The only safe email is text-only email
theconversation.com
The only safe email is text-only email
1–10 of 123 posts
Re: The only safe email is text-only email
#2Reminds me of the ascii ribbon campaign against non-human readable formats in email.
I switched to a text only email client a few months back. I really don't think I am missing anything. HTML content tends to be chaff/advertising.
Re: The only safe email is text-only email
#3[deleted]
Re: The only safe email is text-only email
#4Reminds me of the ascii ribbon campaign against non-human readable formats in email. I switched to a text only email client a few months back. I really don't think I am missing anything. HTML content tends to be chaff/advertising.
In my experience, for personal email, text-only is a non-issue; for work stuff, it's not even an option.
Re: The only safe email is text-only email
#5I was expecting to read about some brilliant new way to solve all of the normalisation problems with Unicode, and make plain text safe again. What a let down!
Re: The only safe email is text-only email
#6Annoyingly, the Gmail Android app sends things multipart, even though I'm not sure it's really possible to have any formatting (except maybe links?). I wish there wan option to send text only, it might even make a (small) difference for people with limited data.
Re: The only safe email is text-only email
#7There's a certain zen to going back to basics and using plaintext. It's always my default choice whenever I'm given the option.
I'd argue in most cases you really don't need any fancy styles and markup. Although upon writing this I'm now wondering if unstyled HTML might provide improved accessibility over plaintext. What are people's experiences on the matter?
Although I respect that some people may find greater value in carefully styled marketing emails, to me it just feels a bit overengineered at times. How many man-hours have been spent trying to get marketing emails to look the same across all major clients? Are slight variations really such a horrible thing?
As we're on the subject, I'll add the following suggestion to gmail users: go to Settings and changing the Images option to "Ask before displaying external images". External images are regularly abused to track if the email has been viewed, which I consider creepy.
Re: The only safe email is text-only email
#8This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way.
Text-only emails can and will still contain links, which users will still click on. Misleading domain names will work just as well in the email body as they do in the address bar. Even if (as this article seems to imply should be done) mail clients don't make the links clickable, users will still copy-paste them. (Not to mention that the usability benefits of making links clickable are significant enough that mail clients won't forgo them just for a speculative hypothetical security benefit.)
The authors seem to think that inserting a "speed bump" here will cause users to pay closer attention and not be fooled. This is not how humans work, especially very busy humans who get too much email and just want to get through it as quickly as possible.
Also, the reference to JavaScript in email leads me to question whether the authors have any idea what they're talking about. Mail clients don't execute JavaScript.
Re: The only safe email is text-only email
#9But even there you've got to be careful. For example if you're using GNU Emacs to read your email you could have been vulnerable to arbitrary code execution for the past few years:
Re: The only safe email is text-only email
#10This is silly. The authors establish that phishing is a serious problem (duh), and that this problem is caused by the absence of reliable authentication of messages (a worthwhile observation, albeit one that the industry is already aware of and doing its best to patch over), but they fail to establish that text-only email solves this problem in any meaningful way. Text-only emails can and will still contain links, wh…
At least with plain-text, it's a slightly harder to forge links. (i.e. you have to do http://www.megabank.com.phishingattempt.io instead of http://www.phishingattempt.io"> src="megabank.com/logo.png"> )
Speaking of JavaScript in e-mail, gmail doesn't allow you to send or receive .js files (even tarred up), which is somewhat inconvenient, and I'm not really sure what attack that prevents. Maybe there is a mail client out there that will happily execute attached js?