• @[email protected]
    link
    fedilink
    English
    193 days ago

    It still amazes me that the security concept against spoofing a number for phone calls and SMS is “Please don’t do that, it’s illegal”.

      • @pastermil
        cake
        link
        English
        5
        edit-2
        3 days ago

        Aren’t there more security measures in ensuring email credentials (assuming the user holds up their end)?

        • @[email protected]
          link
          fedilink
          English
          53 days ago

          Protocols to authenticate email senders exist, e.g. SPF and DKIM. Mostly an enterprise thing, though.

          • @[email protected]
            link
            fedilink
            English
            5
            edit-2
            3 days ago

            Unless I’ve seriously lost what “an enterprise thing” is nowadays, I wouldnt call SPF and DKIM (and DMARC for that matter) “mostly an enterprise thing” considering:

            • They are security measures implemented by default with all freemail providers

            • Almost all mail systems will block or flag any mail which isnt at least SPF authenticated

            • Gmail and yahoo now aggressively require DKIM and DMARC to be configured in order for mail to be delivered if delivered in bulk (this is in addition to their past SPF requirements)

            • We (my company) consider it a mandatory now in 2024 to guarantee mail delivery, even for our smallest clients.

            • @[email protected]
              link
              fedilink
              English
              43 days ago

              A lot of smaller businesses just aren’t bothering to deal with it right now, relying on getting the opposing IT department to just whitelist their address is apparently working for them with their mail volume. I am talking smaller businesses, but also not mom and pop stores, we’re talking national chains, etc. that just don’t care about the impact. That is also assuming that whoever manages the receiving mail server has even managed to keep a policy to block items that fail SPF/DKIM in the first place.

              Gmail and Yahoo are pushing and I love that, but they’re just a bit ahead of the game.