HTML email: Difference between revisions

Revision as of 00:07, 23 June 2024

Revision as of 01:04, 23 June 2024

Line 90:

== Security vulnerabilities ==

HTML allows a link to be displayed as arbitrary texthidden, sobut thatshown ratheras thanany displayingarbitrary the full URLtext, asuch link may show only part of it or simplyas a user-friendly target name. This can be used in [[phishing]] attacks, in which users are fooled into believing thataccessing a linkcounterfeit pointsweb to the website of an authoritative source (such as a bank), visiting it,site and unintentionally revealing personal details (like bank account numbers) to a scammer.

If an email contains inline content from an external server, such as a [[Digital image|picture]],

HTML allows a link to be displayed as arbitrary text, so that rather than displaying the full URL, a link may show only part of it or simply a user-friendly target name. This can be used in [[phishing]] attacks, in which users are fooled into believing that a link points to the website of an authoritative source (such as a bank), visiting it, and unintentionally revealing personal details (like bank account numbers) to a scammer.

retrieving it requires a request to that external server which identifies where the picture will be displayed and other information about the recipient. [[web bug|Web bug]]s are specially created images (usually unique for each individual email) intended to track that email and let the creator know that the email has been opened. Among other things, that reveals that an email address is real, and can be targeted in the future.

Displaying HTML content frequently involves the client program calling on special routines to parse and render the HTML-coded text; deliberately mis-coded content can then exploit mistakes in those routines to create security violations.{{cn}} Requests for special fonts, etc, can also impact system resources.{{cn}

If an email contains [[web bug]]s (inline content from an external server, such as a [[Digital image|picture]]), the server can alert a third party that the email has been opened. This is a potential [[email privacy|privacy]] risk, revealing that an email address is real (so that it can be targeted in the future) and revealing when the message was read.

HTML content requires email programs to use engines to parse, render and display the document. This can lead to more security vulnerabilities, denial of service or low performance on older computers.

During periods of increased network threats, the US Department of Defense has converted user's incoming HTML email to text email.<ref>{{cite web|publisher=nextgov.com|url=https://www.nextgov.com/cybersecurity/2006/12/dod-bars-use-of-html-e-mail-outlook-web-access/213308/|date=December 22, 2006 |title=DOD bars use of HTML e-mail, Outlook Web Access|accessdate=2024-06-22}}</ref>