View source

From FastMailWiki

You do not have permission to edit this page, for the following reasons:

• The action you have requested is limited to users in the group: Users.
• You must confirm your e-mail address before editing pages. Please set and validate your e-mail address through your user preferences.

You can view and copy the source of this page:

===Privacy/Anti-Spam=== *(Done! But only partly. Some crafty tricks still get through. It's a ToDo.) Add a function that prevents remote content from being loaded whilst viewing HTML emails, in order to prevent web-bugs/beacons ''(Spammers use them to confirm they have a valid address that goes to a mailbox someone reads.) This would also need to block all other remote stuff to be effective: frames, gopher, objects, etc are commonly used too. Fastmail now blocks images, but not other remote content. -[[MrElvey]]'' I'm pretty sure we block everything that might be a problem these days. As part of the change to the new interface, we rewrote the defanging code (http://search.cpan.org/~kurianja/HTML-Defang/) and tested it against lots of nasties such as readnotify emails and stuff from http://ha.ckers.org/xss.html - RobM (2009-08-16) ===SPF=== [http://www.emaildiscussions.com/showthread.php?p=429865#post429865 DONE]. * Add a Sender Policy Framework (SPF) entry for the fastmail domain. This stops people spoofing my fastmail address, as has been occurring recently. Also check SPF entries on email (you may already be doing this - haven't tested). This is good practice and protects your customers from dodgy email. Most Australian government departments now publish SPF records to cut down on spoofing attacks. I expect major banks will soon follow. Greg912. :I suggest a poll on the forum about this first - to see if there are folks who object - users who wish to send mail with fastmail.fm in the from without using fastmail's SMTP server. It would, for example, be a problem for all Guest-level users who use email clients, because they aren't permitted to use fastmail's SMTP server. It might be a problem for some devices - perhaps there are phones that can be used to send mail from a fastmail address, but that aren't capable of using fastmail's SMTP servers via SMTP AUTH. OTOH, fastmail could at least make one domain available that has an SPF record. Would the requester switch to using and address at such a domain as their primary address if this was an option, e.g. SPFONLY.COM? --[[User:MrElvey|MrElvey]] 17:35, 11 August 2007 (CDT) :[[SPF]] has major design flaws and harmful side effects. FM's [http://www.fastmail.fm/docs/faqparts/SpamSettings.htm#JunkBackscatter Backscatter protection] is more effective than SPF at stopping people from spoofing fastmail addresses. See [[SPFIsNoCSV]]. P.S. What "fastmail domain"? There are many. If you want fastmail to set this up for a new domain, the flaws and side effects would only impact users of that new domain. --[[User:MrElvey|MrElvey]] 15:02, 19 September 2007 (PDT) ===Password Security=== *(DONE!) Provide the hostname/IP of the previous logins. At a minimum, do this when listing failed login attempts, e.g. on login, and maybe send email (for non Web Interface users) of failures too. ::''People are [http://162.42.211.151/forum/showthread.php?s=&threadid=12025 trying to guess] [[FastMail]] passwords!'' ::DONE! Web, IMAP, SMTP are logged (Options->Login Log). Failures appear on login screen for 2 weeks. Also logged: FastCheck and WAP ^{January 2006}, WebDAV and FTP logins too ^{March 2006}. [[User:MrElvey|MrElvey]] 16:09, 30 March 2006 (UTC) *Ability to clear out all server-side saved logins (i.e. if I do a "permanent login" from one computer but later want to disable that while accessing [[FastMail]] from a different computer.) ::''WORKAROUND: If you change your password, the cookies that allowed "permanent login" will no longer work - per Rob in a forum post in a thread I started.'' - [[MrElvey]]. *Never email passwords in the clear: "What surprised me is that [[FastMail]] password retrieval mails the actual account password, which I discovered the other day when requesting the password for my guest account. I'd mistakenly thought it was encrypted with a one-way algorithm and the retrieval request would generate a new temporary password." **- from [http://emailaddresses.com/forum/showthread.php?threadid=12025#post101174 this forum post] *As discussed in [http://www.emailaddresses.com/forum/showthread.php?s=&threadid=37205 this forum post], add a feature to SMS a one-time expiring password on request, to allow truely secure internet cafe access *Or, for a start, implement a simple [http://www.emailaddresses.com/forum/showthread.php?s=&threadid=38600 One Time Password] mechanism for use of the webmail interface in Internet cafes and on other untrusted systems. -lostgravity 2005-10-11 *Are username and password ''really'' sent securely from http://f-m.fm (not https:) if user clicks "Secure Login"? It seems to be sent in the clear, ''then'' a secure session is opened for mail reading. This seems misleading. ''Actually, they are sent securely. If you look at the page source and see what the action that clicking "Secure Login" does, you'll see that it is secure; I did this over a year ago and found that [[FastMail]] was doing this securely. (You could also use a packet filter to confirm this.) -[[MrElvey]]'' ''Yes, it uses javascript to change the form action to the https url when you click Secure Login. If javascript is not enabled on your browser, it shows a "Goto secure login" link instead - RobM (2006-04-02)'' *Verify Account SENDS THE USER'S PASSWORD IN THE CLEAR. This is easy to fix - If I manually add an 's' to http and reload, the login will be secure, the UI just needs to change to make this easier. [[User:MrElvey|MrElvey]] 16:09, 30 March 2006 (UTC) ''I've just updated the beta server to include a link on the page to switch to a secure version - RobM (2006-04-02)'' *Allow different username for login (Web/IMAP) and for address construction. At the moment, everyone who knows my e-mail address knows my login, except if I use only aliases in public. But aliases-only means not using subdomain addresses at all. If the login were completely independent of all e-mail addresses, it would be more difficult to guess. *Simple enhancement: Make the login log sortable by IP (not just login, service, and date).. Make the IP clickable for more info on the ip, like geolocation and hostname (e.g. to [http://www.ipchecking.com/?ip=98.248.113.11] or [http://whatismyipaddress.com/staticpages/index.php/ip-details?ip=76.191.212.41]) --[[User:MrElvey|MrElvey]] 21:20, 8 December 2009 (UTC) ===Secure login at ssl-mail.com=== 12/29/02: Make ssl-mail.com only allow secure login. ([http://www.emailaddresses.com/forum/showthread.php?s=&postid=81188&highlight=suggestion#post81188 see forum thread]) ===PGP encryption in the Web Interface=== If FM development team ever got really bored (hypothetical).. it would be nice if the Web Interface featured a personal PGP keyring and an option to transparently encrypt/de-crypt mail messages.<br> ''Either this is hard, or the Hushmail folks did a bad job at it. I find it <b>nearly</b> unusable for communicating with PGP/GPG users. - [[MrElvey]]'' ** I use hushmail and PGP and they are interoperable. Hushmail has its www.hushtools.com web site that allows you to upload public keys for people in your hushmail address book, and in the other direction, Hushmail provide a PGP key server - so it does work fine :) - davew666. ''I'm aware of the tools site! However, I found that when I actually tried to use the tools, I found that they didn't work. Have you actually used them to communicate with a PGP user? A GPG user? - [[MrElvey]]'' I would like to add that this is the single most value added feature that you could do. It is important to make it an open system (unlike hushmail) so that one could communicate with people who have different encryption software. I know PGP probably isn't possible however due to the licensing, but take a look at the new Squirrelmail GPG plugin! - Bishop PGP support would be a nice feature, but it's rather antithetical to the whole idea of PGP for the administrators of Fastmail to have your PGP keys. The 'right' way to do PGP is to have a local mail client and have the PGP encryption and decryption take place on that client. And doing that (a la hushmail) is hard. Though I recall that the source of hushmail's client app is available at no charge. :''I agree that having fastmail host your PGP signature would not be very satisfactory, but something is still needed, if only to verify that a mail sent by you from the web interface really does come from you. Therefore I suggest that, instead of using a personal key to sign emails at the web interface, you should have the option of signing with a generic fastmail.fm key. That way you can at least verify that the mail really does come from the fastmail.fm server. The the only issue would be the security of the web interface itself, but since this would, in terms of security, be the weakest point of the system anyway, I can't see that this would make much difference.'' :''What I have suggested would mean that on every mail your contacts get from you, whether it came from your desktop MUA or from the web interface, there would at least be some kind of digital signature or other. This would encourage those contacts to think consciously about issues of security and authenticity whenever they receive a message purporting to be from you. This in itself would be very valuable, considering how much most of us take the authenticity of emails we receive for granted.'' ::The existing headers are already pretty good at doing what you (the person whose comments I put in ''italics'' and indented) are asking. The Received header added by the recipient's server contains the IP of Fastmail's server. Unless the recipient doesn't trust his own server, this is reliable proof of origin <small>(unless NYI's AS in BGP gets hacked, and that would be big news, and is very unlikely)</small>. In addition, the X-Sasl-enc header is there; and that proves to fastmail's admins that an email was sent through their system, as well as who sent it, and when.--[[User:MrElvey|MrElvey]] 21:30, 8 December 2009 (UTC) ===S/MIME encryption in the Web Interface=== I wholeheartedly second the "PGP encryption in the Web Interface" suggestion, but I believe the S/MIME standard is becoming the norm for email encryption these days and therefore S/MIME should be implemented rather than PGP/GPG. S/MIME uses the same trust networks as HTTPS certificates; Outlook, Thunderbird, KMail, Evolution, even the newest Windows Mobile cell phones support S/MIME email encryption "out of the box"; PGP/GPG requires plugins, and PGP is proprietary. Every web client already knows how to decrypt information encrypted with a web certificate since that's required for HTTPS support, but I have no idea how to tap into that functionality from Javascript. Maybe send the encrypted content directly to the web browser as if it were a standard HTTPS page? If it were simple I guess someone would have done it already... ===Consider deprecating the cleartext login option=== Also, in this day and age is there any reason to have a cleartext login option? - Bishop ===Simple anti-virus for guest accounts=== *Rename attachments with nasty extensions, e.g. foo.exe to foo.exe:virus? Also, look in archives for executables, and rename the archive. ''We block certain problematic extensions entirely (eg .pif, .scr, .cpl, .com) and bounce the email telling the sender to re-send in a zip file - RobM (2006-04-02)'' ===Cookie to remember http: or https: mode=== *Use a persistent cookie to remember "secure login" preference, and always load the https: page if cookie is set. ''This happens already. If you do a Secure Login, it sets a cookie so that next time you go to www.fastmail.fm, it automatically immediately switches to https mode, which makes the Secure Login button the default button - RobM (2006-04-02)'' ===Filter outgoing mail for forbidden content/accidental disclosure=== Use the existing outgoing mail filter to help users keep data safe from accidental exposure. This would be particularly useful to corporate users. At its simplest, have the filter scan and block all outgoing mail, (whether sent via the website or SMTP) containing a specific text, such as "MK ULTRA" or "TOP SECRET" or "q2zw" or "CORPORATE CONFIDENTIAL". Perhaps the filter already does this - does it block the eicar 'virus' test string? Users would mark documents they didn't want accidentally (or maliciously) mailed, such as security system documentation with Better would be a system that would include user-specified content - say, part of of a user's social, credit card #s, etc. Of course, a malicious user could get around this system, but a lot of disclosure is accidental - I've seen it happen more than once. ---- In [http://www.emailaddresses.com/forum/showthread.php?postid=4024#post4024 post 4024], Jeremy says some reassuring things about [[FastMail]]'s security. [[FastMail]].FM uses djbdns, not Bind. Rob says some reassuring things [http://www.emaildiscussions.com/showthread.php?t=46421 in this thread]. [[Category:Suggestions]]

Return to FeatureSuggestionsSecurity.