Bilingual

Shifting Cyber Norms: Microsoft security POST-ing to you - Bert Hubert's writings
a day ago
- Microsoft's email security scanners now execute JavaScript in email links, including POST requests, breaking single-use sign-on links.
- Historically, GET requests were considered safe and idempotent, while POSTs had side effects and were avoided by scanners.
- Website operators must now design systems to handle repeated or fake confirmations from security scanners.
- Microsoft's actions represent a significant shift in cyber norms without transparency or warning to users.
- The author calls for better accountability from tech gatekeepers like Microsoft under regulations like the EU Digital Markets Act.
Make people pay to get into your inbox
14 days ago
- Captchainbox helps protect inboxes from AI spam by requiring unknown senders to solve a CAPTCHA or pay a fee to reach recipients.
- The service scans email metadata to build a trusted sender list without reading messages, ensuring trusted contacts and introductions bypass verification.
- It offers a 7-day free trial with features like real-time filtering, calendar protection, custom auto-replies, and archival of emails without deletion.
- Setup takes 5 minutes, with pricing per inbox, and fees from senders are pooled for donation.
DKIM2 and DMARCbis Have Landed
23 days ago
- DKIM2 is a new version of DKIM that creates a verifiable chain of custody for emails, ensuring signatures remain valid through forwarding and preventing replay attacks.
- DMARCbis is the successor to DMARC, replacing the static Public Suffix List with a live DNS tree walk and retiring ineffective tags, while incorporating operational improvements.
- Stalwart v0.16.12 is the first mail server to fully implement both DKIM2 and DMARCbis, with a web-based playground for testing authentication without installation.
- DKIM2 addresses issues like replay attacks by including envelope information in signatures, and forwarding breakage via reversible recipes that allow verifiers to undo changes.
- DMARCbis simplifies policy enforcement with a testing flag (t), closes spoofing gaps for non-existent subdomains (np), and allows public suffix operators to declare their status (psd).
- The protocols are backward compatible, with existing DKIM and DMARC records remaining functional, enabling a gradual migration without disruption.

email security

Shifting Cyber Norms: Microsoft security POST-ing to you - Bert Hubert's writings

Make people pay to get into your inbox

DKIM2 and DMARCbis Have Landed