3 ms·
Well, there is a case for PDFs in a .zip, but it's when you're e.g. downloading some set of documents from your e-government site, and it's like 4 PDFs, all cry
by Joker_vD 1y ago
Well, there is a case for PDFs in a .zip, but it's when you're e.g. downloading some set of documents from your e-government site, and it's like 4 PDFs, all cryptographically signed: so you get a .zip with 4 PDFs in it and 4 .sig files with matching names.
But in emails? Just attach however many PDFs you need and send, they don't really compress anyway; and I think most web-mail fronts actually allow you to download all the attachments as a single .zip — but obviously those .zip-files are not maliciously crafted (I hope, at least).
Also, now that I think of it, forwarding the PDF you've extracted and visually reviewed instead of the original .zip-file would defeat this attack (unless, of course, it's the PDF file that's schizophrenic).
- b112 1y agoThe other reason is to use zip's incredibly mega super secure password protection, to keep super secret docs safe. (I see it all the time. Along with the password in the very same email)
- gcarvalho 1y agoI’m not saying this is good security hygiene, but not necessarily everyone with access to the file will also have access to the password in the email. e.g. someone downloaded the password protected zip on a public computer, logged out of their email, but forgot to delete the file.
- blincoln 1y agoThis is often a useful practice, because it prevents providers' badly-written/-configured attempts at antimalware from blocking files that the recipient knows they want to accept.