Snapchat Employee Data Leaks Out Following Phishing Attack

Re:Snapchat Employee Data Leaks Out Following Phishing Attack by josho on Monday February 29, 2016 @07:49PM (#11200038)

I thought we had this through SPF. Ie. Your mail server can reject mail if the domain doesn't match spf records in dns.

Maybe it's time to start something like an SPF Everywhere campaign.

[ Parent | on HN ]

Re:Snapchat Employee Data Leaks Out Following Phishing Attack by lazaroclapp on Monday February 29, 2016 @09:43PM (#11200458)

SPF Everywhere would be a start. But, as currently deployed, at least, SPF is nowhere near enough. I do research in security, and even I often have no clue, when faced with a new corporate email system, whether the email addresses I see can or can't be forged, depending on domain.

Hell, if I get [email protected] on my Gmail inbox, I cannot really tell whether even the @company.com part has been authenticated or not. There isn't even an HTTPS like lock icon or anything, let alone a "Google has verified that this email comes from Amazon.com" assurance.

[ Parent | on HN ]

Re:Snapchat Employee Data Leaks Out Following Phishing Attack by r1ch on Tuesday March 01, 2016 @07:00AM (#11202097)

SPF doesn't really do anything to prevent this. It can only protect the return path address, the scammer is free to use whatever From and Reply-To headers they like in the email itself - they don't really care if a bounce goes to the wrong place.

DMARC protects the From header, but isn't widely deployed.

[ Parent | on HN ]