Hacker News Reader

Comment by can16358p | Hacker News Reader

Is there any progress about the displayed from address being incorrect for phishing attacks than the actual sender? For example I get a (phishing) mail from "Someone <someone@facebook.com>" whereas the message isn't from Facebook at all. And my mail client is perfectly fine with delivering it to my inbox and showing Facebook as the sender.

If I'm not tech savvy I'd easily fall for it. If I go down the rabbit hole and view all message headers I see it's fake, but why does the mail client show it as if it's from Facebook in the first place? It's a huge attack vector still present for many non-tech savvy users.

(For clarity I'm not talking about the sender name which can be anything that is free text. I'm talking about the "apparent" from field which does not reflect the actual sending address and looks perfectly legit as if from @facebook.com)

View on HN

I don't understand why clients do that either, the information's there as you say, they just assume the normal/'happy path' case always occurs for some reason.

In my own (rather WIP, wouldn't really suggest anyone else use it yet) client I display both if different - which should make it clear even if the content isn't stereotypically crap and obvious spam/phishing (to a more technical user).

If you read the RFCs, it was intended for use cases like 'from Mr Blah, but sent by his secretary, reply to his secretary'. Primarily legitimately used today almost like that I suppose - with mailing list / support case management type software being the 'secretary'.

So maybe I'm half answering my own point - Gmail et al. show `From` because it's usually friendlier to a non-technical user, it's who it's 'really' from, not confusing them with 'who is this Intercom.io' or whatever. But.. surely it's worth showing both, to help in the phishing cases as you say.

Not all email clients do that.

Let's say fishysenders.com tries to fake an email on behalf of johnsmith@company.com (and thus, dmarc alignment fails)

Gmail would say "From: johnsmith@company.com via fishysenders.com"

Facebook is an interesting example here. If you give them your PGP indentity they will encrypt and sign the emails they send you. So you will know if the email is actually from them.

So technically this is a very solved problem. Facebook unfortunately is very much the exception. It is pretty much impossible to convince entities like your bank to sign their emails.

This is what DMARC should solve, but it appears your mailserver lets these messages through without checking

I used Outlook, Gmail, iCloud Mail. All three had the same behavior AFAIR.

Reply on news.ycombinator.com