_ » Tue, Sep 12, 2017, 6:27 AM UTC

ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

> but they fail to establish that text-only email solves this problem in any meaningful way

The quote from US-CERT isn't "meaningful"?

FWIW, I'm the first to bitch about security experts that sacrifice usability in the name of security any day, but for once I completely agree with them.

> Also, the reference to JavaScript in email leads me to question whether the authors have any idea what they're talking about. Mail clients don't execute JavaScript.

https://stackoverflow.com/questions/3054315/is-javascript-su...

And that's only until someone finds a way to make them execute Javascript anyway. I don't think it ever actually happened, but not using an HTML engine drastically reduces the attack surface for sure.

Re: The only safe email is text-only email

#23

Post by dvfjsdhgfv » Tue, Sep 12, 2017, 6:55 AM UTC

jasonkostempski wrote: post #4

coldouthere wrote: post #2

Reminds me of the ascii ribbon campaign against non-human readable formats in email. I switched to a text only email client a few months back. I really don't think I am missing anything. HTML content tends to be chaff/advertising.

In my experience, for personal email, text-only is a non-issue; for work stuff, it's not even an option.

Can you elaborate why? I sometimes abuse this option by including screenshots in the body of e-mail, but I could as well add it as an attachment. Other than that I see no reason to use HTML in e-mail conversations at work.

Re: The only safe email is text-only email

#24

Post by ams6110 » Tue, Sep 12, 2017, 7:32 AM UTC

I've always used plain text for email. Text is for email; HTML is for web pages.

Re: The only safe email is text-only email

#25

Post by andyjohnson0 » Tue, Sep 12, 2017, 8:15 AM UTC

TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> External images are regularly abused to track if the email has been viewed, which I consider creepy.

My understanding was that external images are automatically fetched and cached on their servers by Google, so they can't be reliably used to track message views [1]. Has this changed?

[1] https://gmail.googleblog.com/2013/12/images-now-showing.html

Re: The only safe email is text-only email

#26

Post by ElectronShak » Tue, Sep 12, 2017, 9:00 AM UTC

I think this is entirely dependent on the context of that particular E-mail. Email has evolved quite a lot.

A good example is a newsletter from say, Quora or Medium; Newsletters usually have links to a story or a news feed article. If this was done using plain text, the link would be one long mashup of characters, because they usually include an authentication token or something like that. In this case, using an html link or button is clearly the better option.

HTML is like structured text for web pages.

Re: The only safe email is text-only email

#27

Post by hnlmorg » Tue, Sep 12, 2017, 9:07 AM UTC

ameliaquining wrote: post #11

cozzyd wrote: post #10

Earlier quoted context omitted.

At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> ) Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client…

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high. The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine…

> The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information

Which is already too late for anyone compromised by a drive-by download attack.

Re: The only safe email is text-only email

#28

Post by scaasic » Tue, Sep 12, 2017, 9:23 AM UTC

andyjohnson0 wrote: post #25

TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> External images are regularly abused to track if the email has been viewed, which I consider creepy. My understanding was that external images are automatically fetched and cached on their servers by Google, so they can't be reliably used to track message views [1]. Has this changed? [1] https://gmail.googleblog.com/2013/12/images-now-showing.html

AFAIK tracking images are usually sent via a recipient-unique URL, which allows services like Mailchimp to provide open stats for individuals. Since the URLs are unique, the host servers will get hit at least once per recipient that opens the email, as Google downloads and caches the image.

Re: The only safe email is text-only email

#29

Post by stephenr » Tue, Sep 12, 2017, 9:32 AM UTC

I've always thought native handling of markdown for email would be pretty cool.

The MUA could strip out any HTML embedded in the actual markdown, render to HTML locally (for display) and you have nice formatting without the risks or cruft of email HTML.

And of course if you choose to view in text only mode, you don't actually lose any semantic meaning.

Re: The only safe email is text-only email

#30

Post by alkonaut » Tue, Sep 12, 2017, 9:43 AM UTC

This might be true, but I think that ship has sailed. Email for 99% of internet users is html. Thinking that some large fraction of news letters, outlook emails will ever be plaintext is just naive. I use html emails in outlook simply because I don't want my emails within the corporation to appear differnet from anyone elses. I certainly don't want to return something that looks different from what the sender wrote,.

The mail client is a web browser. In many cases it's an actual web app in an actual web browser. The solution has to be to make them safer for the user. Maybe a subset of html can be whitelisted, maybe link targets should be rendered more clearly, maybe something else.