5 ms·
The same privacy preserving features of Tutanota enjoyed by privacy conscious individuals, make it ideal for fraudsters. We experience a large number of fraudu
by schappim 4y ago
The same privacy preserving features of Tutanota enjoyed by privacy conscious individuals, make it ideal for fraudsters.
We experience a large number of fraudulent ecommerce orders using Tutanota email domains. I'm not shocked to think that this could be an example of an algorithm gone awry based on the signals it received.
- Raed667 4y agoIt is not the job of an ISP to decide what is fraudulent and what is not. They should be a dumb pipe between services and people.
- masklinn 4y agoThat is not really true, ISPs are relied on by non-technical customers who have neither the personal chops nor a 24/7 technical assistant to help them. Whether ISPs succeed in any way is an entirely different ballgame, but this is absolutely the job of the ISP, especially in their role of email provider. Its ability to properly discriminate and aggressively block or plonk messages isvery much one of the reasons people like gmail.
- throwaway0x7E6 4y agoyes comrade, lets confine everyone to a handful of party-approved websites, for their own good.
- robertlagrant 4y ago> Whether ISPs succeed in any way is an entirely different ballgame, but this is absolutely the job of the ISP, especially in their role of email provider. They aren't providing email in this example, as far as I can tell. They're providing internet access to an email service. Or they should be.
- psychphysic 4y agoThat's not how the UK works. We invented the nanny state.
- EdwardDiego 4y agoAnd the nanny fetish, although that seems to be rather particular to a certain class of people in the UK. That said, full credit on the nanny dog, Staffordshire bull terriers are amazing with children.
- geraldwhen 4y agoThey’re certainly good at silencing children permanently.
- kitd 4y agoNot Staffs. You may be thinking of pitbulls.
- EdwardDiego 4y agoBe sure to distinguish the English staffies from the American staffies. Very different dogs.
- callahad 4y agoIt shouldn't be the role of the ISP, but in the UK content blocking is legally mandated. E.g., "The Digital Economy Act 2017 placed the requirement for ISP filtering into law and introduced a requirement for ISPs to block pornographic sites with inadequate age verification." https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin...
- Eleison23 4y ago
- that_guy_iain 4y agoPorn and fraud are two very different things.
- IshKebab 4y agoYeah I'm not sure how much ISPs still bother with that. Up until a year or so ago my ISP was pretty good at blocking torrent sites but now I can visit e.g. 1337x.to with no problems. I think this is talking about 3's adult content filter which is different and has existed for ages and has always been shit (I assume most people disable it).
- lost_tourist 4y agoYeah but email is a service completely unrelated to porn.
- roenxi 4y agoHow can an ISP be sure an end-to-end encrypted communication channel isn't being used for porn? It is encrypted. By design they have no idea what it is being used for. It would be very easy to set up a ring of pornography distributors using email (at least in the UK, in civilised countries they'd probably be put out of business by the open internet).
- Nextgrid 4y ago
- hrrsn 4y agoFraudulent ecommerce orders are the only time I've seen tutanota addresses in the wild.
- nonrandomstring 4y agoI have two colleagues who regularly send me emails from that domain. For the first , I assumed it was her own domain. When I saw messages from a second person I assumed they might both work for the same company. Now I figured it's an ISP. I checked it out and it looks like a good, legit service for people who don't want creeps and advertisers grubbing through their messages. Three UK have no place blocking traffic from legitimate users and must identify problematic use on a per case basis. Modern legal systems usually limit criminal liability to individuals [1]. Companies engaging in acts of collective punishment (That goes for you too Cloudflare) should at least try to raise their ethical standards to those expected by International Law. https://en.wikipedia.org/wiki/Collective_punishment https://en.wikipedia.org/wiki/Collective_punishment
- masklinn 4y ago> Now I figured it's an ISP. It's not an ISP, it's an email provider. > Modern legal systems usually limit criminal liability to individuals [1]. Companies engaging in acts of collective punishment (That goes for you too Cloudflare) should at least try to raise their ethical standards to those expected by International Law. There is no "criminal liability", and blocking malfeasants on the internet has always been a heuristic fight. If a service originates an extremely high rate of fraud versus legitimate uses, it's a good heuristic for fraud. It's a shame for legitimate users, but it's also how it's always worked. And more generally minor (or self-hosted) MTA have always had that issue, it's not news that they get delivered less reliably than big "trusted" mail hosts, and that they can get blacklisted real fast.
- schappim 4y agoTotally, especially that CloudFlare wall of harrassment... It is a form of harassment, and it needs to be recognised as such!
- agumonkey 4y agoIt's strange how cryptography, in mail or 'coins' is always leading to the same dilemma.
- nicce 4y agoEcommerce service itself should be using Tutanota if fraudsters want the most privacy benefits. If not, Tutanota is like any other email provider, possibly with better privacy policy.
- infinitedata 4y agoI’m sure there are the same or more number of fraudulent cases coming from gmail accounts but they don’t block that one
- jamespo 4y agoAs a proportion of total email volume for each service?
- masklinn 4y agoThe question is one of ratio, and false positives versus false negatives. If 90% of tutanota-orginated emails are fraudulent, tutanota is an excellent fraud indicator, even though it will block legitimate emails. If 10% of gmail-originated emails are fraudulent, gmail is a terrible fraud indicator, even though it will let fraudulent emails pass through, possibly more than the count of fraudulent emails coming from tutanota.
- newaccount74 4y agoBut if you block Tutanota the fraudsters will just switch to Gmail, and all you accomplished is that you inconvenienced legit Tutanota users. I wonder why so many companies drag their feet when implementing actually useful anti-fraud measures (like supporting Verified-by-Visa) and instead block random email providers.
- schappim 4y ago> drag their feet when implementing actually useful anti-fraud measures (like supporting Verified-by-Visa) Most ecommerce merchants are non-technical, and utilise 3rd party platforms (Shopify, Bigcommerce etc) that in combination with their Payment Gateway don't support these systems. I can safely say that every order my business has received with a Tutanota address has turned out to be fraud. It is a really strong indicator for a fraudulent transaction. There are many other signals, but for some reason this is a really strong one. We see a similar trend with Aleeas, and Simplelogin. We still get fraud from Gmail and Outlook addresses, but it is picked up using other indicators, IP, IP owner, Shipping Address, phone number reachability, carrier, Payment Methods, name, useragent, "for lease" or "for sale" status of the delivery address etc etc...
- schipplock 4y agoYou can register an account for free. You don't need to provide anything when registering an account, just choose an E-Mail and a password. Is that what you mean with "privacy preserving"?