3 ms·

There is nothing secure about email. It's less secure than Telnet. You can email anyone on the internet as anyone and it will be delivered with NO validation.

There is nothing secure about email. It's less secure than Telnet. You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets.

gruez 5y ago
>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Security_extensions https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. That might be true for some systems, but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all.
- josephg 5y ago
  > but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. Then they forged emails from her email address, with a gmail address set up in the reply-to field. The emails all said it was an emergency, and asked for her colleages to transfer money. As far as we can tell, most of the emails were delivered and lots of people were fooled - at least for awhile. Her email address has DKIM and SPF set up, but (like most email providers) it has a lax DMARC policy. It turns out thats all it takes to be vulnerable to this sort of attack.
  - tekknik 5y ago
    The NGO could also force people to sign their emails. Refuse it from the SMTP if it’s not.
    - josephg 5y ago
      Are you being serious right now? You understand that that'll never happen in our current technology landscape, right? Outside of a few niche hardcore technologists, nobody knows what PGP is or how to use it. It would be hard enough getting my mum set up to PGP sign her own emails in Outlook, on the desktop and from her phone. (Is that even possible?). Let alone require anyone emailing her PGP sign their email too? Thats never going to happen for so many reasons, both technical and social. I'm a software engineer and I tried setting up PGP years ago in thunderbird and it only worked for a few weeks, then it somehow broke. And then later I lost my PGP key. Oh, and then I started using webmail and PGP didn't work there at all. And then later still I realised my public PGP key (signed by my web of trust) leaked details on the identity of my social network; which bothers me a lot more than any problems I've personally ever had with a forged identity. PGP is dead. Let it go.
      - tekknik 5y ago
        This is just incorrect. Amazon for instance does this.
- justsomehnguy 5y ago
  > That's obviously false if you bothered to do a bit of searching Technically correct, best kind of correct. Sure, it is not plaintext, but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years, but I never seen someone not accepting a connection with a self-issued certificate and any warnings (to the end user) if the receiver uses self-issued cert. Which makes the whole point quite moot.
  - gruez 5y ago
    >but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years The section on MTA-STS describes how that attack is mitigated.
    - justsomehnguy 5y ago
      > mitigated For this attack to be mitigated everyone should implement it. Gmail and Live.com has MTA-STS records, Fastmail doesn't, one regional provider with millions of accounts doesn't have it too. And finally your MTA should support it and be configured to deny the delivery if MTA-STS validation fails (and adversary, who is happily MITMing your traffic, shouldn't fiddle with DNS and HTTPS and of course blocking HTTP/S from the MX would be considered cheating!). All in all, SMTP traffic is encrypted, but it is not secured.

gruez 5y ago

>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Security_extensions https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. That might be true for some systems, but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all.

josephg 5y ago
> but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. Then they forged emails from her email address, with a gmail address set up in the reply-to field. The emails all said it was an emergency, and asked for her colleages to transfer money. As far as we can tell, most of the emails were delivered and lots of people were fooled - at least for awhile. Her email address has DKIM and SPF set up, but (like most email providers) it has a lax DMARC policy. It turns out thats all it takes to be vulnerable to this sort of attack.
- tekknik 5y ago
  The NGO could also force people to sign their emails. Refuse it from the SMTP if it’s not.
  - josephg 5y ago
    Are you being serious right now? You understand that that'll never happen in our current technology landscape, right? Outside of a few niche hardcore technologists, nobody knows what PGP is or how to use it. It would be hard enough getting my mum set up to PGP sign her own emails in Outlook, on the desktop and from her phone. (Is that even possible?). Let alone require anyone emailing her PGP sign their email too? Thats never going to happen for so many reasons, both technical and social. I'm a software engineer and I tried setting up PGP years ago in thunderbird and it only worked for a few weeks, then it somehow broke. And then later I lost my PGP key. Oh, and then I started using webmail and PGP didn't work there at all. And then later still I realised my public PGP key (signed by my web of trust) leaked details on the identity of my social network; which bothers me a lot more than any problems I've personally ever had with a forged identity. PGP is dead. Let it go.
    - tekknik 5y ago
      This is just incorrect. Amazon for instance does this.
justsomehnguy 5y ago
> That's obviously false if you bothered to do a bit of searching Technically correct, best kind of correct. Sure, it is not plaintext, but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years, but I never seen someone not accepting a connection with a self-issued certificate and any warnings (to the end user) if the receiver uses self-issued cert. Which makes the whole point quite moot.
- gruez 5y ago
  >but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years The section on MTA-STS describes how that attack is mitigated.
  - justsomehnguy 5y ago
    > mitigated For this attack to be mitigated everyone should implement it. Gmail and Live.com has MTA-STS records, Fastmail doesn't, one regional provider with millions of accounts doesn't have it too. And finally your MTA should support it and be configured to deny the delivery if MTA-STS validation fails (and adversary, who is happily MITMing your traffic, shouldn't fiddle with DNS and HTTPS and of course blocking HTTP/S from the MX would be considered cheating!). All in all, SMTP traffic is encrypted, but it is not secured.