News for hackers. Stuff that matters.

A comment on Ask HN: Best hosted alternative to Google Workspace for email?. Parent comment

Re:Ask HN: Best hosted alternative to Google Workspace for e... by brightball on Saturday February 05, 2022 @10:33PM (#30229114)
That’s a huge security issue! Geez.

If anybody realizes you’re using that service they can immediately impersonate you.

[ Parent | on HN ]
Re:Ask HN: Best hosted alternative to Google Workspace for e... by hda111 on Sunday February 06, 2022 @06:44AM (#30231653)
The email standards explicitly allow everyone to impersonate anyone. That’s why you should use S/MIME and PGP.
[ Parent | on HN ]
Re:Ask HN: Best hosted alternative to Google Workspace for e... by 15characterslon on Sunday February 06, 2022 @07:35AM (#30231966)
That's not true. SPF and DKIM were explicitly made to prevent email forging by authenticating the server, and the server is responsible for authenticating the user.

Please name even a single major mail provider that allows to send emails with arbitrary "from" headers.

https://datatracker.ietf.org/doc/html/rfc7208 https://datatracker.ietf.org/doc/html/rfc7489

[ Parent | on HN ]
Re:Ask HN: Best hosted alternative to Google Workspace for e... by brightball on Sunday February 06, 2022 @07:21AM (#30231872)
If you’re using DKIM to sign the outgoing message it’s a huge flaw if your service provider is signing other peoples emails with your key just because they included the domain. You authenticate to the server for a reason.
[ Parent | on HN ]