4 ms·

Can someone with some good security/email knowledge tell me if email spoofing is a thing (or will be possible) here?

• Alex3917 11y ago
  When you preview a thread we get that data directly from the Gmail API on our servers. This means that if your email is properly configured with SPF and DKIM, it shouldn't be possible for someone else to spoof your email before we retrieve it. Once we have a copy of your email, we then take a hash of the messages before sending the text to the users. When we get the text back from the users (who can make highlights or redactions), we compare the text we receive back with the hash of the original message and throw an exception if the hashes don't match. We then delete the hash from our database, and store an encrypted copy of the message. The message remains encrypted until each of the message contributors gives permission. If this doesn't happen then the encrypted thread is deleted from our servers. So yeah, we were pretty OCD about making sure that if something shows up in everyone's newsfeed that it was actually both written by you and approved for publication by you.