3 ms·

> In plaintext emails, the URL is always visible, and you can more easily make an informed choice to click it. Many phishing emails have also taken the step of

> In plaintext emails, the URL is always visible, and you can more easily make an informed choice to click it. Many phishing emails have also taken the step of carefully replicating the visual style of an email you might trust, such as the appearance of a PayPal email. With plain text, it's much more difficult to trick you like this. This isn't actually true anymore. It's actually pretty hard to trick a user and anti-spam software with HTML these days. And getting look alike domains is pretty easy. More and more successful phishing attacks happen with plaintext emails! > HTML emails open up a lot of possibilities which are exploited by spammers to circumvent spam filters, such as making large amounts of text invisible, using hidden elements, and so on. Many people discard HTML emails (particularly mailing lists) on the simple basis that it dramatically reduces the amount of spam emails they receive. Also not true anymore, at least if you use a service like Yahoo or Gmail. If anything, HTML gives Gmail's filters more "clues" as to whether something is spam.

autoexec 3y ago
> This isn't actually true anymore. It's actually pretty hard to trick a user and anti-spam software with HTML these days. I see tons of phishing email using HTML email. The ones that use plaintext tend to be the least convincing ones (often the fill in the blank style) as well. Phishing messages love to include logos, and to hide the URL of the links they include which often are URL shorteners or free website/form/survey builders. One of the reasons I recommend people use plaintext email is to prevent their email from looking like spam, either to the people getting it or to spam filters. Almost all the spam we see uses HTML. I can't remember the last time I saw an unsubscribe link in a plain text message (I have seen plain text spam with instructions to reply with a certain phrase in the subject line though).
- legitster 3y ago
  Is this through a service like Gmail or self-hosting? The only phishing attempts I ever see making it through Gmail's filters these days have all been plaintext emails usually with a fake invoice attached.
  - autoexec 3y ago
    It's not self hosted, we're using one of the largest email vendors for ISPs. We used to allow Google to host our mail servers, and saw similar levels of phishing getting through although that was several years ago now, and I can only hope they've gotten better at filtering out what actually reaches people's inboxes.

autoexec 3y ago

> This isn't actually true anymore. It's actually pretty hard to trick a user and anti-spam software with HTML these days. I see tons of phishing email using HTML email. The ones that use plaintext tend to be the least convincing ones (often the fill in the blank style) as well. Phishing messages love to include logos, and to hide the URL of the links they include which often are URL shorteners or free website/form/survey builders. One of the reasons I recommend people use plaintext email is to prevent their email from looking like spam, either to the people getting it or to spam filters. Almost all the spam we see uses HTML. I can't remember the last time I saw an unsubscribe link in a plain text message (I have seen plain text spam with instructions to reply with a certain phrase in the subject line though).

legitster 3y ago
Is this through a service like Gmail or self-hosting? The only phishing attempts I ever see making it through Gmail's filters these days have all been plaintext emails usually with a fake invoice attached.
- autoexec 3y ago
  It's not self hosted, we're using one of the largest email vendors for ISPs. We used to allow Google to host our mail servers, and saw similar levels of phishing getting through although that was several years ago now, and I can only hope they've gotten better at filtering out what actually reaches people's inboxes.