6 ms·
If this starts showing up in the wild as a new attack vector, it would be great if companies/governments decided to abandon faxes and embrace email attachments
by mamurphy 8y ago
If this starts showing up in the wild as a new attack vector, it would be great if companies/governments decided to abandon faxes and embrace email attachments as a response. If both are subject to vulnerabilities are there any upsides to continuing to use fax?
- peterwwillis 8y agoThe only digital equivalent of a fax is: 1) Get a public IP address on the internet. 2) Put a server on the internet, with an open port, running software that can receive arbitrary files. 3) Connect to it from your computer and send it a file. 4) Receive confirmation that the remote server correctly received your whole file. Everything else, like e-mail, depends on a chain of service providers and accounts to deliver and store content reliably over the network. Fax enables any person with a phone number to send documents to any person with a phone number. E-mail may seem similar (you need a phone service provider and a fax machine), but I think faxing is a less technically complicated solution, more reliable overall, and allows a lot more independence.
- walrus01 8y agoNew SaAS VC-funded startup: Netcat As a Service (NaAs). Cloud hosted with slick HTML5 control panel.
- losteric 8y ago> Everything else, like e-mail, depends on a chain of service providers and accounts to deliver and store content reliably over the network In your proposal, how do the packets get from point A to B?
- peterwwillis 8y agoOver the public network. Via fax that's the PSTN. Via internet that's... the internet. A phone number == A publicly routable IP address.
- rhencke 8y agoI think the point was that you still directly depend on a chain of service providers when you use the Internet. You don't free yourself of that.
- peterwwillis 8y agoOk, so, we're all agreeing on the same thing. The internet method I proposed is the same as faxing, but anything else requires more service providers, machines and steps.
- grkvlt 8y agoI think there's an assumed split between infrastructure providers (ISP, PSTN, telco) and service providers (webmail, hosting, etc.) and fax only needs the former.
- varenc 8y agoDoesn't calling a phone number rely on a chain of service providers as well? Your fax probably needs to be bounced through several companies and some of that infrastructure ends up shared with internet infra anyway. Though I agree that for many end users sending a fax is easier and simpler, but that seems mostly because of experience and familiarity.
- peterwwillis 8y agoThe big differences to me are that faxes don't need an "account" to send/receive files, the machines are simpler and cheaper, they have far fewer intermediary technical and user issues, and their network is way more reliable. If you depend on sending and receiving documents, faxes are light-years more reliable and less complicated than, say, e-mail. Can you count the number of times an internet connection has gone down for a business, compared to the number of times the PSTN has gone down? Unless a truck takes out a utility pole, there's no contest. And the lack of obstructions for user access removes a whole slew of other issues.
- vageli 8y ago> The big differences to me are that faxes don't need an "account" to send/receive files, the machines are simpler and cheaper, they have far fewer intermediary technical and user issues, and their network is way more reliable. If you depend on sending and receiving documents, faxes are light-years more reliable and less complicated than, say, e-mail. You most definitely need an "account" with your telephony provider in order to receive anything.
- peterwwillis 8y agoI meant regarding e-mail (or any other internet file transfer service). Your e-mail account, and that of your recipient, are accounts used to authorize access. If either you or your recipient lose account access, you can not send and receive files. This happens all the time, like when your corporate ID gets locked for no reason, or a user forgets their password, or some other problem occurs. Faxes require no such accounts. Just plug the machine in to a phone line and send a document.
- nitemice 8y agoSounds like an FTP server to me.
- mbreese 8y agoAn FTP server that also then does some processing on the received file. It’s the processing that opens the machine up to exploit, not the receiving of the data.
- peterwwillis 8y agoIf one piece of FTP software were both a client and server and allowed anonymous write access, yes, FTP would be fine.
- deathanatos 8y agoIt doesn't need to be that equivalent though. Some changes can be / are beneficial. The last time I had to send a fax was when my back account had fraudulent charges made against it. My now-former bank wanted me to fill out a form — fine — which they would only snail-mail or fax to me. This form could simply be hosted on their website, as a PDF. In fact, the form I received had something like Z:\BigBankCo_Shared\Docs\Forms\Fraud.docx on the bottom of it, and in the end, I gave them a number of a service that automatically converts faxes into PDFs in emails. Now, they wanted me to fax (or snail mail) it back. A email with an attachment to a support address, such as fraud-form-returns@bigbank.example.com, would have suffice. Directly, bit for bit equivalent? No. Gets the job done? Yes. All together, the entire thing was a few simple questions (my info, information about the transactions, and a statement essentially swearing up and down it wasn't my fault) that could also have just been gathered by an HTML form. (And, I'm not saying these should replace the snail mail/fax; keep them, if there is sufficient demand for them. Which I suspect that once you have an HTML form, there won't be.)
- EamonnMR 8y agoReliable? Depends on the implementation I guess. If it's competing with a phone line they might not get it. We used fax to communicate with with far flung doctors offices and it was nothing but trouble. The process of sending or receiving a fax often entaled calling back and fourth to ensure that it arrived and re-sending. Email, on the other hand, always got through.
- Animats 8y agoYou can run inbound and outbound SMTP servers yourself, and send email with no forwarding. Nobody does this, but the protocols support it fine.
- zamfi 8y agoThe official protocols do support this, true, but nearly all of the major email service providers (e.g., Gmail, etc) will assume your email is spam if you send it from your own random mail server.
- Animats 8y agoThey're intermediaries. If you want to bypass intermediaries, to emulate a fax, it works fine.
- pasbesoin 8y agoThe last I knew, in the U.S. the fax still carried some legal recognition/privileges that email did not. For example, your doctor can fax a prescription to the pharmacist. Or a request for records to another doctor. A faxed copy of a signed contract carries some degree of official legal recognition/status (yeah, go figure). Bog standard email did/does not carry such authority. Maybe closed email interconnects now do. For example, I think our area health care networks (we have 3 big ones, here) now support email requests for some things requiring authorization. But those emails are within their private network, and on private links between their networks where they've agreed to interconnect on such things. Or they should be... Speaking more generally, I observe at least some doctors and offices emailing all sort of stuff on the public, general Internet, that should actually remain protected. (One of the reasons I expect the Internet to continue to be de facto locked down by authority (laws and rubber hoses, as opposed to technically complete "solutions"). People, including authority figures, insist upon using it as if it is secure. They have a lot of power, that will end up enforcing "security" through physical power against those who don't "obey the rules".)
- yjftsjthsd-h 8y agoI wonder if we could actually get gpg in use here; it's already a tightly regulated, controlled environment, so we might be able to push through actually standardizing on it, and being able to verify that something truly was signed by a doctor and then encrypt it in transit would be really useful.
- beojan 8y agoThe web of trust isn't really helpful here. Ideally we'd have government run certification authorities issuing official X.509 certificates to individuals and corporations.
- jessaustin 8y agoMaybe faxes have legal weight, but that's silly because they are easily spoofed. I agree that HIPAA violation via email is common.
- avip 8y agoFWIW the country I live in has a law that forces all public services to accept requests over email. Though the motivation was to stop the well known "send us a fax" customer abuse vector.
- rmetzler 8y agoGerman lawyers use fax, because the receipt shows the recipient has legally received the message. This is not the case with email. Therefor they created a different kind of electronic mail system (De-Mail [0]) they want people to subscribe to, so people can receive legally binding documents in an account they never look into. I don't have any numbers about monthly active users and other relevant KPIs, but I bet they are really low. [0]: https://en.wikipedia.org/wiki/De-Mail https://en.wikipedia.org/wiki/De-Mail
- giovannibajo1 8y agoItaly has been using this mess for more than ten years now: https://en.wikipedia.org/wiki/Certified_email https://en.wikipedia.org/wiki/Certified_email