79 pointsby ashurandi7 hours ago11 comments
  • PoignardAzur6 hours ago
    Reading the article, I kept thinking: "could you defeat this with an iframe?", and indeed:

    > One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.

    iframes should be the first layer of any defense-in-depth against user-submitted content.

    • purplemoonx2 hours ago
      Lol, should we go back to browsing "With Frames" or "Without Frames"
  • esprehn4 hours ago
    The frustration with the Gmail triager is typical unfortunately. Google teams have outsourced almost all user issue triage to contractors and the actual engineers don't interact with the community or users. Hopefully some Googler sees this and can get the Gmail team to fix it. The image proxy is useless if emails can trivially work around it.
  • Waterluvian5 hours ago
    This website was pretty nasty to my browser history and pretty much kidnapped my tab on mobile safari.
    • albinowax_2 hours ago
      That is not good, I’ll get it fixed. Thanks for flagging.
    • Wistar2 hours ago
      Yes, it breaks the back button on iPad/Safari
  • ksbd-pls-finish4 hours ago
    >When the user types this command Atlas will open some browser tabs and exfiltrate the victim's name from the current web page and send it to a remote server via the hash.

    But the remote server doesn't see the hash? This casts doubt into the content, since the attack was clearly not tested. Am I missing something?

    It's a pretty interesting post though, but hardly surprising - touching and rendering untrusted content is always risky.

  • Bender5 hours ago
    I view email in Thunderbird and have uBlock installed. Sadly the CSS Exfil addon for Firefox does not exist for Thunderbird but I view emails in plain text either way. I suppose I "miss out" on backgrounds, themes, animated GIFs. For me personally plain text is the way to go. Am I the only one using an email client these days? I prefer the client so I can keep my emails off the server and manage my own backups.
    • cassepipe15 minutes ago
      Using a email a free email provider with Thunderbird is a pain nowadays

      You can get away with not giving your phone only with google and outlook but you will need recovery addresses. For those I am using proton mail, they don't require anything and for those I have the recovery key saved somewhere.

      Also you will get error messages in thunderbird from outlook that it doesn't work... but it does work !

      I did all that in anger but if I had to do it again I would just use one of those super cheap provider where you pay 1$ a month or even by usage and use TB with that.

      Hey mail, fastmail, they all look great but I don't even pay that much to my bank or any other services so no way I am spending 5 euros or more a month for email

    • graemepan hour ago
      Email clients have a much better UI too.
  • branon5 hours ago
    One thing I've found that purports to address (some of) these risks: https://mail.cock.li/cock-mail/

    Haven't tried it yet though, done some reading but don't know enough to be sure their proposed paradigm is valid.

  • ashurandi6 hours ago
    Would a hard isolation model for HTML email be a better long-term solution, or is that impractical for reasons I’m missing?
  • desro6 hours ago
    Allowing anything other than plain text in email bodies was a terrible mistake.
    • upofadown3 hours ago
      It was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent time considering the potential downsides with the aim of making HTML email practical and secure.

      HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.

      • Arnt3 hours ago
        There was one, in the IETF. It went like this: "We should have a HTML profile, somewhat restricted, so that the people who want to send bold and italic and a little more can do that, and composers can know what's okay, and javascript isn't" and a little discussion, and then came people shouting "EVERYTHING EXCEPT TEXT/PLAIN IS THE DEVIL'S WORK!" and the whole thing dissolved due to the noise.
      • chuckadams2 hours ago
        It was allowed before HTML even existed: MIME was invented for email.
      • ranger_dangeran hour ago
        > It should be rejected/ignored if you are at all concerned about privacy and/or security.

        This is actively harmful advice that could easily get someone fired.

    • iammrpayments3 hours ago
      Ecommerce loves html in email, it would be interesting seeing them reverting to plain text but the backlash would be too great
  • pluc6 hours ago
    > This page requires JavaScript for an enhanced user experience.

    Yeah no shit.

    • thunderbong6 hours ago
      You're certainly welcome to browse the internet without JavaScript.

      But when most of the articles submitted here don't work without JavaScript, this comment seems really irrelevant.

      • appplication4 hours ago
        I do not understand the anti-JavaScript folks here. This is a forum that celebrates all sorts of automation, but now when a website wants to run automations that is agitating?

        I guess my question would be why does something so benign and common aggravate you so much? That feels like an exhausting way to live.

        • wasmperson19 minutes ago
          There are several reasons someone might prefer to use websites that work without JS:

          - The page will load noticeably faster (and likely be faster in a number of other ways).

          - The semantics are more predictable (buttons, links, scrolling, text selection, find-in-page, etc. all behave the same as on other websites).

          - The page will work in Tor Browser's "maximum security" setting.

          - The page is more likely to work better in screen readers or with other less-commonly used web browsing tools.

          - The page is more likely to work in older browser versions.

          - It used to be that a JS-free page had lighter CPU usage, though newer CSS features and browser setTimeout/setInterval throttling have changed the balance somewhat.

          - The page does not require running untrusted/proprietary code on your computer (the browser sandbox is a small comfort).

        • pluc4 hours ago
          There's no reason to require JavaScript to render rich text especially when it's an article about CSS prowess.
        • semolino4 hours ago
          Most webpages that function as simple documents can be built without JS. If you build webpages, you probably have an intuition for what kind of functionality necessitates JS. When a webpage requires that users enable JS, then, when it doesn't seem like it should need it, that's a signal of either developer laziness or nefarious behind-the-scenes activity (tracking, etc.).
          • true_religionan hour ago
            After writing a long article, creating videos, images, and no doubt doing multiple rounds of edits... why should an author also have to ensure that their publication works without JS?

            From what I can see, they're doing so codeblocks have proper highlighting but also can be copied & pasted. It's a reasonable choice.

            They're not lazy. They even have long, accurate alt tag descriptions for all their images.

            If I would guess, they have an inherent desire to see their work viewed in exactly the way it was intended, so they deliberately refuse progressive enhancement when it's a matter of reader choice. The visually impaired who have no choice are accommodated. Anti-JS readers are not.

        • GoblinSlayer2 hours ago
          JavaScript is an RCE vulnerability. Browsers literally execute it as "run this malicious code in a vm, then nuke the whole thing from the orbit".
        • ksbd-pls-finish4 hours ago
          I dislike JS, because I don't want to let random websites to run arbitrary code on my machine.

          Most importantly, enabling JS makes it much easier to spy on users, so I automatically assume that the website tries to spy on my and feel attacked.

          I agree it's not healthy, and I didn't care about privacy that much in the past. I guess this may be caused by my work experience.

        • javascripthater4 hours ago
          [flagged]
      • graemepan hour ago
        Most articles submitted here do work without JS in my experience, including this one. I just tried the current top five articles and all work, except that github does not load everything (the main text does load, the commit message and time for each file or directory does not).
  • fragmede6 hours ago
    > In this section I targeted Fastmail, ProtonMail, Gmail, Cowork and Slack.

    Oh that's all, is it?

  • nickcw28 minutes ago
    Here is an idea...

    Why don't we give up on HTML in emails and just use markdown instead? It is readable and writable by humans and doesn't have insane security problems.

    It seems to be our AI overlords' preferred communication format too so it would future proof email for the aipocalypse.

    This would, alas, make the the people sending you marketing emails very unhappy. Maybe they could attach a PDF instead, I'm sure that would be safe.

    /s