3 ms·
JavaScript, embedded, in email is, pejoratively, a bad idea by putting too much power into a transmitted email. Too many security holes, discovered and undisco
by egberts1 4y ago
JavaScript, embedded, in email is, pejoratively, a bad idea by putting too much power into a transmitted email.
Too many security holes, discovered and undiscovered with JavaScript, not to mention JMTP.
Better yet,
Hashing the local part of the email address and retrofitting mail clients to do the mapping and rejection is the best way to delete unwanted and unsolicited emails.
Couple that with new decentralized lookup of sender’s PKI (as well as DKIM).
That should add years/decades to SMTP viability and usability.
- hulitu 4y ago> JavaScript, embedded, in email is, pejoratively, a bad idea by putting too much power into a transmitted email The exploits writers would like to politely disagree. /s
- trevoristall 4y agoI was under the impression JMAP was just a sync protocol and had nothing to do with js in email. Is that incorrect?
- Flimm 4y agoJMAP is not JavaScript embedded in email. Are you thinking of something else?
- egberts1 4y agoBut it does nothing to prevent JS in its payload.
- Beltalowda 4y agoI can also put JavaScript in a DNS TXT record; the protocol does nothing to stop that! There is no "JavaScript" in JMAP in the sense that it's supported by the protocol, and the specification explicitly warns against email clients interpreting JavaScript.
- egberts1 4y agoNow you are getting the idea of how to design a new network protocol in contrast to adding the supporting numbers of parsers and validators. Potential and actual vulnerabilities explodes, like the chronic problems of Microsoft Macros.
- windows_sucks 4y agothe client should be responsible for not executing embedded JS in a message
- sleepybrett 4y agosure, but that's not a feature a protocol should have. Because the protocol itself does not interact with it in any way. It's clients that process that javascript and execute it. The protocol is about moving 'emails' from one place to another. If you don't want javascript in your email and run your own email stack you can certainly filter out javascript blobs if you want. Or you can chose clients that disable or simply don't even know what javascript is.
- egberts1 4y agoWhile it is a bit late to close the door on JS usage within SMTP protocol, choices of client SMTP becomes paramount given its legacy stage of SMTP protocol.
- sleepybrett 4y agoagain, the protocol should be dumb, its a way to move bytes. If there is js encoded in those bytes the rotocol will not and should not know or care. It's up to a client do decide what it wants to do with the bytes it receives.
- hsbauauvhabzb 4y agoYou cannot read this email until you disable your adblocker.