3 ms·
There is one rather ugly privacy threat that I seldom see discussed even on HN. The spam fighting services. First of all, I'm not sure whether they are being r
by jakobdabo 6y ago
There is one rather ugly privacy threat that I seldom see discussed even on HN.
The spam fighting services. First of all, I'm not sure whether they are being run locally on the mail servers or maybe the mail servers forward our emails body to a third party anti-spam service to get a "spam score".
And secondly, after being assigned a "spam score" a part of your email may end up in the headers as "X-something" where the anti-spam service describes why it didn't like your email. And we know that many 3-letter agencies collect as much email metadata (e.g. headers) as they can sniff out. So, you should know that the first X bytes of your unencrypted emails are less private than the remaining part, because they can be part of the metadata.
- arghwhat 6y agoSpam detection is run locally on the receiving mail server, and adds the result information to the email as the "X-something" header fields you are referring to as part of the receive pipeline. See e.g. rspamd. Should you forward the email with these header fields intact, then all it does is reveal a bit about your mail providers' infrastructure, which is already entirely public information.
- jakobdabo 6y agoI've seen small parts of my email body in the "X-something" headers inserted there by the anti-spam service. I can try to find an example later when I get to my desktop.
- arghwhat 6y agoI don't have memory of such behavior, but even then, this is in your receive pipeline, reading plain-text, publicly readable email meant for you and appending something to its plain-text, publicly readable header meant for you, all in order for the server to present this information to you/your mail agent. I don't see why any of this would lead to any amount of concern, but feel free to present the header field you refer to.