4 ms·

I would make even stronger advice. If you want to verify an email, send me a one-time code with several hours expiry that I have to resubmit through my logged

I would make even stronger advice. If you want to verify an email, send me a one-time code with several hours expiry that I have to resubmit through my logged in web identity at your site. It drives me batty that a financial provider (retirement vendor from previous employer) won't seem to let my "paperless" setting remain active. Only because I don't ping their abusive email tracking pixels etc. To me, paperless means I can log in and download my quarterly PDF statements and related documents, and they won't be left in a mailbox on the street. It doesn't mean I have to subject myself to reading your silly emails with a promiscuous client.

teeray 4mo ago
I really wish you could provide a PGP public key to your bank and have them just email the damn pdf every month.
- RulerOf 4mo ago
  That'd be nice, but I'd even settle for the plain pdf attached to the email.
  - saltcured 4mo ago
    For things like financial records, I would not want plain PDF in the email. I think it needs encryption for confidentiality. I am geeky enough to use PGP or S/MIME if they had the option, but I can definitely see how vendors would see this as too fringe with retail customers. I would not like the typical "secure email" which is nothing more than a volatile link back into yet another website.
    - wwind123 4mo ago
      Hmm, yeah some people feel that plain emails are not secure for sensitive information. As a result, some banks provide a "secure email" box that's usually PITA to use. It'd be great if there's a unified API for all financial institutes to provide sensitive info (statements, tax forms etc.) and you just need to run a software tool to download them once in a while or when you need it.
    - RulerOf 4mo ago
      I get that, but I don't care. I want the PDF (or CSV) emailed to me as an attachment because that's the workflow that doesn't suck. Everything else sucks in one way or another, and much of it is security theater.
  - mcv 4mo ago
    Unencrypted sensitive data in an email is a really bad idea. I hope they never do that. Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)
    - pocksuppet 4mo ago
      Is it really? Who can read it today? Your email provider and theirs? Gmail won't deliver messages without TLS any more, so everyone supports it or they're effectively kicked out of email.
      - floam 4mo ago
        TLS just encrypts the IMAP / SMTP sessions, no guarantee it’s stored encrypted, let alone end to end
        account42 4mo ago
        You didn't answer this question: > Who can read it today?
        mcv 4mo ago
        Well, the email providers. And that could easily include Google without you even realising. It's true that email isn't quite as insecure as it used to be (it was once compared to shouting your message at someone and expecting them to shout it in the right direction until it reached the intended recipient), but there are still many things missing compared to other forms of direct messaging, and there's good reason why many people and organisations don't want it used to send sensitive information.
        pocksuppet 3mo ago
        How is that different from your browser and the bank website being able to read the same PDF transmitted through the website?
deleted 4mo ago
[deleted]
infogulch 4mo ago
To me, paperless means they ATTACH MY STATEMENT TO THE EMAIL. Not signing up to any paperless until they do, none yet have met this bar. The statement is supposed to be a snapshot of the status of the account at a given moment, if you have to open their website to view it they could regenerate it from whatever crap data they have lying around at the given moment. If it can change every time you look at it, it's a quantum statement, it's not a snapshot, it's a vibe. This defeats the entire purpose of getting a statement, I don't know how anyone tolerates this.
- arjie 4mo ago
  Unfortunately for quite a few people in non-Western states with whom I share my email, I now have their paystubs and insurance receipts and so on. They just sent me the email after someone either made an error in data entry or optimistically assumed they have first.last@gmail.com
- saltcured 4mo ago
  I tolerate it when I get a fixed period statement and can download to review and archive. I don't treat the website as my archive, nor would I treat the email system as my archive. It's just the delivery mechanism. And they are for the well-defined accounting periods, e.g. monthly or quarterly, not some sort of ephemeral "rollup to time of download". That would drive me mad if they had different periods depending on download timing. I can't know for certain, but my gut tells me they are just generating PDFs at the same time they perform the general reporting run that also leads to printed statements. And then they have some limited retention history to limit the storage costs.
- throawayonthe 4mo ago
  they send important (financial?) documents over email???? who tf does that what vendor is this
  - technion 4mo ago
    All of them. My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them. My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot: https://infosec.exchange/@jsmall/116745959468132388 https://infosec.exchange/@jsmall/116745959468132388 I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.

teeray 4mo ago

I really wish you could provide a PGP public key to your bank and have them just email the damn pdf every month.

RulerOf 4mo ago
That'd be nice, but I'd even settle for the plain pdf attached to the email.
- saltcured 4mo ago
  For things like financial records, I would not want plain PDF in the email. I think it needs encryption for confidentiality. I am geeky enough to use PGP or S/MIME if they had the option, but I can definitely see how vendors would see this as too fringe with retail customers. I would not like the typical "secure email" which is nothing more than a volatile link back into yet another website.
  - wwind123 4mo ago
    Hmm, yeah some people feel that plain emails are not secure for sensitive information. As a result, some banks provide a "secure email" box that's usually PITA to use. It'd be great if there's a unified API for all financial institutes to provide sensitive info (statements, tax forms etc.) and you just need to run a software tool to download them once in a while or when you need it.
  - RulerOf 4mo ago
    I get that, but I don't care. I want the PDF (or CSV) emailed to me as an attachment because that's the workflow that doesn't suck. Everything else sucks in one way or another, and much of it is security theater.
- mcv 4mo ago
  Unencrypted sensitive data in an email is a really bad idea. I hope they never do that. Although what I would really like, and think is long overdue, is an extension to email that normalises encryption and sender verification. It's ridiculous that email can be spoofed like that. (The same is even more true for phone numbers.)
  - pocksuppet 4mo ago
    Is it really? Who can read it today? Your email provider and theirs? Gmail won't deliver messages without TLS any more, so everyone supports it or they're effectively kicked out of email.
    - floam 4mo ago
      TLS just encrypts the IMAP / SMTP sessions, no guarantee it’s stored encrypted, let alone end to end
      - account42 4mo ago
        You didn't answer this question: > Who can read it today?
        mcv 4mo ago
        Well, the email providers. And that could easily include Google without you even realising. It's true that email isn't quite as insecure as it used to be (it was once compared to shouting your message at someone and expecting them to shout it in the right direction until it reached the intended recipient), but there are still many things missing compared to other forms of direct messaging, and there's good reason why many people and organisations don't want it used to send sensitive information.
        pocksuppet 3mo ago
        How is that different from your browser and the bank website being able to read the same PDF transmitted through the website?

deleted 4mo ago

[deleted]

infogulch 4mo ago

To me, paperless means they ATTACH MY STATEMENT TO THE EMAIL. Not signing up to any paperless until they do, none yet have met this bar. The statement is supposed to be a snapshot of the status of the account at a given moment, if you have to open their website to view it they could regenerate it from whatever crap data they have lying around at the given moment. If it can change every time you look at it, it's a quantum statement, it's not a snapshot, it's a vibe. This defeats the entire purpose of getting a statement, I don't know how anyone tolerates this.

arjie 4mo ago
Unfortunately for quite a few people in non-Western states with whom I share my email, I now have their paystubs and insurance receipts and so on. They just sent me the email after someone either made an error in data entry or optimistically assumed they have first.last@gmail.com
saltcured 4mo ago
I tolerate it when I get a fixed period statement and can download to review and archive. I don't treat the website as my archive, nor would I treat the email system as my archive. It's just the delivery mechanism. And they are for the well-defined accounting periods, e.g. monthly or quarterly, not some sort of ephemeral "rollup to time of download". That would drive me mad if they had different periods depending on download timing. I can't know for certain, but my gut tells me they are just generating PDFs at the same time they perform the general reporting run that also leads to printed statements. And then they have some limited retention history to limit the storage costs.
throawayonthe 4mo ago
they send important (financial?) documents over email???? who tf does that what vendor is this
- technion 4mo ago
  All of them. My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them. My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot: https://infosec.exchange/@jsmall/116745959468132388 https://infosec.exchange/@jsmall/116745959468132388 I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.