3 ms·

I understand that. But I also said that I don't think encrypting the message has much of a benefit. I can't imagine many scenarios where a compromised email add

I understand that. But I also said that I don't think encrypting the message has much of a benefit. I can't imagine many scenarios where a compromised email address would be less of a threat then reading the messages sent to that account.

franga2000 3y ago
A security researcher finds a server-side RCE vulnerability and discloses it to security@bigcorp.net. An attacker breaks into security@bigcorp.net because the password was the IT director's dog's name. Don't you think being able to read that disclosure would give the attacker a bit more access to bigcorp's systems than if it was encrypted?
- blacksmith_tb 3y ago
  When the attacker already has the credentials of the IT Director? I doubt they will be too interested in bug reports, somehow...
  - franga2000 3y ago
    You must be joking! Do you store all your SSH keys in your email? Do IT directors in big companies even have shell access to production servers? Even if, that would show in the audit logs, whereas an RCE is less likely to. And what if the bug is client-side??
    - ZeroSolstice 3y ago
      They wouldn't have to have access or SSH keys. The position is usually at a level where people don't question requests or have a heightened guard with emails. It wouldn't be difficult to pivot to requesting an account made for some project or including an attachment that compromises a device which you have phone home. This is shown a number of times publicly with phishing emails that lead to breaches, gift cards scams and wire fraud. In your proposed situation having access to the director of IT's email account is similar to physical access on a server. The RCE might be another layer of access but its not game changing to what is already available.