3 ms·

To me, paperless means they ATTACH MY STATEMENT TO THE EMAIL. Not signing up to any paperless until they do, none yet have met this bar. The statement is suppos

To me, paperless means they ATTACH MY STATEMENT TO THE EMAIL. Not signing up to any paperless until they do, none yet have met this bar. The statement is supposed to be a snapshot of the status of the account at a given moment, if you have to open their website to view it they could regenerate it from whatever crap data they have lying around at the given moment. If it can change every time you look at it, it's a quantum statement, it's not a snapshot, it's a vibe. This defeats the entire purpose of getting a statement, I don't know how anyone tolerates this.

arjie 4mo ago
Unfortunately for quite a few people in non-Western states with whom I share my email, I now have their paystubs and insurance receipts and so on. They just sent me the email after someone either made an error in data entry or optimistically assumed they have first.last@gmail.com
saltcured 4mo ago
I tolerate it when I get a fixed period statement and can download to review and archive. I don't treat the website as my archive, nor would I treat the email system as my archive. It's just the delivery mechanism. And they are for the well-defined accounting periods, e.g. monthly or quarterly, not some sort of ephemeral "rollup to time of download". That would drive me mad if they had different periods depending on download timing. I can't know for certain, but my gut tells me they are just generating PDFs at the same time they perform the general reporting run that also leads to printed statements. And then they have some limited retention history to limit the storage costs.
throawayonthe 4mo ago
they send important (financial?) documents over email???? who tf does that what vendor is this
- technion 4mo ago
  All of them. My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them. My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot: https://infosec.exchange/@jsmall/116745959468132388 https://infosec.exchange/@jsmall/116745959468132388 I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.
edoceo 4mo ago
Many places don't attach the statement because it has sensitive information. Add that with "email is not secure" which we've been yelling for years (well, me since 1996). Sending it via email is risk exposure for them.
- thayne 4mo ago
  It is long since time we made email secure. Or replaced it with something else that would allow us to send messages to people securely (in a decentralized way). Having to log in to a half-maintained, slow web portal with terrible UI that is down 25% of the time is a really terrible way to get your sensitive and often important documents.
  - SAI_Peregrinus 4mo ago
    email can be read by any server in the chain between the sender & recipient. It's not secure. PGP doesn't fully fix this, it still leaks message content (subject) and metadata. So does S/MIME. That doesn't mean attachments are leaked, but it does mean email isn't compliant with any of the standards which require communicating securely.
    - thayne 4mo ago
      Right. I'm saying this state of affairs is unacceptable for the dominant digital messaging system in 2026.
      - SAI_Peregrinus 4mo ago
        I agree. The problem is that anything which solves this won't be compatible with email, since these issues are inherent to the protocol. Fixing email isn't possible, so the solution has to be replacing it. Unfortunately that's very difficult.
        saltcured 4mo ago
        It would be interesting if there was a DNS record of some kind to announce a PKI registry for a particular domain's email addresses. This would allow for some kind of decentralized discovery of suitable public keys for individual addressees. But, a potential sender with important messages still needs do some pre-flight email verification over this path, e.g. sending a verification code encrypted the same way, to validate that the intended user can read it and send it back via another authenticated channel. This ensures that the sender-specific user identity actually possesses control of that email address and the discovered private key. It also reduces the impact of a malicious email provider to only denial-of-service rather than content interception. So, is that discovery protocol worth it, versus just having an opt-in setting where the user supplies their desired public key and email address in the same form?

arjie 4mo ago

Unfortunately for quite a few people in non-Western states with whom I share my email, I now have their paystubs and insurance receipts and so on. They just sent me the email after someone either made an error in data entry or optimistically assumed they have first.last@gmail.com

saltcured 4mo ago

I tolerate it when I get a fixed period statement and can download to review and archive. I don't treat the website as my archive, nor would I treat the email system as my archive. It's just the delivery mechanism. And they are for the well-defined accounting periods, e.g. monthly or quarterly, not some sort of ephemeral "rollup to time of download". That would drive me mad if they had different periods depending on download timing. I can't know for certain, but my gut tells me they are just generating PDFs at the same time they perform the general reporting run that also leads to printed statements. And then they have some limited retention history to limit the storage costs.

throawayonthe 4mo ago

they send important (financial?) documents over email???? who tf does that what vendor is this

technion 4mo ago
All of them. My personal tax agent only accepts forms and sends them back via email. I had a conversation with him about using password protected zips and he just told me he won't accept them. My hospital sent me a PDF that I was to fill in and email back with cleartext credit card information filled in to pay bills. Screenshot: https://infosec.exchange/@jsmall/116745959468132388 https://infosec.exchange/@jsmall/116745959468132388 I recently deal with an inheritance and the Super Fund would only accept legal documents by email. I could go on, this is normal.

edoceo 4mo ago

Many places don't attach the statement because it has sensitive information. Add that with "email is not secure" which we've been yelling for years (well, me since 1996). Sending it via email is risk exposure for them.

thayne 4mo ago
It is long since time we made email secure. Or replaced it with something else that would allow us to send messages to people securely (in a decentralized way). Having to log in to a half-maintained, slow web portal with terrible UI that is down 25% of the time is a really terrible way to get your sensitive and often important documents.
- SAI_Peregrinus 4mo ago
  email can be read by any server in the chain between the sender & recipient. It's not secure. PGP doesn't fully fix this, it still leaks message content (subject) and metadata. So does S/MIME. That doesn't mean attachments are leaked, but it does mean email isn't compliant with any of the standards which require communicating securely.
  - thayne 4mo ago
    Right. I'm saying this state of affairs is unacceptable for the dominant digital messaging system in 2026.
    - SAI_Peregrinus 4mo ago
      I agree. The problem is that anything which solves this won't be compatible with email, since these issues are inherent to the protocol. Fixing email isn't possible, so the solution has to be replacing it. Unfortunately that's very difficult.
      - saltcured 4mo ago
        It would be interesting if there was a DNS record of some kind to announce a PKI registry for a particular domain's email addresses. This would allow for some kind of decentralized discovery of suitable public keys for individual addressees. But, a potential sender with important messages still needs do some pre-flight email verification over this path, e.g. sending a verification code encrypted the same way, to validate that the intended user can read it and send it back via another authenticated channel. This ensures that the sender-specific user identity actually possesses control of that email address and the discovered private key. It also reduces the impact of a malicious email provider to only denial-of-service rather than content interception. So, is that discovery protocol worth it, versus just having an opt-in setting where the user supplies their desired public key and email address in the same form?