6 ms·

That, after thirty years, email security still depends on the wisdom of individuals not clicking the wrong link, is appalling. The situation involves instituti

That, after thirty years, email security still depends on the wisdom of individuals not clicking the wrong link, is appalling. The situation involves institutions happy to opaque links to email as part of their workflow. What could change this? All I can imagine is state regulation but that also is implausible.

concerndc1tizen 2y ago
The same is true for operating systems. Why don't they sandbox properly? We have sandboxing on mobile apps. Why can't we have the same for desktop?
- andersa 2y ago
  After all these years, Microsoft is finally rolling out win32 app isolation, so maybe we are finally on the good path...
- fassssst 2y ago
  Developers initially revolted against Microsoft UWP and Mac App Store.
  - wetpaws 2y ago
    Walled garden is not a substitute for security
    - wongarsu 2y ago
      APPX (the installer format used by the windows store) and its successor MSIX contain decent security improvements, including filesystem and registry virtualisation and a capability-based permission system. After the limited success of the windows store you can now get the same in standalone installers. It has been adopted by approximately nobody
  - Y_Y 2y ago
    Not because they isolated the applications though! Because they were shit, and that's not a requirement.
- joe_the_user 2y ago
  Asking for fully bug free software is nice but unrealistic. Browsers are ostensibly somewhat sandboxed too but there are always new zero-days 'cause browsers are essentially OSes with many moving parts. However, it reasonable to expect a single hole to be fixed. The "email hole" has been discussed for decades but here we are.
  - makeitdouble 2y ago
    Email is still the running blood of the internet. While we mostly get away with Slack and others for in-group communication, anything going outside, especially to customers, still goes through emails. At that scale, expecting a core issue to be quickly (or ever) fixed is just unrealistic. I honestly wonder if fundamentally it will ever be fixed, or if instead we get a different communication path to cover the specific use cases we do care about security. PS: the phone is now 2 century olds, and we sure couldn't solve scamming issues...
- throw10920 2y ago
  > Why can't we have the same for desktop? Morally? No reason why, and people are working on it (slowly). Practically? Because sandboxing breaks lots of things that users and developers like, such as file picking (I hate snaps), and it takes time to reimplement them in a sandbox in the way that people expect them to work. If it requires the developers' cooperation, then it's even slower, because developers have enough APIs to learn as it is.
  - bandrami 2y ago
    And to the extent you mitigate some of those user complaints (as flatpak etc. are doing) you are basically re-opening the exact same holes that you developed the sandbox to get away from
rawgabbit 2y ago
I blame Microsoft. As a consumer OS its default stance should be no, the user does not intend to grant god permissions to this embedded or external script when they clicked it. Instead the user should have been challenged with a dialog, do you want to install this App and then execute?
- bennythomsson 2y ago
  To which everybody will click yes. They have been conditioned by too much half-baked crap out there that requires it and the need to go on with their lives instead of having tp start investigating things they anyway don't have a clue about (and don't want to, not being IT folks).
- bongodongobob 2y ago
  This is why you don't daily drive a local admin and leave UAC enabled. If you were using an unprivileged account, you'd be getting UAC prompts.
richardw 2y ago
Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility. This helped growth of all the networks but means indefinite whack a mole. I think (but am not sure) that something using trust networks from the ground up would be better in the long term. Consider anything dodgy until it has built trust relationships. Eg email servers can’t just go for it. You need time to warm up your IP address, use DKIM etc. People can’t just friend you on FB without your acceptance so it’s a lot safer than email, if still not perfect. A few layers of trust would slow bad actors down significantly. A trust network wouldn’t be binary. Having eg a bunch of spam accounts all trust each other wouldn’t help getting into your social or business network. Thoughts from experts?
- MetaWhirledPeas 2y ago
  > Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility. But this is fundamental to an open Internet. Yes going whitelist-only would stop bad actors but it would also hand over the entire internet to the megacorps with no avenue for individual success.
  - joe_the_user 2y ago
    Email and browsers shouldn't be glibly equated. Email as it is presently is a constant opening to phishing and spear fishing. Browser exploits are common too but it's harder (not impossible) to make them personal. And phishing doesn't have to rely on a browser exploit - a fake login page is enough. It's logical to have a whitelist (or disallow) email links but still allow browsers to follow links.
  - richardw 2y ago
    I don’t think that’s necessary. We could create open trust networks/protocols that don’t rely on megacorps. In fact it’s probably exactly the megacorps who wouldn’t want this to happen because they benefit from the relative trust they have on their closed environments. Eg certs. Let’s Encrypt equivalent for credibility, where I can trust you as we interact more, and borrow from your trust networks. Send spam and you reduce your cred. (Letscred.com is available right now if anyone is very bored :) Gotta be tested very carefully so you don’t end up with a black mirror episode, of course.
ano-ther 2y ago
I just received a corporate IT security training link. From an external address and with a cryptic link. After a previous training which asked us not to trust external emails (spoofable) especially not with unknown links. IT wasn’t amused when I reported it as phishing attempt.
- nickpinkston 2y ago
  Haha - amazing. I've had the same thought, and I'm sure the scammers have too.
- Foobar8568 2y ago
  I always do report those. In a previous client,the CIO complained about the low click rate for their security training, every one thought it was some spams.
perching_aix 2y ago
Technologically, email aliases have been working wonders for me in personal use. No idea if it could be rolled out effectively for nontechnical users at an organizational scale though, even with automation. It also does little against compromised mailboxes - heck, a sufficiently advanced spear fish might even have better chances if the user misunderstands the security improvements this would provide. But I think other than this, there's not much else to fix. Some people are malicious, others get compromised. No fixing that.
rapind 2y ago
A good start would be ditching HTML in email. Plain text is perfectly suitable for non-marketing emails (and marketing emails are just chaff at this point anyways). I’ll die on this hill.
- MetaWhirledPeas 2y ago
  One word deserves so much blame for the current state of the internet: marketing
  - deleted 2y ago
    [deleted]
- atemerev 2y ago
  You can be perfectly spearphished by a plaintext email, sent by your “colleague”, mentioning some current issue at work, and asking to verify some ticket or by your “friend” mentioning a highly personal issue that only you two were supposed to know, asking you to phone someone on their behalf or by your “relative”, etc.
  - rapind 2y ago
    Security is eliminating attack vectors one at a time. HTML in email is a gigantic hole. We don’t throw up our hands and say “whelp this only solves 90% of issues. Guess we don’t bother.”
- xyst 2y ago
  > I’ll die on this hill. Same. I found a setting in legacy outlook to force all e-mails to be in plain text. So every corporate email I reply to, converts the product owners html formatted emails into junk. Gives me a little joy that the e-mail they worked so hard on gets mangled by my outlook replies :)
- IshKebab 2y ago
  > A good start would be ditching HTML in email. How would that help? You can put links in plain text.
xyst 2y ago
You can have all of this fancy security. But at the end of the day, the weakest and most vulnerable link in the chain is the human.
IshKebab 2y ago
I think for the vast majority of people it doesn't depend on not clicking links. Chrome 0-days are expensive and aren't going to be wasted on the masses. They'll be sold to dodgy middle eastern countries and used to target journalists or whatever. If you aren't a high value target you can click links. It's fine.

concerndc1tizen 2y ago

The same is true for operating systems. Why don't they sandbox properly? We have sandboxing on mobile apps. Why can't we have the same for desktop?

andersa 2y ago
After all these years, Microsoft is finally rolling out win32 app isolation, so maybe we are finally on the good path...
fassssst 2y ago
Developers initially revolted against Microsoft UWP and Mac App Store.
- wetpaws 2y ago
  Walled garden is not a substitute for security
  - wongarsu 2y ago
    APPX (the installer format used by the windows store) and its successor MSIX contain decent security improvements, including filesystem and registry virtualisation and a capability-based permission system. After the limited success of the windows store you can now get the same in standalone installers. It has been adopted by approximately nobody
- Y_Y 2y ago
  Not because they isolated the applications though! Because they were shit, and that's not a requirement.
joe_the_user 2y ago
Asking for fully bug free software is nice but unrealistic. Browsers are ostensibly somewhat sandboxed too but there are always new zero-days 'cause browsers are essentially OSes with many moving parts. However, it reasonable to expect a single hole to be fixed. The "email hole" has been discussed for decades but here we are.
- makeitdouble 2y ago
  Email is still the running blood of the internet. While we mostly get away with Slack and others for in-group communication, anything going outside, especially to customers, still goes through emails. At that scale, expecting a core issue to be quickly (or ever) fixed is just unrealistic. I honestly wonder if fundamentally it will ever be fixed, or if instead we get a different communication path to cover the specific use cases we do care about security. PS: the phone is now 2 century olds, and we sure couldn't solve scamming issues...
throw10920 2y ago
> Why can't we have the same for desktop? Morally? No reason why, and people are working on it (slowly). Practically? Because sandboxing breaks lots of things that users and developers like, such as file picking (I hate snaps), and it takes time to reimplement them in a sandbox in the way that people expect them to work. If it requires the developers' cooperation, then it's even slower, because developers have enough APIs to learn as it is.
- bandrami 2y ago
  And to the extent you mitigate some of those user complaints (as flatpak etc. are doing) you are basically re-opening the exact same holes that you developed the sandbox to get away from

rawgabbit 2y ago

I blame Microsoft. As a consumer OS its default stance should be no, the user does not intend to grant god permissions to this embedded or external script when they clicked it. Instead the user should have been challenged with a dialog, do you want to install this App and then execute?

bennythomsson 2y ago
To which everybody will click yes. They have been conditioned by too much half-baked crap out there that requires it and the need to go on with their lives instead of having tp start investigating things they anyway don't have a clue about (and don't want to, not being IT folks).
bongodongobob 2y ago
This is why you don't daily drive a local admin and leave UAC enabled. If you were using an unprivileged account, you'd be getting UAC prompts.

richardw 2y ago

Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility. This helped growth of all the networks but means indefinite whack a mole. I think (but am not sure) that something using trust networks from the ground up would be better in the long term. Consider anything dodgy until it has built trust relationships. Eg email servers can’t just go for it. You need time to warm up your IP address, use DKIM etc. People can’t just friend you on FB without your acceptance so it’s a lot safer than email, if still not perfect. A few layers of trust would slow bad actors down significantly. A trust network wouldn’t be binary. Having eg a bunch of spam accounts all trust each other wouldn’t help getting into your social or business network. Thoughts from experts?

MetaWhirledPeas 2y ago
> Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility. But this is fundamental to an open Internet. Yes going whitelist-only would stop bad actors but it would also hand over the entire internet to the megacorps with no avenue for individual success.
- joe_the_user 2y ago
  Email and browsers shouldn't be glibly equated. Email as it is presently is a constant opening to phishing and spear fishing. Browser exploits are common too but it's harder (not impossible) to make them personal. And phishing doesn't have to rely on a browser exploit - a fake login page is enough. It's logical to have a whitelist (or disallow) email links but still allow browsers to follow links.
- richardw 2y ago
  I don’t think that’s necessary. We could create open trust networks/protocols that don’t rely on megacorps. In fact it’s probably exactly the megacorps who wouldn’t want this to happen because they benefit from the relative trust they have on their closed environments. Eg certs. Let’s Encrypt equivalent for credibility, where I can trust you as we interact more, and borrow from your trust networks. Send spam and you reduce your cred. (Letscred.com is available right now if anyone is very bored :) Gotta be tested very carefully so you don’t end up with a black mirror episode, of course.

ano-ther 2y ago

I just received a corporate IT security training link. From an external address and with a cryptic link. After a previous training which asked us not to trust external emails (spoofable) especially not with unknown links. IT wasn’t amused when I reported it as phishing attempt.

nickpinkston 2y ago
Haha - amazing. I've had the same thought, and I'm sure the scammers have too.
Foobar8568 2y ago
I always do report those. In a previous client,the CIO complained about the low click rate for their security training, every one thought it was some spams.

perching_aix 2y ago

Technologically, email aliases have been working wonders for me in personal use. No idea if it could be rolled out effectively for nontechnical users at an organizational scale though, even with automation. It also does little against compromised mailboxes - heck, a sufficiently advanced spear fish might even have better chances if the user misunderstands the security improvements this would provide. But I think other than this, there's not much else to fix. Some people are malicious, others get compromised. No fixing that.

rapind 2y ago

A good start would be ditching HTML in email. Plain text is perfectly suitable for non-marketing emails (and marketing emails are just chaff at this point anyways). I’ll die on this hill.

MetaWhirledPeas 2y ago
One word deserves so much blame for the current state of the internet: marketing
- deleted 2y ago
  [deleted]
atemerev 2y ago
You can be perfectly spearphished by a plaintext email, sent by your “colleague”, mentioning some current issue at work, and asking to verify some ticket or by your “friend” mentioning a highly personal issue that only you two were supposed to know, asking you to phone someone on their behalf or by your “relative”, etc.
- rapind 2y ago
  Security is eliminating attack vectors one at a time. HTML in email is a gigantic hole. We don’t throw up our hands and say “whelp this only solves 90% of issues. Guess we don’t bother.”
xyst 2y ago
> I’ll die on this hill. Same. I found a setting in legacy outlook to force all e-mails to be in plain text. So every corporate email I reply to, converts the product owners html formatted emails into junk. Gives me a little joy that the e-mail they worked so hard on gets mangled by my outlook replies :)
IshKebab 2y ago
> A good start would be ditching HTML in email. How would that help? You can put links in plain text.

xyst 2y ago

You can have all of this fancy security. But at the end of the day, the weakest and most vulnerable link in the chain is the human.

IshKebab 2y ago

I think for the vast majority of people it doesn't depend on not clicking links. Chrome 0-days are expensive and aren't going to be wasted on the masses. They'll be sold to dodgy middle eastern countries and used to target journalists or whatever. If you aren't a high value target you can click links. It's fine.