Hacker News Reader

Comment by joe_the_user | Hacker News Reader

That, after thirty years, email security still depends on the wisdom of individuals not clicking the wrong link, is appalling.

The situation involves institutions happy to opaque links to email as part of their workflow. What could change this? All I can imagine is state regulation but that also is implausible.

View on HN

I just received a corporate IT security training link. From an external address and with a cryptic link. After a previous training which asked us not to trust external emails (spoofable) especially not with unknown links.

IT wasn’t amused when I reported it as phishing attempt.

Haha - amazing. I've had the same thought, and I'm sure the scammers have too.

I always do report those.

In a previous client,the CIO complained about the low click rate for their security training, every one thought it was some spams.

Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility. This helped growth of all the networks but means indefinite whack a mole.

I think (but am not sure) that something using trust networks from the ground up would be better in the long term. Consider anything dodgy until it has built trust relationships.

Eg email servers can’t just go for it. You need time to warm up your IP address, use DKIM etc. People can’t just friend you on FB without your acceptance so it’s a lot safer than email, if still not perfect. A few layers of trust would slow bad actors down significantly.

A trust network wouldn’t be binary. Having eg a bunch of spam accounts all trust each other wouldn’t help getting into your social or business network.

Thoughts from experts?

> Email and web browsing relies on “deny lists” rather than “allow lists”. So anything goes but you block bad addresses, rather than nothing until you get permissions/trust/credibility.

But this is fundamental to an open Internet. Yes going whitelist-only would stop bad actors but it would also hand over the entire internet to the megacorps with no avenue for individual success.

Email and browsers shouldn't be glibly equated.

Email as it is presently is a constant opening to phishing and spear fishing. Browser exploits are common too but it's harder (not impossible) to make them personal. And phishing doesn't have to rely on a browser exploit - a fake login page is enough.

It's logical to have a whitelist (or disallow) email links but still allow browsers to follow links.

I don’t think that’s necessary. We could create open trust networks/protocols that don’t rely on megacorps. In fact it’s probably exactly the megacorps who wouldn’t want this to happen because they benefit from the relative trust they have on their closed environments.

Eg certs. Let’s Encrypt equivalent for credibility, where I can trust you as we interact more, and borrow from your trust networks. Send spam and you reduce your cred. (Letscred.com is available right now if anyone is very bored :)

Gotta be tested very carefully so you don’t end up with a black mirror episode, of course.

The same is true for operating systems. Why don't they sandbox properly?

We have sandboxing on mobile apps. Why can't we have the same for desktop?

After all these years, Microsoft is finally rolling out win32 app isolation, so maybe we are finally on the good path...

Developers initially revolted against Microsoft UWP and Mac App Store.

Walled garden is not a substitute for security

APPX (the installer format used by the windows store) and its successor MSIX contain decent security improvements, including filesystem and registry virtualisation and a capability-based permission system.

After the limited success of the windows store you can now get the same in standalone installers. It has been adopted by approximately nobody

Not because they isolated the applications though! Because they were shit, and that's not a requirement.

Asking for fully bug free software is nice but unrealistic. Browsers are ostensibly somewhat sandboxed too but there are always new zero-days 'cause browsers are essentially OSes with many moving parts.

However, it reasonable to expect a single hole to be fixed. The "email hole" has been discussed for decades but here we are.

Email is still the running blood of the internet. While we mostly get away with Slack and others for in-group communication, anything going outside, especially to customers, still goes through emails.

At that scale, expecting a core issue to be quickly (or ever) fixed is just unrealistic. I honestly wonder if fundamentally it will ever be fixed, or if instead we get a different communication path to cover the specific use cases we do care about security.

PS: the phone is now 2 century olds, and we sure couldn't solve scamming issues...

> Why can't we have the same for desktop?

Morally? No reason why, and people are working on it (slowly).

Practically? Because sandboxing breaks lots of things that users and developers like, such as file picking (I hate snaps), and it takes time to reimplement them in a sandbox in the way that people expect them to work. If it requires the developers' cooperation, then it's even slower, because developers have enough APIs to learn as it is.

And to the extent you mitigate some of those user complaints (as flatpak etc. are doing) you are basically re-opening the exact same holes that you developed the sandbox to get away from

A good start would be ditching HTML in email. Plain text is perfectly suitable for non-marketing emails (and marketing emails are just chaff at this point anyways).

I’ll die on this hill.

One word deserves so much blame for the current state of the internet: marketing

You can be perfectly spearphished by a plaintext email, sent by your “colleague”, mentioning some current issue at work, and asking to verify some ticket

or by your “friend” mentioning a highly personal issue that only you two were supposed to know, asking you to phone someone on their behalf

or by your “relative”, etc.

Security is eliminating attack vectors one at a time. HTML in email is a gigantic hole. We don’t throw up our hands and say “whelp this only solves 90% of issues. Guess we don’t bother.”

> I’ll die on this hill.

Same. I found a setting in legacy outlook to force all e-mails to be in plain text. So every corporate email I reply to, converts the product owners html formatted emails into junk.

Gives me a little joy that the e-mail they worked so hard on gets mangled by my outlook replies :)

> A good start would be ditching HTML in email.

How would that help? You can put links in plain text.

It's all about attack surface and HTMLs attack surface is huge. HTML in email is strictly unnecessary. Name another popular messaging tool that allows you to craft custom HTML messages. Text, Whatsapp, social posts, Snapchat, etc.

The only people who want to send HTML emails are marketers, advertisers, trackers, scammers, hackers, and that clueless manager who wants the cornflower blue background. (most of these actors are the same people, except for that last one).

Technologically, email aliases have been working wonders for me in personal use. No idea if it could be rolled out effectively for nontechnical users at an organizational scale though, even with automation.

It also does little against compromised mailboxes - heck, a sufficiently advanced spear fish might even have better chances if the user misunderstands the security improvements this would provide.

But I think other than this, there's not much else to fix. Some people are malicious, others get compromised. No fixing that.

You can have all of this fancy security. But at the end of the day, the weakest and most vulnerable link in the chain is the human.

I think for the vast majority of people it doesn't depend on not clicking links.

Chrome 0-days are expensive and aren't going to be wasted on the masses. They'll be sold to dodgy middle eastern countries and used to target journalists or whatever.

If you aren't a high value target you can click links. It's fine.

I blame Microsoft. As a consumer OS its default stance should be no, the user does not intend to grant god permissions to this embedded or external script when they clicked it. Instead the user should have been challenged with a dialog, do you want to install this App and then execute?

To which everybody will click yes. They have been conditioned by too much half-baked crap out there that requires it and the need to go on with their lives instead of having tp start investigating things they anyway don't have a clue about (and don't want to, not being IT folks).

This is why you don't daily drive a local admin and leave UAC enabled. If you were using an unprivileged account, you'd be getting UAC prompts.

Reply on news.ycombinator.com