5 ms·
>HTML as a vector for phishing I would disagree, You can make Text-only links look fairly harmless too. The issue is more often that people do not look at all,
by zaarn 7y ago
>HTML as a vector for phishing
I would disagree, You can make Text-only links look fairly harmless too. The issue is more often that people do not look at all, even in text-mail, what the link points to, not that they can't see it (plus you can hover and the browser still shows the URL once you open it)
>Privacy invasion and tracking
Only if you use an ancient and outdated client that doesn't block external resources by default or proxies them over another server.
>Mail client vulnerabilities
Only an issue if the client rolls their own HTML renderer. Outlook uses the IE Trident Engine, Thunderbird uses Firefox' engine, Gmail transforms using the Chromium engine internally. That means the email client is usually as secure as the respective browser, unless you use a mail client that rolls their own engine.
>HTML emails are less accessible
Possibly, depends on the sender. You can make them more accessible than Text though because you can prevent the screenreader from trying to read out the link or irrelevant information.
>Some clients can't display HTML emails at all
Most mail clients will usually bundle a text-version of the mail, some MTAs also do this on their own. Doesn't really matter in practise since 99.99% of people use a mail client that can display HTML.
It feels a bit like complaining that people on the highway drive so fast that you can't properly merge into the rightmost lane with your oldtimer car.
>Rich text isn't that great, anyway
And tbh, this last one basically seals it; this is a website made to rant from the personal perspective of someone who blocks mails containing any HTML from their services and has quite the history of throwing people using their lib under the bus over personal preferences.
I don't see how any of this is relevant when even the site itself admits that using a multipart mail with both text and HTML is sufficient, why should I even begin to send plaintext instead of doing that?
Unless your mailclient is garbage, it handles multipart and will understand the mail.
- e12e 7y ago>> Some clients can't display HTML emails at all > Most mail clients will usually bundle a text-version of the mail, some MTAs also do this on their own. This assumes there is a proper text part (one that actually includes the content of the mail body).
- naikrovek 7y agoThat does not seem like much of an assumption; all modern mail clients that I am aware of do this.
- cyphar 7y agoThe problem isn't the clients, it's the senders. And as someone who uses Mutt, the vast majority of HTML emails don't have usable plaintext versions.
- naikrovek 7y agoWhat kind of mail client doesn't send mail? I am talking about someone using a mail client to draft and send an email.
- cyphar 7y agoSorry, I realised that's what you were talking about after the edit window closed. Though, a lot of mail is sent by mailing services not individual clients (and all the awful ones really don't like sending useful plaintext mail).
- zaarn 7y agoUnless you violate accessibility laws or your email client is shit, there is a text part or the HTML part is screen-reader compatible.
- mlang23 7y agoHowever, a significant portion of HTML mail I receive happily violates "accessibility laws" and omit to provide a text-only part. I know that, since I actually rely on accessibility to do my daily work.
- zaarn 7y agoScreen readers should be able to deal with HTML-only mails for the most part, otherwise you should send the sender of that mail a reminder about those laws.
- erk__ 7y agoDoes outlook not use microsoft word as the html render now?
- dpau 7y agoOne reason I would add is archiving. Having managed some large, archived mailing lists, one of the headaches is dealing with formatted text. Even plaintext can be a pain in this regard (differences between email chain formatting, fixed-width lengths, etc.). HTML is even more troublesome...
- u801e 7y ago> You can make Text-only links look fairly harmless too. Could you give an example? As far as I know, you cannot do something like making a link look like it belongs to a completely different domain.
- zaarn 7y agoExamples from what I've seen: https://account:paypal.com.login@verified-account.com/phish This, to the untrained eye, might at first glance look like a paypal.com link. In fact, it belongs to verified-account.com and it abuses the capability of URLs to contain a username and password to make it look legit.
- zepolen 7y agoDon't even need that account: at start, this works in chrome: https://www.paypal.com@google.com https://www.paypal.com@google.com
- b3n 7y agoIn Firefox it tells me: You are about to log in to the site “google.com” with the username “www%2Epaypal%2Ecom”, but the website does not require authentication. This may be an attempt to trick you. Is “google.com” the site you want to visit?
- deftnerd 7y agoGold star for Firefox! That's an excellent feature.
- jefftk 7y agoFrom the error message it sounds like if this was an attacker controlled site configured to require authentication it wouldn't trigger? If so it's not that useful a defense since whether to require auth is entirely under the attacker's control.
- jeroenhd 7y ago
- Sir_Cmpwn 7y agoI'll address more of your comment later, but for now let's start here: >Only an issue if the client rolls their own HTML renderer. Outlook uses the IE Trident Engine, Thunderbird uses Firefox' engine, Gmail transforms using the Chromium engine internally. That means the email client is usually as secure as the respective browser, unless you use a mail client that rolls their own engine. This is not true. You can't just drop a modern web browser into an email client and have it magically be secure - if you do, your client will be broken and insecure. A huge number of browser features have to be removed - loading external images, stylesheets. scripts, images in stylesheets (except datas URLs, so add a special codepath for that). Things like animations aren't desirable, nor forms, etc. The list of things you have to turn off is huge and getting longer with each browser release. And you had better keep up with those releases, as each one fixes a half dozen security bugs which are inevitable in a technology whose specification alone is a million lines.
- zaarn 7y agoThat stuff is actually not that hard, mozilla's engine has compile flags for that stuff and the patches you have to make are minimal. There are a few methods for runtime restrictions too, they're quite extensive in their capabilities and sufficient for sandboxing a mail.
- Sir_Cmpwn 7y agoMozilla's engine is a giant multi-million lines-of-code ball of C++ and Rust and JavaScript weighing in at nearly 200 MiB - not including dependencies. And what if I don't want to support the browser monoculture? Implementing a new one is a daunting task (nigh impossible), but rendering plaintext is easy peasy. Mutt is 1 megabyte.
- yyyk 7y agoHTML email in practice doesn't need much more than what w3m supports, in some places less - no need for w3m's frame, cookie, or FTP support. w3m is smaller than mutt. Limiting HTML mail to an agreed subset could actually be a winnable fight compared to more impractical suggestions.
- snowwrestler 7y agoIn terms of phishing, plain text emails can still carry malicious attachments, which can be very dangerous. Plain text does not prevent phishing!
- zaarn 7y agoYour paypal account was deactivated, please visit https://www.paypal.com@google.com to reactivate it. Looks phishy, no?
- Sir_Cmpwn 7y agoFinally back at a computer, can reply to this in full now: >I would disagree, You can make Text-only links look fairly harmless too. The issue is more often that people do not look at all, even in text-mail, what the link points to, not that they can't see it (plus you can hover and the browser still shows the URL once you open it) It would be difficult to argue that it's not at least more difficult to phish people with plain text. >Only if you use an ancient and outdated client that doesn't block external resources by default or proxies them over another server. This works until you click any link in the typical marketing email, or click "show images" to make the email readable. Remember that you have to train these careful behaviors into non-technical end-users. >You can make them more accessible than Text though because you can prevent the screenreader from trying to read out the link or irrelevant information This only sounds useful for spam or marketing emails (which are the same thing 99 times out of 100). >It feels a bit like complaining that people on the highway drive so fast that you can't properly merge into the rightmost lane with your oldtimer car. This is an uncharitable interpretation. We don't use these email clients because we're old fogeys, but because they're better and more efficient for our workflow and needs.
- esoterica 7y agoFor the vast majority of people html formatting is better and more efficient for their communication needs. Bold and highlighted text, section headers, tables and inline images are all very very standard and useful things to have in emails. These are not niche use cases.
- Sir_Cmpwn 7y agoI have never seen an email with a table in it, HTML or not. Inline images are not useful, just attach them. Leave your giant signature with your company logo at the door. What's left is section headers and bold text. Use asterisks for emphasis and # for section headers and you can communicate quite effectively. We seem to manage pretty well here on Hacker News without most of these features, wouldn't you say?
- hyperpape 7y ago