Email security related questions

Ruralmochaman

Hello.
I believe the forum here is more specific to GrapheneOS but I thought that because Graphene I'd security focused if I could get some input on email security related questions I'd appreciate it.

a. Sending and receiving email for the information contained. Is it trustworthy or can the email address that's exact with no alteration in spelling etc be spoofed?

b. Is it possible to preview the files sent to me without downloading them with zero risk in acquiring any malicious code or files etc?

c. If something malicious of any type is inside one of the files downloaded from that bad email, then can my device be taken over then and there?

d. If not. Downloading the file, can I at that point use an app to check the files before I open / or run them?

e. Is it possible that the files downloaded from the bad email after you choose to view them / open them, to actually be *ran* rather than simply opened? If so is there always a visible way to identify this happening?

f. Can any file or a program that's run after downloading that loses the device owners ability to use the device, be placed within an email. Or are these types of full device takeovers exclusive to other protocols / vectors than email?

Carrousel7956

Ruralmochaman on GrapheneOS, it's a pain to read the questions in that formed.

NoahRaketic

What is with this trend of people asking a series of questions, each on their own line in a code block? I've seen this at least two or three times recently.

raccoondad

Ruralmochaman

1) yes, check headers and verify links. Don't open links you don't know. Use filters related to DKIM and similar to prevent spoofing if your mail provider supports it

2.) No

3.) Stop opening files you don't trust

4.) Stop opening files you don't trust

5.) Stop opening files you don't trust

6.) Stop opening files you don't trust

Hope it helps!

erikfritzek

NoahRaketic may it be LLM markdown copied blindly?

phonenotworking

Ruralmochaman Please next time send it normally, this is a pain to read, especially from the phone.

Ruralmochaman

Carrousel7956

Yeah I had the questions written in Obsidian for brainstorming a way to ask them. When I pasted it into the browser section here it created that format, didn't think anything of it at the time.

I do agree, now that I see it -- looks rather awful. I'll keep this in mind for the future. I'm always looking for ways to better my writing and thus communication.

Ruralmochaman

raccoondad

Thanks for that, Racoondad.

When you say check headers, the header is the URL from the link? Also I usually copy the link text and then enter it into the URL in a separate tab. It does eliminate redirects that way as long as I check that the URL is the same as the link given in the email, or is there a different way to verify the links inside an email?

raccoondad

Ruralmochaman the header is the URL from the link?

No, the emails header. The question in response was related to email address spoofing, which headers and mail security features like DKIM would expose.

Ruralmochaman Also I usually copy the link text and then enter it into the URL in a separate tab

You shouldn't be accessing websites you don't trust in general as a rule of thumb.

Ruralmochaman

raccoondad

The rule of thumb is good.

My biggest issue is when I need an outreach coordinator for housing related assistance, transportation and more importantly housing applications. A way around downloading an application could be just having one physically mailed to me, filled out then sent via postage, or if they have a portal where no download necessary, other than that I'm out of ideas.

Also, if I find a website such as a gov one to acquire documents for information... The PDF version always wants me to download. Is it possible to download it to the browser only then view via PDF viewer or dies it need to actually be on the device to be opened?

Otherwise maybe not ever using PDF from those types of websites would dodge any spoofed ones completely, and I would likely be able to access the same information in a non PDF format?