4 ms·

You can do the same thing with Fastmail. Completely indistinguishable from a legitimate email - all signatures look exactly the same. Any user can impersonate a

You can do the same thing with Fastmail. Completely indistinguishable from a legitimate email - all signatures look exactly the same. Any user can impersonate any other user. Not considered a vulnerability. What's especially frustrating is that Fastmail have a special opaque sender header that only they can interpret, and they put a little "verified" icon on email that actually comes from them. So it's a vulnerability if I impersonate them, but not any other Fastmail user. Sigh. I'm a happy FM user, apart from that. But I'm going to keep bringing it up until they do something about it. At least let me blacklist my domain from being used by other accounts jfc.

Polylactic_acid 6y ago
Email is an absolute disaster for security and privacy. Its a shame we will never see a real alternative because the age of open and decentralized standards is over. Matrix shows hope but I doubt it will come anywhere close to the popularity of email and SMS
- aaomidi 6y ago
  Meh, we've continuously built stuff on top of older protocols and have made them very usable. It seems shortsighted to say email as a whole is a disaster for security and privacy.
- swiley 6y ago
  So was the web until ~ a decade ago. (Well, parts of it still are a disaster but it’s getting better every year provided you’re not running chrome.)
paranoidrobot 6y ago
Have you got a thread/ticket number or something so that I, and other Fastmail users, can put our names behind "Please fix this"?
- deleted 6y ago
  [deleted]
nmjenkins 6y ago
This is not true for custom domains for some time. The DKIM signature is only added for users in the account that has the domain, and similarly mail is sent via different outbound servers that are not included in our recommended SPF record if another a user outside of this account tries to send mail from that domain. For Fastmail domains the situation is more complicated for historical reasons (we've been around over 20 years and customers have set up workflows that we need to transition) but we are working on it.
- regecks 6y ago
  Thank you! How recently was this change made? I could still do it in 2018, but I wasn't able to do it just now. As you say, no signature on the message, which makes my DMARC record do something useful. That's really great, a huge relief. (Wish I could modify my original post now).

Polylactic_acid 6y ago

Email is an absolute disaster for security and privacy. Its a shame we will never see a real alternative because the age of open and decentralized standards is over. Matrix shows hope but I doubt it will come anywhere close to the popularity of email and SMS

aaomidi 6y ago
Meh, we've continuously built stuff on top of older protocols and have made them very usable. It seems shortsighted to say email as a whole is a disaster for security and privacy.
swiley 6y ago
So was the web until ~ a decade ago. (Well, parts of it still are a disaster but it’s getting better every year provided you’re not running chrome.)

paranoidrobot 6y ago

Have you got a thread/ticket number or something so that I, and other Fastmail users, can put our names behind "Please fix this"?

deleted 6y ago
[deleted]

nmjenkins 6y ago

This is not true for custom domains for some time. The DKIM signature is only added for users in the account that has the domain, and similarly mail is sent via different outbound servers that are not included in our recommended SPF record if another a user outside of this account tries to send mail from that domain. For Fastmail domains the situation is more complicated for historical reasons (we've been around over 20 years and customers have set up workflows that we need to transition) but we are working on it.

regecks 6y ago
Thank you! How recently was this change made? I could still do it in 2018, but I wasn't able to do it just now. As you say, no signature on the message, which makes my DMARC record do something useful. That's really great, a huge relief. (Wish I could modify my original post now).