Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only safe email is text-only email

theconversation.com

Post reply on HN
Print view View original

61–70 of 123 posts

Re: The only safe email is text-only email

#61

Post by nailer »

TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext.

Yep. Email formatted for 65 to 78 monospaced characters with hard carriage returns (as per *nix mailing lists) look much worse on devices that are narrower or wider than this. HTML paragraphs don't have the problem.

Re: The only safe email is text-only email

#62

Post by dozzie »

simias wrote: post #56
eveningcoffee wrote: post #39

Earlier quoted context omitted.

Second link points out a problem I was afraid of existing - big providers just stump on personal email servers. > Hotmail is typically deleting all emails that I am sending. ... Monopolists like gmail.com won't accept any messages sent from my mail server.

I feel like I'm making this comment once a week on HN but I host my own email and I haven't had any major issue so far with "big email". The main caveat is that you will have a very hard time getting your email accepted if it comes from a home connection IP range instead of some host provider but if you do have a dedicated server and follow the guidelines (SMTPS, DKIM, SPF etc...) it just works, at least in my experi…

Hosting one's own e-mail server is a totally opaque random crapshot. You may not have any trouble, but some other dude or gal will get their e-mail marked as spam without any way to tell what exactly is wrong and what to change.

Re: The only safe email is text-only email

#63

Post by askvictor »

andyjohnson0 wrote: post #25
TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> External images are regularly abused to track if the email has been viewed, which I consider creepy. My understanding was that external images are automatically fetched and cached on their servers by Google, so they can't be reliably used to track message views [1]. Has this changed? [1] https://gmail.googleblog.com/2013/12/images-now-showing.html

They are proxied by Google's servers, but not (necessarily) cached.

Re: The only safe email is text-only email

#64

Post by brians »

nailer wrote: post #61
TheAceOfHearts wrote: post #7

There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option. I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter? Although I respect that some people may find greater valu…

> Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. Yep. Email formatted for 65 to 78 monospaced characters with hard carriage returns (as per *nix mailing lists) look much worse on devices that are narrower or wider than this. HTML paragraphs don't have the problem.

I think this is the problem format=flowed was created to solve. But it doesn’t seem to help. I wonder why it doesn’t have wider implementation

Re: The only safe email is text-only email

#66

Post by dingaling »

dvfjsdhgfv wrote: post #23
jasonkostempski wrote: post #4

Earlier quoted context omitted.

In my experience, for personal email, text-only is a non-issue; for work stuff, it's not even an option.

Can you elaborate why? I sometimes abuse this option by including screenshots in the body of e-mail, but I could as well add it as an attachment. Other than that I see no reason to use HTML in e-mail conversations at work.

Intra-corporate e-mail is often used as an ad hoc document collaboration tool.

"See my comments in blue", strikethroughs, inline diagrams, bullet points, big red font for emphasis.

Of course that should all be done in a dedicated application, but who is going to provision and authorise users for that versus just adding Bob to the cc line and giving him implicit editing capabilities?

The functional overloading of corporate e-mail is a user-driven reaction to the awfulness of most " collaborative' software.

Re: The only safe email is text-only email

#67

Post by yoz-y »

userbinator wrote: post #32

I've noticed that "if it's not plaintext, it gets deleted without being read" seems to be a pretty common rule among Germans on the Internet, who also have a tendency to like specifying very exactly what they want of email to them. Here's a few examples: https://www-user.tu-chemnitz.de/~heha/email.en.htm http://problemkaputt.de/email.htm https://www.gaertner.de/~neitzel/email-to-mn.html http://www.karo-electronics.de…

I would love to only use plain text e-mail. However, how does this work in practice when you are not a well known person (albeit in a niche) that decides the rules?

In work I have to accept whatever my colleagues, clients and bosses will send me. For personal communication I use mail with two people. And services that let you choose whether they'll send you plain text are practically inexistent.

Re: The only safe email is text-only email

#68

Post by ameliaquining »

stan_rogers wrote: post #21
ameliaquining wrote: post #11

Earlier quoted context omitted.

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high. The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine…

That involves the rather large and utterly baseless assumption that users look at the address bar at all. You probably do. Does your somewhat less-savvy next-door neighbour?

They don't really look at the URL in the email body either, especially if it's long and intimidatingly technical-looking.

Re: The only safe email is text-only email

#69

Post by ameliaquining »

hnlmorg wrote: post #27
ameliaquining wrote: post #11

Earlier quoted context omitted.

The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information. I don't know exactly what proportion of users will notice a well-disguised phishing URL in the email body but not in the address bar, but I bet it's not that high. The attack prevented is simply having the user open the attachment, allowing the sender to execute arbitrary JavaScript on their machine…

> The real URL will appear in the browser address bar anyway before the user gets the chance to disclose any information Which is already too late for anyone compromised by a drive-by download attack.

The threat model here is phishing, not drive-by downloads. Browsers have a much greater ability to mitigate those. Also, a drive-by download email doesn't have to impersonate any particular sender, it just has to look like something that a user might want to click on.

Re: The only safe email is text-only email

#70

Post by amelius »

Sir_Cmpwn wrote: post #60
amelius wrote: post #53

Earlier quoted context omitted.

I'm still waiting for people like that to automatically email back a CAPTCHA to the sender, if the sender is unknown, and not on a whitelist yet.

The proof of work approach is better.

Or how about a (micro-)payment?
Post reply on HN