I read this article and was surprised when I reached the end because the whole thing felt like it was setting the stage for some announcement or new thing. But nothing came..? Forgive me if I'm being thick but what was the takeaway?
https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol
It's basically "you need to pass DMARC now" which has been true for 2 years.
It also goes into how authentication helps stop spoofed domains which yes, is true. But in my opinion the biggest problem isn't spoofed domains at all.
Attackers will figure out how to make your payment platform (PayPal, Stripe, etc) send out emails. They'll figure out what pieces of info make it into the generated emails, so they'll do things like set their company name to "there's a problem call this phone number." So next thing you know you're getting an email from PayPal that sounds urgent because they'll put that company name in the subject or body of the email.
These emails will be legit, from-the-actual-company, passes-all-authentication emails. DMARC can't catch that, and that's what I've been observing attackers do. They'll find a ticketing system or payment processor and get them to generate "authentic" emails.
I was sincerely hoping that Fastmail had something to deal with that problem.
Genuinely curious. Why is it posted and being upvoted here?
FM often(ish) posts blog posts that are very low key, sometimes they make it on HM, sometimes they don't.
There you go. They don’t know how to get there, but email’s getting faster and smarter and stuff.