Re:The only safe email is text-only email
by dm319 on Tuesday September 12, 2017 @06:19AM
(#15226119)
Problem is you've already received the rogue html before accessing the secure webpage. It's a shame email signing and encryption never took off.
[ Parent
| on HN ]
Re:The only safe email is text-only email
by alkonaut on Tuesday September 12, 2017 @07:16AM
(#15226362)
The solution assumed mail clients would be adapted to enforce this. So if you send me a forged email claiming to be from hsbc, the mail client would allow showing html content only from a https connection to somewhere on hsbc.
Kind of like the same-origin policy but where the origin is the domain the email claims it came from.