Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211214

Re: HTML mail

Show all headers | View raw

On 2019-07-11 16:10, Andrei POPESCU wrote:
> On Jo, 11 iul 19, 15:52:56, John Crawley wrote:
>> On 2019-07-11 15:25, Andrei POPESCU wrote:
>>> On Jo, 11 iul 19, 12:31:07, John Crawley wrote:
>>>> ...user agents that could deal with html in some sane way, and without
>>>> exposing the recipient to attacks. Simply not following any web links would
>>>> be enough I'd have thought? Or are there some more subtle attack paths?
>>>
>>> Yes, look up the EFAIL vulnerability (I posted a link in another
>>> message). It enabled a potential attacker to trick e-mail clients
>>> parsing html e-mail to decrypt an (old) encrypted message.
>>>
>>> In most cases users only had to open the message.
>> Since enforcing no-html, and particularly no-malevolent-html on all incoming
>> mail is not an option available to us, the only remaining choices for a
>> "good" MUA would then be:
>> A) Display html as-is, tags and all
>> B) Strip out the tags and display what's left, like html2text
>>
>> I think B) is the better option.
> 
> C) Treat *all* message parts as potentially harmful, not just some
> attachments. If additional parsing is needed (check signature, parse
> html, etc.) do so in a safe way.
> 
> Of course, this is not easy to do, especially if you insist on parsing
> all the bells and whistles in the html/css, which is probably why so
> many clients were vulnerable.

Fair enough. Easier if you don't insist on having all that stuff.
Thunderbird, anyway, let's you view message bodies as "Simple html", 
which I'm hoping avoids most of the vulnerabilities. Maybe it's 
something similar to the mutt/mailcap config Reco  posted earlier.

-- 
John

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: chromebook Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-09 19:00 +0200
  Re: chromebook Dan Purgert <dan@djph.net> - 2019-07-10 02:20 +0200
  Re: chromebook John Crawley <john@bunsenlabs.org> - 2019-07-10 03:40 +0200
    Re: chromebook Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 06:30 +0200
      Re: chromebook Joe <joe@jretrading.com> - 2019-07-10 09:20 +0200
      Re: chromebook <tomas@tuxteam.de> - 2019-07-10 09:30 +0200
        Re: chromebook Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 22:00 +0200
    Re: chromebook Reco <recoverym4n@enotuniq.net> - 2019-07-10 08:40 +0200
      Re: chromebook Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-10 15:10 +0200
        Re: mutt vs HTML (was: chromebook) Reco <recoverym4n@enotuniq.net> - 2019-07-10 16:10 +0200
      Re: HTML mail (was: chromebook) John Crawley <john@bunsenlabs.org> - 2019-07-11 05:50 +0200
        Re: HTML mail (was: chromebook) Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-11 08:30 +0200
          Re: HTML mail John Crawley <john@bunsenlabs.org> - 2019-07-11 09:00 +0200
            Re: HTML mail Gene Heskett <gheskett@shentel.net> - 2019-07-11 09:20 +0200
            Re: HTML mail Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-11 09:20 +0200
              Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 10:10 +0200
                Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 11:20 +0200
                Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 11:40 +0200
                Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 16:00 +0200
                Re: HTML mail Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-11 16:10 +0200
                Re: HTML mail Dan Purgert <dan@djph.net> - 2019-07-11 19:00 +0200
                Re: HTML mail Carl Fink <carl@finknetwork.com> - 2019-07-11 20:20 +0200
                Re: HTML mail John Hasler <jhasler@newsguy.com> - 2019-07-11 14:30 +0200
                Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 14:50 +0200
                Re: HTML mail Gene Heskett <gheskett@shentel.net> - 2019-07-11 18:00 +0200
                Re: HTML mail Thomas D Dial <tdial@acm.org> - 2019-07-11 21:30 +0200
                Re: HTML mail tomas@tuxteam.de - 2019-07-12 09:30 +0200
                Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 16:00 +0200
                Re: HTML mail David Wright <deblis@lionunicorn.co.uk> - 2019-07-11 17:20 +0200
              Re: HTML mail John Crawley <john@bunsenlabs.org> - 2019-07-11 13:20 +0200
  Re: chromebook Kenneth Parker <sea7kenp@gmail.com> - 2019-07-11 04:40 +0200
    Re: chromebook <tomas@tuxteam.de> - 2019-07-11 10:30 +0200
      Re: Own MTA is hard (was: chromebook) Reco <recoverym4n@enotuniq.net> - 2019-07-11 10:40 +0200
        Re: Own MTA is hard (was: chromebook) <tomas@tuxteam.de> - 2019-07-11 10:50 +0200
      Re: chromebook John Hasler <jhasler@newsguy.com> - 2019-07-11 18:40 +0200
        Re: chromebook <tomas@tuxteam.de> - 2019-07-12 09:40 +0200
          Re: chromebook Curt <curty@free.fr> - 2019-07-12 10:00 +0200
            Re: chromebook <tomas@tuxteam.de> - 2019-07-12 10:40 +0200
          [Off-topic] John Hasler <jhasler@newsguy.com> - 2019-07-12 16:00 +0200
            Re: [Off-topic] <tomas@tuxteam.de> - 2019-07-12 16:30 +0200
            Re: [Off-topic] Reco <recoverym4n@enotuniq.net> - 2019-07-12 19:00 +0200
              Re: [Off-topic] Diagonal Arg <debian.org@niwas.net> - 2019-07-17 04:20 +0200
                Re: [Off-topic] Nicholas Geovanis <nickgeovanis@gmail.com> - 2019-07-17 18:30 +0200
    Re: chromebook rhkramer@gmail.com - 2019-07-11 14:00 +0200
      Re: chromebook <tomas@tuxteam.de> - 2019-07-11 14:50 +0200
        Re: chromebook Keith Bainbridge <keithrbau@gmail.com> - 2019-07-17 06:30 +0200
          Re: chromebook Diagonal Arg <debian.org@niwas.net> - 2019-07-17 06:50 +0200
            Re: chromebook <tomas@tuxteam.de> - 2019-07-17 09:10 +0200

csiph-web