{"id":9946,"date":"2017-09-10T06:07:01","date_gmt":"2017-09-10T06:07:01","guid":{"rendered":"http:\/\/www.lifeandnews.com\/articles\/?p=9946"},"modified":"2017-09-11T06:10:31","modified_gmt":"2017-09-11T06:10:31","slug":"the-only-safe-email-is-text-only-email","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/the-only-safe-email-is-text-only-email\/","title":{"rendered":"The only safe email is text-only email"},"content":{"rendered":"

Sergey Bratus<\/a>, Dartmouth College<\/a><\/em> and Anna Shubina<\/a>, Dartmouth College<\/a><\/em><\/span><\/p>\n

It\u2019s troubling to think that at any moment you might open an email that looks like it comes from your employer, a relative or your bank, only to fall for a phishing<\/a> scam<\/a>. Any one of the endless stream of innocent-looking emails you receive throughout the day could be trying to con you into handing over your login credentials and give criminals control of your confidential data or your identity.<\/p>\n

Most people tend to think that it\u2019s users\u2019 fault<\/a> when they fall for phishing scams: Someone just clicked on the wrong thing. To fix it, then, users should just stop clicking on the wrong thing<\/a>. But as security experts who study malware techniques, we believe that thinking chases the wrong problem. <\/p>\n

The real issue is that today\u2019s web-based email systems are electronic minefields filled with demands and enticements to click and engage in an increasingly responsive and interactive online experience. It\u2019s not just Gmail, Yahoo mail and similar services: Desktop-computer-based email programs like Outlook display messages in the same unsafe way. <\/p>\n

Simply put, safe email is plain-text email \u2013 showing only the plain words of the message exactly as they arrived, without embedded links or images. Webmail is convenient for advertisers<\/a> (and lets you write good-looking emails with images and nice fonts), but carries with it unnecessary \u2013 and serious \u2013 danger, because a webpage (or an email) can easily show one thing but do another.<\/p>\n

Returning email to its origins in plain text may seem radical, but it provides radically better security. Even the federal government\u2019s top cybersecurity experts<\/a> have come to the startling, but important, conclusion that any person, organization or government serious about web security should return to plain-text email<\/a>:<\/p>\n

\n

\u201cOrganizations should ensure that they have disabled HTML from being used in emails, as well as disabling links. Everything should be forced to plain text. This will reduce the likelihood of potentially dangerous scripts or links being sent in the body of the email, and also will reduce the likelihood of a user just clicking something without thinking about it. With plain text, the user would have to go through the process of either typing in the link or copying and pasting. This additional step will allow the user an extra opportunity for thought and analysis before clicking on the link.\u201d<\/p>\n<\/blockquote>\n

Misunderstanding the problem<\/h2>\n

In recent years, webmail users have been sternly instructed<\/a> to pay perfect attention<\/a> to every nuance of every email message<\/a>. They pledge not to open emails<\/a> from people they don\u2019t know. They say they won\u2019t open attachments without careful vetting<\/a> first. Organizations pay security companies to test<\/a> if their employees make good on these pledges. But phishing continues \u2013 and is becoming more common<\/a>.<\/p>\n

News coverage can make the issue even more confusing. The New York Times called the Democratic National Committee\u2019s email security breach somehow both \u201cbrazen\u201d and \u201cstealthy,\u201d<\/a> and pointed fingers at any number of possible problems \u2013 old network security equipment, sophisticated attackers, indifferent investigators and inattentive support staff \u2013 before revealing the weakness was really a busy user who acted \u201cwithout thinking much.\u201d<\/p>\n

But the real problem with webmail \u2013 the multi-million-dollar<\/a> security mistake \u2013 was the idea that if emails could be sent or received through a website, they could be more than just text, even webpages themselves, displayed by a web browser program. This mistake created the criminal phishing industry.<\/p>\n

Engineered for danger<\/h2>\n

A web browser is the perfect tool for insecurity. Browsers are designed to seamlessly mash together content<\/a> from multiple sources \u2013 text from one server, ads from another, images and video from a third, user-tracking \u201clike\u201d buttons from a fourth, and so on. A modern webpage is a patchwork of third-party sites<\/a>, which can number in the dozens. To make this assemblage of images, links and buttons appear unified and integrated, the browser doesn\u2019t show you where the pieces of a webpage come from \u2013 or where they\u2019ll lead if clicked. <\/p>\n

Worse, it allows webpages \u2013 and thereby emails \u2013 to lie about it. When you type \u201cgoogle.com\u201d into your browser<\/a>, you can be reasonably sure you will get Google\u2019s page. But when you click a link or button labeled \u201cGoogle,\u201d are you actually heading to Google? Unless you carefully read the underlying HTML source of the email, there are a dozen ways your browser can be manipulated to trick you<\/a>.<\/p>\n

This is the opposite of security. Users can\u2019t predict the consequences of their actions, nor decide in advance if the potential results are acceptable. A perfectly safe link might be displayed right next to a malicious one, with no apparent difference between them. When a user is faced with a webpage and the decision to click on something, there is no reasonable way to know what might happen, or what company or other party the user will interact with as a result. By design, the browser hides this information. But at least, when browsing the web, you can choose to start at a trusted site; webmail, however, delivers an attacker-made webpage right into your mailbox!<\/p>\n

The only way to be sure of security in today\u2019s webmail environment is to learn the skills of a professional web developer. Only then will the layers of HTML, Javascript, and other code become clear; only then will the consequences of a click become known in advance. Of course, this is an unreasonable level of sophistication to require for users to protect themselves.<\/p>\n

Until software designers and developers fix browser software and webmail systems, and let users make informed decisions about where their clicks would lead them, we should follow the advice of C.A.R. Hoare, one of the early pioneers of computer security: \u201cThe price of reliability is the pursuit of the utmost simplicity<\/a>.\u201d<\/p>\n

Safe email is plain-text email<\/h2>\n

Companies and other organizations are even more vulnerable than individuals. One person needs only to worry about his or her own clicking, but each worker in an organization is a separate point of weakness. It\u2019s a matter of simple math: If every worker has that same 1 percent chance of falling for a phishing scam, the combined risk to the company<\/a> as a whole is much higher. In fact, companies with 70 or more employees have a greater than 50 percent chance<\/a> that someone will be hoodwinked. Companies should look very critically at webmail providers who offer them worse security odds than they\u2019d get from a coin toss.<\/p>\n

As technologists, we have long since come to terms with the fact that some technology is just a bad idea, even if it looks exciting. Society needs to do the same. Security-conscious users must demand that their email providers offer a plain-text option. Unfortunately, such options are few and far between, but they are a key to stemming the webmail insecurity epidemic. <\/p>\n

Mail providers that refuse to do so should be avoided, just like back alleys that are bad places to conduct business. Those online back alleys may look eye-pleasing, with ads, images and animations, but they are not safe.<\/p>\n

\"TheThis article was written in collaboration with cybersecurity researcher and developer Robert Graham<\/a>.<\/em><\/p>\n

Sergey Bratus<\/a>, Research Associate Professor of Computer Science, Dartmouth College<\/a><\/em> and Anna Shubina<\/a>, Post-doctoral Associate in Computer Science, Dartmouth College<\/a><\/em><\/span><\/p>\n

This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Sergey Bratus, Dartmouth College and Anna Shubina, Dartmouth College It\u2019s troubling to think that at any moment you might open an email that looks like it comes from your employer, a relative or your bank, only to fall for a phishing scam. Any one of the endless stream of innocent-looking emails you receive throughout the […]<\/p>\n","protected":false},"author":44,"featured_media":9947,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8],"tags":[612,1521,3108,3109,3110,1634,3107],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/9946"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=9946"}],"version-history":[{"count":1,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/9946\/revisions"}],"predecessor-version":[{"id":9948,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/9946\/revisions\/9948"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/9947"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=9946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=9946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=9946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}