3 ms·
But does the recipient need to trust those headers? Couldn't it just remove those non-signed headers before decoding. If not, what does it really buy you? Sli
by magicalhippo 2y ago
But does the recipient need to trust those headers?
Couldn't it just remove those non-signed headers before decoding.
If not, what does it really buy you? Slight fuzzy feeling?
In the article they describe an attacker changing Content-Type as it's typically not signed. That seems like exactly the kind of header you'd want to ignore if not signed.
- Avamander 2y ago> In the article they describe an attacker changing Content-Type as it's typically not signed. That seems like exactly the kind of header you'd want to ignore if not signed. That would result in a lot of unreadable emails unfortunately. It would also take over-signing the Content-Type to mitigate this issue, having everything signed that way would certainly break even more.
- deleted 2y ago[deleted]