Nearly all 2020 presidential candidates aren’t using a basic email security

Re:Nearly all 2020 presidential candidates aren’t using a ba... by jrockway on Tuesday April 30, 2019 @10:14AM (#19788085)

To setup DMARC, you add a text record like _dmarc.example.com with content like "v=DMARC1; p=reject" (or perhaps a more permissive or canaried policy).

I am not sure if Google sets it up automatically. I have no memory of setting it up for my gsuite domain... but the record is there. I probably added it at some point though.

The advantage of DMARC against phishing is that people without access to your email server can't impersonate people in your organization. If you tried sending me an email with a "From: [email protected]" header, it would be rejected by my server and I would never see it. This makes it much more difficult to spearphish someone. If you could send an email "this is your boss, look at the From: field, now click my link!", a lot of people would click that link. If the From: field is "[email protected]", you might think twice.

Every little bit helps.

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by sokoloff on Tuesday April 30, 2019 @10:54AM (#19788457)

Wouldn't someone still be able to send mail from jon@jrơck.us and even have it pass DMARC and DKIM checks if they bought that domain? (last o being a ơ [ơ])

I wrote that fake address, I know where the defect is, and I can't spot the difference on my screen right now. It just looks like the other 50 specks of dirt on my laptop screen.

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by egwynn on Tuesday April 30, 2019 @11:40AM (#19788913)

One common way to defend against a partial (or full) homograph attack is to have clients render IDNs as punycode. The downside is that it kinda pulls the plug on non-ascii domains. :-\

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by nine_k on Tuesday April 30, 2019 @08:58PM (#19793575)

It has a reasonable workaround: check that all glyphs belong to the same writing system. That is, post.com should have all glyphs from Latin, почта.рф, all glyphs from Cyrillic, and ταχυδρομείο.ελληνικό must have all letters Greek. The fact that the Latin, Cyrillic, and Greek glyphs have same-looking glyphs like o or p is not dangerous if you can't mix them up.

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by egwynn on Wednesday May 01, 2019 @02:32PM (#19800189)

That's a cool idea and will normally work, but won't prevent homograph attacks entirely. Identities can still be spoofed if they can be constructed entirely from glyphs in the intersection of two unicode blocks. E.g. `ΝΙΚΕ.ϹΟΜ` and `NIKE.COM`.

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by nine_k on Wednesday May 01, 2019 @02:36PM (#19800229)

Lowercasing them would let the user tell the lowercase L from uppercase i.

But I agree, some things may need to be special-cased.

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by tomatotomato37 on Tuesday April 30, 2019 @11:42AM (#19788935)

That should be preventable if their email clients allow restricting unicode

https://www.unicode.org/reports/tr39/#Restriction_Level_Dete...

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by jrockway on Tuesday April 30, 2019 @06:40PM (#19792712)

Yeah, I don't think DMARC helps with that. jon@jrơck.us won't key into the corporate directory, though, so someone should at least think something is amiss. (I thought my screen was dirty.)

[ Parent | on HN ]

Re:Nearly all 2020 presidential candidates aren’t using a ba... by erichurkman on Tuesday April 30, 2019 @10:48AM (#19788402)

If you have the domain through Google Domains and set up email through GSuite, they can set up DMARC automatically.

[ Parent | on HN ]