Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only safe email is text-only email

theconversation.com

Post reply on HN
Print view View original

31–40 of 123 posts

Re: The only safe email is text-only email

#31

Post by dm319 »

alkonaut wrote: post #30

This might be true, but I think that ship has sailed. Email for 99% of internet users is html. Thinking that some large fraction of news letters, outlook emails will ever be plaintext is just naive. I use html emails in outlook simply because I don't want my emails within the corporation to appear differnet from anyone elses. I certainly don't want to return something that looks different from what the sender wrote,.…

I'm not sure the ship has sailed. If HSBC switched to only mailing out text-only emails with URLs written out in full, after a while HSBC users would get used to only receiving text correspondence from their bank. I think that would be a step towards reducing phishing attempts, though certainly not a complete answer.

Re: The only safe email is text-only email

#32

Post by userbinator »

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples:

https://www-user.tu-chemnitz.de/~heha/email.en.htm

http://problemkaputt.de/email.htm

https://www.gaertner.de/~neitzel/email-to-mn.html

http://www.karo-electronics.de/448.html

...and of course there's this:

http://arc.pasp.de/

Re: The only safe email is text-only email

#33

Post by alkonaut »

dm319 wrote: post #31
alkonaut wrote: post #30

This might be true, but I think that ship has sailed. Email for 99% of internet users is html. Thinking that some large fraction of news letters, outlook emails will ever be plaintext is just naive. I use html emails in outlook simply because I don't want my emails within the corporation to appear differnet from anyone elses. I certainly don't want to return something that looks different from what the sender wrote,.…

I'm not sure the ship has sailed. If HSBC switched to only mailing out text-only emails with URLs written out in full, after a while HSBC users would get used to only receiving text correspondence from their bank. I think that would be a step towards reducing phishing attempts, though certainly not a complete answer.

That would require HSBC to value some kind of improved security so much that they'd accept not having the HSBC logo in the email. That's what I think is out of the question.

You could maybe see banks having plaintext communication as an optional, but I doubt they'd make it default (allowing users to switch to html).

Isn't this problem already solved with certificates online? Shouldn't this be solvable the same way? E.g. a bank sends an email containing a link to the content with some special attribute. The web browser displays the content if and only if the sender domain of the email (e.g. hsbc.com) is also the domain from which the content will be downloaded.

Re: The only safe email is text-only email

#34

Post by neals »

userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

This is the most German thing I've seen since Octoberfest 2016.

It seems weird to me to have to find out the preferred way of communication to this level of detail, I already loathe that one cient of mine that only uses Facebook messenger for all communication.

Re: The only safe email is text-only email

#35

Post by ConfucianNardin »

andyjohnson0 wrote: post #25
TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> External images are regularly abused to track if the email has been viewed, which I consider creepy. My understanding was that external images are automatically fetched and cached on their servers by Google, so they can't be reliably used to track message views [1]. Has this changed? [1] https://gmail.googleblog.com/2013/12/images-now-showing.html

That depends on how the fetching and caching is implemented. If it's done when you open your email, the tracking would still work. If the trigger is unrelated to anything correlating with your opening of the email it wouldn't.

It will still prevent the sender from setting cookies for you, or learning your IP and user agent.

Re: The only safe email is text-only email

#36

Post by zwp »

stephenr wrote: post #29

I've always thought native handling of markdown for email would be pretty cool. The MUA could strip out any HTML embedded in the actual markdown, render to HTML locally (for display) and you have nice formatting without the risks or cruft of email HTML. And of course if you choose to view in text only mode, you don't actually lose any semantic meaning.

Huh, looks like text/markdown email is coming slowly:

https://stackoverflow.com/a/25812177

https://tools.ietf.org/html/rfc7763

https://tools.ietf.org/html/rfc7764

(March 2016)

Previous HN discussion: https://news.ycombinator.com/item?id=13176743

Re: The only safe email is text-only email

#37

Post by userbinator »

ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

Text-only emails can and will still contain links, which users will still click on. Misleading domain names will work just as well in the email body as they do in the address bar.

...that brings up the other elephant in the room: Unicode. More specifically, https://en.wikipedia.org/wiki/IDN_homograph_attack

The 0/O/i/1/l/I distinction is a classic one that can be somewhat mitigated by good font choice (plaintext emails are often presented in monospace, so that helps a little), but some of the other sets of Unicode characters are designed to look identical to ones in the ASCII range, often using the exact same glyphs.

For those who use non-English characters exclusively, it is not possible to use ASCII only emails, but non-Unicode encodings are still helpful in this situation --- e.g. the Cyrillic characters most known for IDN homograph attacks aren't even encodable in 8859-1 or Shift-JIS.

Re: The only safe email is text-only email

#38

Post by userbinator »

stan_rogers wrote: post #21
ameliaquining wrote: post #11

Earlier quoted context omitted.

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high. The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine…

That involves the rather large and utterly baseless assumption that users look at the address bar at all. You probably do. Does your somewhat less-savvy next-door neighbour?

This observation I made a while ago shows that a considerable number of "average users" used to, and even understood how URLs are formed:

https://news.ycombinator.com/item?id=7678729

If an increasing number of users aren't, then that is certainly a problem.

Re: The only safe email is text-only email

#39

Post by eveningcoffee »

userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

Second link points out a problem I was afraid of existing - big providers just stump on personal email servers.

>Hotmail is typically deleting all emails that I am sending. ... Monopolists like gmail.com won't accept any messages sent from my mail server.

Re: The only safe email is text-only email

#40

Post by dm319 »

alkonaut wrote: post #33
dm319 wrote: post #31

Earlier quoted context omitted.

I'm not sure the ship has sailed. If HSBC switched to only mailing out text-only emails with URLs written out in full, after a while HSBC users would get used to only receiving text correspondence from their bank. I think that would be a step towards reducing phishing attempts, though certainly not a complete answer.

That would require HSBC to value some kind of improved security so much that they'd accept not having the HSBC logo in the email. That's what I think is out of the question. You could maybe see banks having plaintext communication as an optional, but I doubt they'd make it default (allowing users to switch to html). Isn't this problem already solved with certificates online? Shouldn't this be solvable the same way? E…

Problem is you've already received the rogue html before accessing the secure webpage. It's a shame email signing and encryption never took off.
Post reply on HN