6 ms·

> 'service@paypal.co.uk' via redacted <redacted> It looks to me that Paypal is not sending the emails in a secure and verifiable method. Emails that are sent f

> 'service@paypal.co.uk' via redacted <redacted> It looks to me that Paypal is not sending the emails in a secure and verifiable method. Emails that are sent from a domain that's different than the from address are legitimately suspicious, especially when they contain financial keywords. https://support.google.com/mail/answer/1311182?hl=en https://support.google.com/mail/answer/1311182?hl=en

WorldMaker 8y ago
Also maybe Paypal should consider to stop sending "credit approval" spam from the same addresses.
ASalazarMX 8y ago
Also, every website asks you to check the spam folder if the verification mail hasn't shown after a couple of minutes, it's not like you lost it forever.
- nh2 8y ago
  > every website asks you to check the spam folder if the verification mail This is not a registration email that you expect to receive after clicking somewhere on a website. This is the kind of email that says "something important happened to your account you may not be aware of, you should really know this; if it wasn't you, you are now in danger". (Of course in this case it was me, but the whole purpose of this type of email is to alert you promptly in case it wasn't you.)
  - ASalazarMX 8y ago
    Does it make sense to send such vital notifications via a channel that can silently hide them? This is ideal for mobile push notifications, and if you want reliable notifications, you should install the PayPal app.
- stordoff 8y ago
  An unsolicited email is not going to get noticed in the hundreds of spam emails I get on a weekly basis (currently 189 since February 3).
deleted 8y ago
[deleted]
dwringer 8y ago
I'd really like to see a customizable threshhold on what is and isn't spam. I've noticed a lot of mailing lists and things I did sign up for getting passed to junk, though periodically I try to mark them as "not spam" presumably enough other people mark similar messages as spam that my suggestions are overridden when new messages arrive. Something as simple as a slider to control how zealously the filter culls messages from the inbox might go a long way to making users feel more in control of the situation (whether such a control could be effective enough not to annoy users and have a real effect on the false positive rate is another question, so I admit there's no easy answer).
- hsk0823 8y ago
  Never gonna happen, the big G knows the best for all. Even G Suite business users have to deal with the lack of controls here, even if we whitelist our own domain, things can get flagged by the larger Gmail spam filters that G Suite users are still subject to.
- fiddlerwoaroof 8y ago
  I discovered that you can make a filter that marks email as not spam. I use this to mark some logs I get from logwatch as legit.
nh2 8y ago
Your link explains there are two cases in which Gmail shows e.g. > 'service@paypal.co.uk' via Paypal-Admins <paypal-admins@company.example.com> namely: > 1) The domain it was sent from doesn't match the domain in the "From:" address' > 2) The email was sent to a Google Group from a domain that has a "p=reject or p=quarantine" DMARC policy In my case, it's (2): The target email is a Google Group email (e.g. paypal-admins@company.example.com). Should that make the email more spammy though?
bad_user 8y ago
> “Emails that are sent from a domain that's different than the from address are legitimately suspicious” That’s not how this works. The “from” email header has nothing to do with the actual sender due to the email standard. The actual sender is specified in the SMTP command. This is why SPF and DKIM for example have nothing to do with “from” either. SPF refers to the sender in the SMTP command and DKIM signing can use the keys of a domain unrelated to “from” and it’s all legal. It’s very easy actually to spoof the “From” header and Gmail won’t complain. That “via” information you’re seeing is just another header that doesn’t have much to do with Gmail. If you’re seeing it, that’s because the sender wants you to see it.
- admax88q 8y ago
  Nobody said it wasn't legal according to specs, but that it's suspicious. And it is. Having a "From" header in the email that doesn't match the sender used for SMTP _is_ suspicious, and certainly should be an input signal for any spam filter.
  - megous 8y ago
    Not suspicious at all. It's how mailing lists work. From on the envelope will be address of the mailing list, and from in the headers will be the original sender. Perfectly legitimate and extremely annoying if anythig uses this as a SPAM signal.
    - kelnos 8y ago
      Not suspicious for a mailing list, sure. But definitely suspicious for a security-related email from what is essentially a bank.
      - megous 8y ago
        Why? They simply want bounces delivered to a differnt address than the real replies from customers. Seems reasonable if it's a from address used for a mass/automated mailing. (it is)
cm2187 8y ago
I recently received an email claiming to be from paypal (the SPF+DKIM passed) but inviting me to click on links in "epl.paypal-communication.com". How do I know this is not phishing? It certainly looks like phishing, and I certainly wouldn't click on those. But if it is not, how stupid must these guys be to use "paypal-communication.com"?
- deleted 8y ago
  [deleted]
- bduerst 8y ago
  Whois says it's owned by Paypal on MarkMonitor, but that can be faked, right? Or does MarkMonitor require email address validation? (hostmaster@paypal.com in this case)
  - cm2187 8y ago
    Correct. But even if the whois wasn't fakeable, do I really need to run a whois before I click on a link in an email?
    - bduerst 8y ago
      Almost like we need an ssl-like authority for email now. Ugh.
  - jakejarvis 8y ago
    MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.
- TheRealPomax 8y ago
  you forward it to spoof@paypal.com, and then get a response pretty quickly telling you whether it was phishing or a real email.

WorldMaker 8y ago

Also maybe Paypal should consider to stop sending "credit approval" spam from the same addresses.

ASalazarMX 8y ago

Also, every website asks you to check the spam folder if the verification mail hasn't shown after a couple of minutes, it's not like you lost it forever.

nh2 8y ago
> every website asks you to check the spam folder if the verification mail This is not a registration email that you expect to receive after clicking somewhere on a website. This is the kind of email that says "something important happened to your account you may not be aware of, you should really know this; if it wasn't you, you are now in danger". (Of course in this case it was me, but the whole purpose of this type of email is to alert you promptly in case it wasn't you.)
- ASalazarMX 8y ago
  Does it make sense to send such vital notifications via a channel that can silently hide them? This is ideal for mobile push notifications, and if you want reliable notifications, you should install the PayPal app.
stordoff 8y ago
An unsolicited email is not going to get noticed in the hundreds of spam emails I get on a weekly basis (currently 189 since February 3).

deleted 8y ago

[deleted]

dwringer 8y ago

I'd really like to see a customizable threshhold on what is and isn't spam. I've noticed a lot of mailing lists and things I did sign up for getting passed to junk, though periodically I try to mark them as "not spam" presumably enough other people mark similar messages as spam that my suggestions are overridden when new messages arrive. Something as simple as a slider to control how zealously the filter culls messages from the inbox might go a long way to making users feel more in control of the situation (whether such a control could be effective enough not to annoy users and have a real effect on the false positive rate is another question, so I admit there's no easy answer).

hsk0823 8y ago
Never gonna happen, the big G knows the best for all. Even G Suite business users have to deal with the lack of controls here, even if we whitelist our own domain, things can get flagged by the larger Gmail spam filters that G Suite users are still subject to.
fiddlerwoaroof 8y ago
I discovered that you can make a filter that marks email as not spam. I use this to mark some logs I get from logwatch as legit.

nh2 8y ago

Your link explains there are two cases in which Gmail shows e.g. > 'service@paypal.co.uk' via Paypal-Admins <paypal-admins@company.example.com> namely: > 1) The domain it was sent from doesn't match the domain in the "From:" address' > 2) The email was sent to a Google Group from a domain that has a "p=reject or p=quarantine" DMARC policy In my case, it's (2): The target email is a Google Group email (e.g. paypal-admins@company.example.com). Should that make the email more spammy though?

bad_user 8y ago

> “Emails that are sent from a domain that's different than the from address are legitimately suspicious” That’s not how this works. The “from” email header has nothing to do with the actual sender due to the email standard. The actual sender is specified in the SMTP command. This is why SPF and DKIM for example have nothing to do with “from” either. SPF refers to the sender in the SMTP command and DKIM signing can use the keys of a domain unrelated to “from” and it’s all legal. It’s very easy actually to spoof the “From” header and Gmail won’t complain. That “via” information you’re seeing is just another header that doesn’t have much to do with Gmail. If you’re seeing it, that’s because the sender wants you to see it.

admax88q 8y ago
Nobody said it wasn't legal according to specs, but that it's suspicious. And it is. Having a "From" header in the email that doesn't match the sender used for SMTP _is_ suspicious, and certainly should be an input signal for any spam filter.
- megous 8y ago
  Not suspicious at all. It's how mailing lists work. From on the envelope will be address of the mailing list, and from in the headers will be the original sender. Perfectly legitimate and extremely annoying if anythig uses this as a SPAM signal.
  - kelnos 8y ago
    Not suspicious for a mailing list, sure. But definitely suspicious for a security-related email from what is essentially a bank.
    - megous 8y ago
      Why? They simply want bounces delivered to a differnt address than the real replies from customers. Seems reasonable if it's a from address used for a mass/automated mailing. (it is)

cm2187 8y ago

I recently received an email claiming to be from paypal (the SPF+DKIM passed) but inviting me to click on links in "epl.paypal-communication.com". How do I know this is not phishing? It certainly looks like phishing, and I certainly wouldn't click on those. But if it is not, how stupid must these guys be to use "paypal-communication.com"?

deleted 8y ago
[deleted]
bduerst 8y ago
Whois says it's owned by Paypal on MarkMonitor, but that can be faked, right? Or does MarkMonitor require email address validation? (hostmaster@paypal.com in this case)
- cm2187 8y ago
  Correct. But even if the whois wasn't fakeable, do I really need to run a whois before I click on a link in an email?
  - bduerst 8y ago
    Almost like we need an ssl-like authority for email now. Ugh.
- jakejarvis 8y ago
  MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.
TheRealPomax 8y ago
you forward it to spoof@paypal.com, and then get a response pretty quickly telling you whether it was phishing or a real email.