Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only safe email is text-only email

theconversation.com

Post reply on HN
Print view View original

51–60 of 123 posts

Re: The only safe email is text-only email

#51

Post by alkonaut »

dm319 wrote: post #40
alkonaut wrote: post #33

Earlier quoted context omitted.

That would require HSBC to value some kind of improved security so much that they'd accept not having the HSBC logo in the email. That's what I think is out of the question. You could maybe see banks having plaintext communication as an optional, but I doubt they'd make it default (allowing users to switch to html). Isn't this problem already solved with certificates online? Shouldn't this be solvable the same way? E…

Problem is you've already received the rogue html before accessing the secure webpage. It's a shame email signing and encryption never took off.

The solution assumed mail clients would be adapted to enforce this. So if you send me a forged email claiming to be from hsbc, the mail client would allow showing html content only from a https connection to somewhere on hsbc. Kind of like the same-origin policy but where the origin is the domain the email claims it came from.

Re: The only safe email is text-only email

#52

Post by ryanbrunner »

alkonaut wrote: post #49
proactivesvcs wrote: post #43

Earlier quoted context omitted.

Over 99.5% of the email I receive is either plaintext or renders perfectly legible in plain. This suggests that a large fraction of newsletters are already plaintext. The mail client is primarily a program to display and send email. The web browser is a web browser. If the user wants safety, switching to plaintext is a very wide step forward.

> Over 99.5% of the email I receive is either plaintext or renders perfectly legible in plain. Is that representative? Where do you get email from? Did you change preferences on things like mailing lists in order to get to that percentage? Also: what kind of client do you use? iOS mail does send plain text emails as text/plain (which is fantastic) but if you look at e.g. inbox (gmail) it doesn't even allow sending pl…

Emails can send in both formats for a single message, so it's possible and even likely that most mailing lists, etc. he receives send in both formats. In my experience, even most marketing e-mails are at least somewhat good about this. I'm 99% sure that Gmail will still send a plaintext e-mail inferred from your HTML content whenever you send, so it's not quite accurate to say it doesn't send in plaintext.

Re: The only safe email is text-only email

#53

Post by amelius »

userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

I'm still waiting for people like that to automatically email back a CAPTCHA to the sender, if the sender is unknown, and not on a whitelist yet.

Re: The only safe email is text-only email

#54

Post by mike-cardwell »

ameliaquining wrote: post #8

This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…

"Mail clients don't execute JavaScript."

Maybe not on purpose, but EmailPrivacyTester.com has found several clients in the past (usually webmail) which do.

Re: The only safe email is text-only email

#55

Post by alkonaut »

ryanbrunner wrote: post #52
alkonaut wrote: post #49

Earlier quoted context omitted.

> Over 99.5% of the email I receive is either plaintext or renders perfectly legible in plain. Is that representative? Where do you get email from? Did you change preferences on things like mailing lists in order to get to that percentage? Also: what kind of client do you use? iOS mail does send plain text emails as text/plain (which is fantastic) but if you look at e.g. inbox (gmail) it doesn't even allow sending pl…

Emails can send in both formats for a single message, so it's possible and even likely that most mailing lists, etc. he receives send in both formats. In my experience, even most marketing e-mails are at least somewhat good about this. I'm 99% sure that Gmail will still send a plaintext e-mail inferred from your HTML content whenever you send, so it's not quite accurate to say it doesn't send in plaintext.

> I'm 99% sure that Gmail will still send a plaintext e-mail inferred from your HTML content whenever you send, so it's not quite accurate to say it doesn't send in plaintext.

I think that might be possible in the "old" gmail, I was referring to their newer "Inbox by gmail" client. I believe it never sends a text/plain email regardless of content (And it being their "newer" revamped client kind of shows what googles take on this is...)

Re: The only safe email is text-only email

#56

Post by simias »

eveningcoffee wrote: post #39
userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

Second link points out a problem I was afraid of existing - big providers just stump on personal email servers. > Hotmail is typically deleting all emails that I am sending. ... Monopolists like gmail.com won't accept any messages sent from my mail server.

I feel like I'm making this comment once a week on HN but I host my own email and I haven't had any major issue so far with "big email".

The main caveat is that you will have a very hard time getting your email accepted if it comes from a home connection IP range instead of some host provider but if you do have a dedicated server and follow the guidelines (SMTPS, DKIM, SPF etc...) it just works, at least in my experience.

Re: The only safe email is text-only email

#57

Post by decasteve »

Some client software hides the From and Reply-To addresses, only showing the name by default. A friend's accountant got hit because the From had my friend's name, but the address itself was bogus but hidden, so he opened the attachment.

So keep the main headers text-only as well (which most sane software does anyway).

Re: The only safe email is text-only email

#58

Post by ElectronShak »

gkya wrote: post #47
ElectronShak wrote: post #26

I think this is entirely dependent on the context of that particular E-mail. Email has evolved quite a lot. A good example is a newsletter from say, Quora or Medium; Newsletters usually have links to a story or a news feed article. If this was done using plain text, the link would be one long mashup of characters, because they usually include an authentication token or something like that. In this case, using an html…

> A good example is a newsletter from say, Quora or Medium; Newsletters usually have links to a story or a news feed article. If this was done using plain text, the link would be one long mashup of characters, because they usually include an authentication token or something like that. In this case, using an html link or button is clearly the better option. Well, that's a yet more hostile thing that one has to put up…

Yah,consequently. But last week someone posted a link here, a text only version of CNN, I looked it up, here it is; http://lite.cnn.io/en. We could have more of these soon, which is a good thing.

Re: The only safe email is text-only email

#59

Post by extra88 »

toast0 wrote: post #20
diggernet wrote: post #12

Earlier quoted context omitted.

Also, I gather that non-text emails make it possible to disguise the link target when you hover over it to see where the link goes. Whether that is using css or js, I'm not sure.

On mobile, there's no hover, so HTML mail means I just have to guess if I think the link will go where it says or not.

In iOS Mail, you don't have to guess where the link goes, press and hold on a link will show the URL.

Re: The only safe email is text-only email

#60

Post by Sir_Cmpwn »

amelius wrote: post #53
userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

I'm still waiting for people like that to automatically email back a CAPTCHA to the sender, if the sender is unknown, and not on a whitelist yet.

The proof of work approach is better.
Post reply on HN