Webmail "safer" than Outlook?

  • Thread starter Thread starter louise
  • Start date Start date
L

louise

I have to access a few mail accounts on a daily basis, one of which
received about 75 spam messages per day. There are times when I
have to open a message and I'm not sure before I open it, whether
it's "real" or not.

In an effort to be careful, I access these two accounts using
webmail rather than my usual email program: Outlook.

However, after reading up on many AV programs, I'm not sure whether
I'd be "safer" having the email come through Outlook and be scanned
by NOD, or "safer" opening the occasional message within the
webmail environment.

Which method leaves my machine somewhat less vulnerable?

Louise
 
louise said:
However, after reading up on many AV programs, I'm not sure whether
I'd be "safer" having the email come through Outlook and be scanned
by NOD, or "safer" opening the occasional message within the
webmail environment.

Which method leaves my machine somewhat less vulnerable?
Click to expand...

Using a webbrowser means being vulnerable to every HTML exploit.

Juergen Nieveler
 
Juergen said:
Using a webbrowser means being vulnerable to every HTML exploit.
Click to expand...

Some online webmail programs allow you to read in Plain Text only.
Mine does, so email HTML exploits are a non-issue.

Haven't used Outlook in a long time, but I don't remember that it has
an option to read in plain text. Opening HTML spam, while still
connected to the internet, can/will get you tagged as a valid email
address.

Recommend you access your account at the webmail (in plain text),
delete all spams, and then download what is left.
 
Haven't used Outlook in a long time, but I don't remember that it has
an option to read in plain text.
Click to expand...

Depends on version.
2002, 2003 have it.
Can't remember about 2000.
 
Colin said:
Depends on version. 2002, 2003 have it. Can't remember about 2000.
Click to expand...

Thanks. Heh, I have an old O97 version, which I wouldn't use for email
anyway. Personally, I think Outlook is a business application,
suitable for use in a corporate environment, but way overkill for home
use. <g>
 
louise said:
I have to access a few mail accounts on a daily basis, one of which
received about 75 spam messages per day. There are times when I
have to open a message and I'm not sure before I open it, whether
it's "real" or not.

In an effort to be careful, I access these two accounts using
webmail rather than my usual email program: Outlook.

However, after reading up on many AV programs, I'm not sure whether
I'd be "safer" having the email come through Outlook and be scanned
by NOD, or "safer" opening the occasional message within the
webmail environment.

Which method leaves my machine somewhat less vulnerable?

Louise
Click to expand...

Newer versions of Outlook are pretty safe. NOD is also pretty efficient
at detecting malware attachments. As others have suggested Web-mail has
its own vulnerabilities to deal with.
 
On Tue, 09 Aug 2005 15:05:51 GMT, "Beauregard T. Shagnasty"

Hi BTS!
Haven't used Outlook in a long time, but I don't remember that it has
an option to read in plain text.
Click to expand...

It does. Worth noting also that some antivirus software allows you to
convert html email to rtf or plaintext upon send/receive.

But I guess it is also worth highlighing that HTML vulnerabilities
aren't the only ones out there - remember this MS01-020?
Opening HTML spam, while still
connected to the internet, can/will get you tagged as a valid email
address.
Click to expand...

Ugh! Damn those clever spammers :-)
Recommend you access your account at the webmail (in plain text),
delete all spams, and then download what is left.
Click to expand...

How about this - if your email server provides pop-access use Mozilla
mail or Thunderbird. This way your attachments will always be a click
away even when you are offline.
 
Ian said:
On Tue, 09 Aug 2005 15:05:51 GMT, "Beauregard T. Shagnasty"

Hi BTS!
Click to expand...

Howdy Ian,
It does. Worth noting also that some antivirus software allows you
to convert html email to rtf or plaintext upon send/receive.
Click to expand...

...for those who require a-v software. <g> Not sure if I (personally)
want another program messing with my email.

There's a sign on my door: "HTML Mail Not Welcome Here"
But I guess it is also worth highlighing that HTML vulnerabilities
aren't the only ones out there - remember this MS01-020?
Click to expand...

Yeah. IE 5.0, 5.5.
Ugh! Damn those clever spammers :-)
Click to expand...

Spammers are stupid .. but .. spammers are smart.
 
Newer versions of Outlook are pretty safe. NOD is also pretty efficient
at detecting malware attachments. As others have suggested Web-mail has
its own vulnerabilities to deal with.
Click to expand...
I phoned both ISPs - one does nothing about virus checking webmail
and the other blocks exe files and that's pretty much it.

For the moment I've made users for both accounts in Outlook. I'm
running NOD.

I do need to use Outlook as I run a small business. I use it as a
PIM and it synchs with my Palm, etc. I know I'm in the minority,
but aside from its security vulnerabilities, I actually like the
program :-)

Louise
 
I phoned both ISPs - one does nothing about virus checking webmail
and the other blocks exe files and that's pretty much it.
Click to expand...

One is half interested in Security - the other isn't interested at
all.
I do need to use Outlook as I run a small business. I use it as a
PIM and it synchs with my Palm, etc. I know I'm in the minority,
but aside from its security vulnerabilities, I actually like the
program :-)
Click to expand...

Just keep it updated and set EMON to 'convert email body to plain
text' and you should be even safer. Outlook looks nice but as was
mentioned previously is OVERkill for most home users. Perfect for your
application though - palm synching and all that caper.

I personally love The Bat! and Eudora. I use both!
 
Beauregard T. Shagnasty said:
Haven't used Outlook in a long time, but I don't remember that it has
an option to read in plain text. Opening HTML spam, while still
connected to the internet, can/will get you tagged as a valid email
address.
Click to expand...

That's why I prefer to use Thunderbird :-)

Juergen Nieveler
 
Thanks. Heh, I have an old O97 version, which I wouldn't use for email
anyway. Personally, I think Outlook is a business application,
suitable for use in a corporate environment, but way overkill for home
use. <g>
Click to expand...

Yes, we use it as a front end to a system that integrates mail
and group calendaring. Making this work required everybody to
go to the 2003 version, or use a web interface which, like
every webmail inteface I've ever seen, sucks. Happily this
means I can no longer get my work email from home - well, I
could, but not without a lot of messing about which I don't
care to get into.
 
Haven't used Outlook in a long time, but I don't remember that it has
an option to read in plain text. Opening HTML spam, while still
connected to the internet, can/will get you tagged as a valid email
address.
Click to expand...

It does? I can understand that replying to an spammer's email will tag
you as a vaild email address, but how does opening or reading (or even
just viewing in the preview pane) tag you?

I understand that to display html, you have to give away your IP, but
your email address?

Can you explain?

Shannon
 
Shannon said:
It does? I can understand that replying to an spammer's email will
tag you as a vaild email address, but how does opening or reading (or
even just viewing in the preview pane) tag you?

I understand that to display html, you have to give away your IP, but
your email address?
Click to expand...

Easy: In the HTML body are links to pictures that are loaded from a
spammers' webserver when you display the mail.

The link to the picture will contain a reference to the email address
used in the mail (sometimes coded, sometimes even in plain text) - so
the spammer just needs to check the logfile of his webserver to see
which of the millions of spams actually was viewed.

Juergen Nieveler
 
In said:
The link to the picture will contain a reference to the email address
used in the mail (sometimes coded, sometimes even in plain text) - so
the spammer just needs to check the logfile of his webserver to see
which of the millions of spams actually was viewed.
Click to expand...

But.. for the most part, do spammers evenbother with this anymore?

The "cost" of sending 100,000 or 100,000,000 spams is
so minimal that even if only 5% of them are valid
e-mail addresses, it's probably cheaper to just crank
them all out rather than pre-screen.
 
danny burstein said:
But.. for the most part, do spammers evenbother with this anymore?

The "cost" of sending 100,000 or 100,000,000 spams is
so minimal that even if only 5% of them are valid
e-mail addresses, it's probably cheaper to just crank
them all out rather than pre-screen.
Click to expand...

Depends. There's still people out there who try to flog their "verified
email accounts"-lists - such lists are sold at much higher prices than
normal lists.

Juergen Nieveler
 
Shannon said:
It does? I can understand that replying to an spammer's email will tag
you as a vaild email address, but how does opening or reading (or even
just viewing in the preview pane) tag you?
Click to expand...

As the others answered, your personalized parameters in the spam
identify you to the spammer, as long as you are still connected when
you open it. Even if you view it in the Preview pane (which is the
same as opening it). The name "web bug" was given to this practice.
I understand that to display html, you have to give away your IP, but
your email address?
Click to expand...

The spammer's web site logs will show your IP, and if the web bug
contains your email address, his script will capture that. Many of
them encrypt your identity, but it is a simple matter for his database
to compare and see who you are.
Can you explain?
Click to expand...

Read the source of the HTML messages ... especially those addressed
individually to you. Look for your email address, or long strings of
seemingly random characters hung onto a URL.
 
Beauregard said:
As the others answered, your personalized parameters in the spam
identify you to the spammer, as long as you are still connected when
you open it. Even if you view it in the Preview pane (which is the
same as opening it). The name "web bug" was given to this practice.
Click to expand...

....unless you use a mail reader where the loading of embedded remote
images can be blocked (e.g. Mozilla / Tbird).
 
Tore said:
...unless you use a mail reader where the loading of embedded
remote images can be blocked (e.g. Mozilla / Tbird).
Click to expand...

Of course! This also usually defeats the spammer's message. <g> But
the subject line of this thread is about Outlook.
 
Back
Top