171
Google now blocks spoofed emails for better phishing protection (www.bleepingcomputer.com)
submitted 2 years ago by to c/technology@lemmy.world
41 comments fedilink hide all child comments
 

Google has started automatically blocking emails sent by bulk senders who don't meet stricter spam thresholds and authenticate their messages as required by new guidelines to strengthen defenses against spam and phishing attacks.

As announced in October, the company now requires those who want to dispatch over 5,000 messages daily to Gmail accounts to set up SPF/DKIM and DMARC email authentication for their domains.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 2 years ago (3 children)

I'm sure they won't do this because it's too community friendly but they should just require all emails be digitally signed. If you don't sign it goes to spam and if you do sign, and abuse the system, it'll be much easier to find out who you are.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 2 years ago (2 children)

    TLS has become too easy to acquire for it to have any effect, I'm afraid. Didn't Chromium remove the padlock signifying HTTPs connection due to just that? That it doesn't really mean anything anymore in terms of illegitimate websites (still obviously crucial against MitM)?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Easy to acquire, yes, but not anonymously. The cert has to tie back to a domain or subdomain and there's a process to prove a domain belongs to whomever requested the cert. Long story short, if you wanted to sue or file complaint against a spammer that signs their emails then it's not really a challenge to trace back to the person or company doing the spamming.

    This still relies on domain name registrars, hosts (e.g. Gmail), and certificate authorities keeping proper records.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    Not sure about that. Phishing scams make sure to hide their identity really well and while something like .com might require your personal information, I can imagine .ru allowing anonymous registration. Once you've got a domain, getting a certificate for it with Let's Encrypt happen in seconds with no personal information iirc. Even if you'd need to disclose something, you could just lie. Let's Encrypt is highly automatized and I doubt anyone would check the information for some random domain. Yeah that cert/domain will be taken down quickly, but they're incredibly cheap and easy to create.

  • permalink
  • fedilink
  • source
  • parent