<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div dir="ltr"></div><div dir="ltr"><br><blockquote type="cite">On 29. Jun 2021, at 16:13, Glenn Parker <glenn.parker@comcast.net> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
<style>
div.markdown { white-space: normal; }
body { font-family: sans-serif; }
h1 { font-size: 1.4em; }
h2 { font-size: 1.2em; }
h3 { font-size: 1.1em; }
a { color: #3983C4; }
blockquote a { color: #777777; }
blockquote blockquote a { color: #999999; }
blockquote blockquote blockquote a { color: #BBBBBB; }
math[display="inline"] > mrow { padding:5px; }
div.footnotes li p { margin: 0.2em 0; }
</style>
<div class="markdown">
<p dir="auto">I would be interested in a deeper discussion of the actual security threats that all this awkward 2FA/OAuth2/whatever are meant to address. I mean, I certainly understand the basic need for authentication (and encrypted transmission) to limit access to private information, but it seems like some folks are going way overboard for email here. All security is a tradeoff with convenience, like a fence around your property that limits free access to everyone, including yourself. So, it’s important to weigh the tradeoffs.</p>
<p dir="auto">To restate my question: what are the downsides to a compromised email account, and do they justify this level of access control?</p>
<p dir="auto">Users can perform a limited number of actions in the email universe: read mail, delete mail, reorganize mail folders, and send mail:</p>
<ul>
<li>
<p dir="auto">Read mail: private information could be exposed, obviously.</p>
</li>
<li>
<p dir="auto">Delete mail and reorganize mail folders: important (?) records or progress tracking could be lost or “misplaced”. (But, seriously, don’t use email for critical data storage).</p>
</li>
<li>
<p dir="auto">Send mail: IMHO, the biggest threat to an organization is the potential for social engineering via “authentic” appearing email.</p></li></ul></div></div></blockquote>And this is a big concern for the system administrators of these systems. I administrate an e-mail-setup which is a bit bigger. Phished e-mail-accounts mean that they suddenly send spam as authenticated users which you usually trust. I do not (can not) sort mail from my users into spam and they have to reach a high threshold to be denied completely - that is even higher than the score external spammers have to receive. <div>And in the end it means that I have to have measures to detect those mailers before my servers get onto blacklists which will be a problem for all of the users. </div><div><br></div><div>Besides that: nowadays pretty much any service nowadays relies on mail as authentication mechanism and you can reset passwords of accounts and take over these accounts which will lead to more damage for yourself. And there can be done a lot of damage when in a couple of hours. If you know in which time zone your target is, you can do everything in the night until they will notice that something is wrong. </div><div><br></div><div><br></div><div>Niels</div></body></html>