4 ms·
> no internal firewalls do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts. > But we probably ca
by waihtis 3y ago
> no internal firewalls
do you mean this in the metaphorical sense? an internal firewall has little effect on compromised email accounts.
> But we probably cannot make email (more) secure? Can we create standard business messages that can be sent and revived by anyone and signed ?
DMARC is fairly well adopted, of course it does nothing against using a typosquatted domain.
> (#) a non technical friend lost thousands of pounds because their small compmay used non 2FA Gmail, was compromised and then "he" sent half a dozen emails to clients asking them to pay genuine invoices for work done to their "new" business account. Some kind of public key verification would stop that. But what kind?
The clue is in your own text. This wouldn't have happened if they used 2FA.
- lifeisstillgood 3y ago"firewalls" between people / departments. There are billions sent daily on little more the "approved" in a reply all email. It's not the 2FA. a typo-squat would probably have worked, or just chnaging the email header. This is "just" social engineering / fraud as it has been for hundreds of years. We have the tools to prevent it. if not the processes and training - but do we have the incentive now?
- jstarfish 3y agoEvery time our C-levels get implicated in this stuff, email is never the medium. It's always text messages. Which makes sense; they're way easier to spoof, especially if the initial recipient lacks authority to initiate bank transfers and forwards a screenshot of the forged message as "proof" to someone who does-- it launders all metadata from the message itself. Even the timestamp is lost. And it's all out of band and not subject to internal firewalling, DMARC, nothing. Never trust text messages (or screenshots of them) as evidence of anything.