3 ms·

There is a wider problem here - that Companies have almost no internal firewalls. Yes it's great that the CEO of company X can email a low level employee but t

There is a wider problem here - that Companies have almost no internal firewalls. Yes it's great that the CEO of company X can email a low level employee but then how do we know that is the CEO? Secure messaging, even the maligned GPG (see tptacek) would simply stop this attack (#). And stop most "cyber criminal" which appears to be mostly identify theft which ia another name for impersonation for fraudulent gain. We can't conduct all business activity over whatsapp or Signal or whisper. But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? Will that help ? will that be viable? I am fascinated because that was kinda the dream for past twenty years but it went nowhere - but maybe crime will provide the impetus (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind?

waihtis 3y ago
> no internal firewalls do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts. > But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? DMARC is fairly well adopted, of course it does nothing against using a typosquatted domain. > (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind? The clue is in your own text. This wouldn't have happened if they used 2FA.
- lifeisstillgood 3y ago
  "firewalls" between people / departments. There are billions sent daily on little more the "approved" in a reply all email. It's not the 2FA. a typo-squat would probably have worked, or just chnaging the email header. This is "just" social engineering / fraud as it has been for hundreds of years. We have the tools to prevent it. if not the processes and training - but do we have the incentive now?
- jstarfish 3y ago
  Every time our C-levels get implicated in this stuff, email is never the medium. It's always text messages. Which makes sense; they're way easier to spoof, especially if the initial recipient lacks authority to initiate bank transfers and forwards a screenshot of the forged message as "proof" to someone who does-- it launders all metadata from the message itself. Even the timestamp is lost. And it's all out of band and not subject to internal firewalling, DMARC, nothing. Never trust text messages (or screenshots of them) as evidence of anything.

waihtis 3y ago

> no internal firewalls do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts. > But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ? DMARC is fairly well adopted, of course it does nothing against using a typosquatted domain. > (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind? The clue is in your own text. This wouldn't have happened if they used 2FA.

lifeisstillgood 3y ago
"firewalls" between people / departments. There are billions sent daily on little more the "approved" in a reply all email. It's not the 2FA. a typo-squat would probably have worked, or just chnaging the email header. This is "just" social engineering / fraud as it has been for hundreds of years. We have the tools to prevent it. if not the processes and training - but do we have the incentive now?
jstarfish 3y ago
Every time our C-levels get implicated in this stuff, email is never the medium. It's always text messages. Which makes sense; they're way easier to spoof, especially if the initial recipient lacks authority to initiate bank transfers and forwards a screenshot of the forged message as "proof" to someone who does-- it launders all metadata from the message itself. Even the timestamp is lost. And it's all out of band and not subject to internal firewalling, DMARC, nothing. Never trust text messages (or screenshots of them) as evidence of anything.