4 ms·

I'd like to see the HTML that is supported in e-mails standardised Count me out. It wasn't even two weeks ago that we had the story here about how The Onion wa

I'd like to see the HTML that is supported in e-mails standardised Count me out. It wasn't even two weeks ago that we had the story here about how The Onion was hacked because somebody clicked on an obfuscated HTML URL in email.

laumars 13y ago
While we're at it, let's all abandon HTML5 and have every browser doing their own thing, because people occasional fall for fake anti-virus ads. </sarcasm> We can't stop social engineering like that - it's completely unavoidable. Which is why banks and payment providers regularly tell people not to follow links asking for bank details (etc). Yeah it sucks that The Onion got hacked that way, but your argument is doesn't fix that. Your argument is nothing more than cutting of your nose to spite your face (ie advocating an inconsistent platform for legitimate e-mails despite anchor tags working on every client already). At least if e-mail was completely redesigned, then we could have banks provide a unique cert that hangs in the e-mail header and can support the authenticity claim of the sender (I'm sure there's ways around that idea I've just presented - but that was just off the top of my head. Any such design would obviously need to be thoroughly thought out)
- raylu 13y ago
  I think he's saying we should instead have text-only e-mail, because that's both standard and has a tiny attack surface.
  - laumars 13y ago
    That doesn't fix anything either. Many clients make URLs clickable (even with text-only emails) and even if those clients didn't do that, someone will just copy and paste a URL into the address bar without looking. Given that the average user isn't an expert on domain names, it's not actually that hard to trick them into thinking that face.book.com isn't the same as facebook.com (and even those that are savvy enough to know the difference might misread the link and get fooled occasionally). So like I said before, it's impossible to prevent social engineering.
    - raylu 13y ago
      It's impossible to prevent all cases of social engineering with a purely technical solution, this is true. But that doesn't mean that we should disregard how much easier phishing attacks are with the advent of HTML mail. The goal here is not so much to stop social engineering dead in its tracks as to prevent some of the low-effort attacks that do happen.
      - laumars 13y ago
        But again, I refer you to my HTML5 example. Should we dumb down what websites are capable of rendering to prevent social engineering via the web? What you're proposing is making things harder to work in the hope that human intelligence will prevail. But the problem is that these cases are where human intelligence has failed, so making things harder is just counter productive. And this is why you can't prevent social engineering from happening and why crippling technology and creating a worse user experience just to try catch a few fringe cases is just a backwards approach to handling the issue. Instead what we need is methods in place to verify the authenticity of senders and better education to users so that don't make silly mistakes like installing random "virus scanners" from web ads or clicking strange URLs in e-mails (and the URLs themselves could be standardised. eg no sub-domains become clickable, to prevent people falling for face.book.com).
        npsimons 13y ago
        But again, I refer you to my HTML5 example. Should we dumb down what websites are capable of rendering to prevent social engineering via the web? Strawman; we're talking about email, where the combination of header forging and HTML mis-labeling are what's really dangerous, not web pages.
        laumars 13y ago
        No, we're talking about social engineering and the principle is the same regardless of whether it's e-mail or websites. You take a page -be that of an e-mail or website- make it look legitimate, and get people to follow dodgy links or download dodgy programs. You see the same thing with Facebook malware as well (which spreads by social engineering). So maybe we should close Facebook apps down.....actually, I'd be in favour of that last point hehehe. Claiming this is a straw man argument only demonstrates how unwilling you are to view this from another's perspective. At least I've listened to your arguments and come up with potential workarounds.
jackinloadup 13y ago
I wonder if this could be fixed by displaying SSL certificate status next to email titles. Much like browsers do for websites. This way before you open or at least before you click anything in the email you can see the validity of the sender.
pyre 13y ago
You can't put the genie back in the bottle, unfortunately. Most people use clients that support HTML right now, and a new format that doesn't support some sort of rich text decoration (like HTML) isn't going to become popular enough to matter.
- loup-vaillant 13y ago
  A ridiculously cheap and powerful alternative to HTML (or any other static format for that matter), would be a bytecode format intended to be executed in a sandboxed virtual machine. Possibly something like Flash. That should give you all the bells and whistles you could possibly want with a document format. Now, there still are some loose ends about various screen sizes, preferred font family and size, and of course allowing textual searches, but those parameters should be few enough to be less problematic that HTML is right now.
  - pyre 13y ago
    Really? Flash is more secure than HTML? Maybe we should just embed Java applets in emails? This still doesn't solve the "click a link that takes them elsewhere" issue that was brought up.
    - loup-vaillant 13y ago
      I did say "sandboxed", did I not? Just have your VM refuse to download anything before you click somewhere, and let it compute the relevant URL so it can show it to you the way Firefox does. If this is too harsh, then relax the restriction to only download to, say, the domain name of the current main URL. If this is still too harsh, then have a NoScript like button to relax restrictions manually, on a case by case basis. It would disable any form of cross scripting by default, which in my opinion is a better state of affairs than HTML alone is right now (now, you can embed an external image in a web page, and bam, Facebook knows what you read).

laumars 13y ago

While we're at it, let's all abandon HTML5 and have every browser doing their own thing, because people occasional fall for fake anti-virus ads. </sarcasm> We can't stop social engineering like that - it's completely unavoidable. Which is why banks and payment providers regularly tell people not to follow links asking for bank details (etc). Yeah it sucks that The Onion got hacked that way, but your argument is doesn't fix that. Your argument is nothing more than cutting of your nose to spite your face (ie advocating an inconsistent platform for legitimate e-mails despite anchor tags working on every client already). At least if e-mail was completely redesigned, then we could have banks provide a unique cert that hangs in the e-mail header and can support the authenticity claim of the sender (I'm sure there's ways around that idea I've just presented - but that was just off the top of my head. Any such design would obviously need to be thoroughly thought out)

raylu 13y ago
I think he's saying we should instead have text-only e-mail, because that's both standard and has a tiny attack surface.
- laumars 13y ago
  That doesn't fix anything either. Many clients make URLs clickable (even with text-only emails) and even if those clients didn't do that, someone will just copy and paste a URL into the address bar without looking. Given that the average user isn't an expert on domain names, it's not actually that hard to trick them into thinking that face.book.com isn't the same as facebook.com (and even those that are savvy enough to know the difference might misread the link and get fooled occasionally). So like I said before, it's impossible to prevent social engineering.
  - raylu 13y ago
    It's impossible to prevent all cases of social engineering with a purely technical solution, this is true. But that doesn't mean that we should disregard how much easier phishing attacks are with the advent of HTML mail. The goal here is not so much to stop social engineering dead in its tracks as to prevent some of the low-effort attacks that do happen.
    - laumars 13y ago
      But again, I refer you to my HTML5 example. Should we dumb down what websites are capable of rendering to prevent social engineering via the web? What you're proposing is making things harder to work in the hope that human intelligence will prevail. But the problem is that these cases are where human intelligence has failed, so making things harder is just counter productive. And this is why you can't prevent social engineering from happening and why crippling technology and creating a worse user experience just to try catch a few fringe cases is just a backwards approach to handling the issue. Instead what we need is methods in place to verify the authenticity of senders and better education to users so that don't make silly mistakes like installing random "virus scanners" from web ads or clicking strange URLs in e-mails (and the URLs themselves could be standardised. eg no sub-domains become clickable, to prevent people falling for face.book.com).
      - npsimons 13y ago
        But again, I refer you to my HTML5 example. Should we dumb down what websites are capable of rendering to prevent social engineering via the web? Strawman; we're talking about email, where the combination of header forging and HTML mis-labeling are what's really dangerous, not web pages.
        laumars 13y ago
        No, we're talking about social engineering and the principle is the same regardless of whether it's e-mail or websites. You take a page -be that of an e-mail or website- make it look legitimate, and get people to follow dodgy links or download dodgy programs. You see the same thing with Facebook malware as well (which spreads by social engineering). So maybe we should close Facebook apps down.....actually, I'd be in favour of that last point hehehe. Claiming this is a straw man argument only demonstrates how unwilling you are to view this from another's perspective. At least I've listened to your arguments and come up with potential workarounds.

jackinloadup 13y ago

I wonder if this could be fixed by displaying SSL certificate status next to email titles. Much like browsers do for websites. This way before you open or at least before you click anything in the email you can see the validity of the sender.

pyre 13y ago

You can't put the genie back in the bottle, unfortunately. Most people use clients that support HTML right now, and a new format that doesn't support some sort of rich text decoration (like HTML) isn't going to become popular enough to matter.

loup-vaillant 13y ago
A ridiculously cheap and powerful alternative to HTML (or any other static format for that matter), would be a bytecode format intended to be executed in a sandboxed virtual machine. Possibly something like Flash. That should give you all the bells and whistles you could possibly want with a document format. Now, there still are some loose ends about various screen sizes, preferred font family and size, and of course allowing textual searches, but those parameters should be few enough to be less problematic that HTML is right now.
- pyre 13y ago
  Really? Flash is more secure than HTML? Maybe we should just embed Java applets in emails? This still doesn't solve the "click a link that takes them elsewhere" issue that was brought up.
  - loup-vaillant 13y ago
    I did say "sandboxed", did I not? Just have your VM refuse to download anything before you click somewhere, and let it compute the relevant URL so it can show it to you the way Firefox does. If this is too harsh, then relax the restriction to only download to, say, the domain name of the current main URL. If this is still too harsh, then have a NoScript like button to relax restrictions manually, on a case by case basis. It would disable any form of cross scripting by default, which in my opinion is a better state of affairs than HTML alone is right now (now, you can embed an external image in a web page, and bam, Facebook knows what you read).