Department of Defense Now Blocking HTML Email

oKAMi-InfoSec writes "The Department of Defense (DoD) has taken the step of blocking HTML-based email. They are also banning the use of Outlook Web Access email clients. The DoD is making this move because HTML messages can easily be infected with spyware and executable lines of code that enable hackers to access DoD networks, according to an article in Federal Computer Week by Bob Brewin . A spokesman for the Joint Task Force for Global Network Operations (JTF-GNO) claims that this is a response to an increased network threat condition. The network threat condition has risen from Information Condition 5 to Information Condition 4 (also called Infocon 4). InfoCon 5 is normal operating conditions and Infocon 4 comes as a result of 'continuing and sophisticated threats' against DoD Networks. The change to Infocon 4 came in mid-November, after the Naval War College suffered devastating attacks that required their entire system be taken offline, but the JTF-GNO spokesman claims there is no connection."

Re:Better yet, just pitch all the email......

[Sepodati]

It still makes it through, it's just converted to plain text according to the article.

---John Holmes...

Good!

[porkThreeWays]

Good! HTML email is very annoying. Most of the time it doesn't display as intended anyway. Many clients will only support a safer reduced set of html thus only parts of the page will display properly. This makes the page even harder to decipher. HTML email is really only useful for spammers and advertisers usually anyway. If something needs to be that heavily formatted, attach it as a word processor document. If you can't get a basic idea across in plain-text, then the problem probably isn't because you are missing your bold tag.

Re:Good call

[Anonymous Coward]

I for one certainly don't miss the annoying pink backgrounds and purple text. But, you forget that a lot of internet based applications send out emails. So you should really include the developers in the losers category here.

I don't know how many email templates I've gone though in the past week converting them to be plain text (where necessary). This mainly applies to processes that include sending tabular data to a person.

Blocking? Looked to me they were just converting.

[MysticOne]

I work as a contractor to the Navy, and we received e-mails a few weeks back saying that HTML e-mail would no longer be allowed. However, they weren't blocking it, merely converting anything that was HTML to plain-text or RTF. I've not tested by sending an HTML e-mail to my .mil address (gonna try that in a few minutes), but I don't think they're actually blocking it.

Re:Doesn't that break digital signing?

[WED Fan]

If the content of the message is changed, isn't the digital signature invalidated? Or is the DoD just skipping the concept of digitally signing email?

The content doesn't change, just the rendering.

Slashdot strikes again......sigh.

[LibertineR]

Folks, the DOD is NOT blocking HTML mail, just converting it to plain text and disabling scripts, something ANY Exchange admin should already be doing in addition to Sender ID.

Instead of facts, we get just another bash Microsoft thread. Figures.

Re:Good call

[1u3hr]

you like your Italics, no?

Bad typing. There's actually a <?i> instead of </i> at the end of the first line. Preview is pretty slow, I usually just wing it.

Re:As They Should

[freakxx]

gotta give kudos to GMail. One of my favorite features is that it disables images until you turn them on.

well, Kmail also does similar thing. But unfortunately, no Kmail for windows. I really miss Kmail a lot when use Windows.
Thunderbird is also good but it hasn't implemented maildir format yet and mbox is a big pain in ass :-(