Department of Defense Now Blocking HTML Email 262
oKAMi-InfoSec writes "The Department of Defense (DoD) has taken the step of blocking HTML-based email. They are also banning the use of Outlook Web Access email clients. The DoD is making this move because HTML messages can easily be infected with spyware and executable lines of code that enable hackers to access DoD networks, according to an article in Federal Computer Week by Bob Brewin . A spokesman for the Joint Task Force for Global Network Operations (JTF-GNO) claims that this is a response to an increased network threat condition. The network threat condition has risen from Information Condition 5 to Information Condition 4 (also called Infocon 4). InfoCon 5 is normal operating conditions and Infocon 4 comes as a result of 'continuing and sophisticated threats' against DoD Networks. The change to Infocon 4 came in mid-November, after the Naval War College suffered devastating attacks that required their entire system be taken offline, but the JTF-GNO spokesman claims there is no connection."
Good call (Score:5, Insightful)
Re: (Score:3, Informative)
I don't know how many email templates I've gone though in the past week converting them to be plain text (where necessary). This mainly applies to processes that include sending tabular data to a person.
Re: (Score:2)
which raises the question: why don't they just strip html out instead? it will probably require more work to make sure nothing gets through, but i think that it might be worth it.
Re: (Score:2)
They do. "A Navy user said that any HTML messages sent to his account are automatically converted to plain text." But if you've used tables or such the layout will probably be trashed, so better to reformat as plain text to begin with.
Using something like Lynx to filter HTML into plain text would give pretty good results, it does tables fairly well.
Re: (Score:3, Informative)
Bad typing. There's actually a <?i> instead of </i> at the end of the first line. Preview is pretty slow, I usually just wing it.
Re: (Score:2)
however when developing i do sometimes use html because it makes reading tabular data and such much easier to read at a glance. true you could use plain text for these but with lots of information it makes it difficult to quickly extract the information you need.
Re: (Score:2)
P.S Merry Christmas to all you Slashdotters, Linux users, MS fan boys and Trolls.
Too late... (Score:4, Funny)
Don't worry, they were already losers!
Re:Your Sig (Score:2)
Re: (Score:3, Interesting)
I also wonder when other organizations will follow suit.
not entirely (Score:3, Insightful)
Outlook did me the favor the other day of removing the "extra" line breaks, screwing up the already limited formatting I was stuck with. People
Re: (Score:2)
Re:Good call (Score:5, Interesting)
If you are DOD and you want to get Commercial Off the Shelf (COTS) products to resolve your problems without hiring the massively expensive solutions of 1 off stuff built to design, you must be able to accept attachments such as .zip and html mail. Sorry but the commercial guys cannot even tell you what they are doing anymore without this stuff. DOD costs just got higher!
I worked one DOD site where we had to email files of code. The volume of the attachments was beyond the Email limits so we had to zip the files. The filters blocked .zip. So we renamed the files .aaa or something like that. Then the filters didn't catch the files. That way we could get the emails. We had to break our own security just to do our job. This stuff is a real problem.
The US DOD needs to can Microsoft. If they were to run Linux or Apple systems and then to sandbox all emails and web browser stuff under the OS a lot could be done and things would be much more secure. The basic problem is a Microsoft logical design construct. Microsoft thought that they should own your computer and you should rent it from them. Under these conditions they wanted "their" computers to be remotely controlled by various means. The means they designed into their constructs also leave sucking security holes which hackers and other malware designers just walk right through.
There is a real reason most DOD people stick like glue to Microsoft. For Network security people in the DOD they are as worried that some subordinate might actually control his machine as they are of having foreign control. (Foreign to their system) As such they must keep central control. This is the Microsoft construct at a second level. The DOD system I worked on had an entire base having one root password that didn't change folks because of this demand. Linux etc doesn't conform to this as naturally as MS systems. Another level of this sticking like glue to MS systems comes from the fact that most of the people who program (contractors etc) for the Government like to keep their jobs. MS systems do not support legacy software well. As such they are continually "re-inventing the wheel" so to speak and it makes for lots of jobs that last a lifetime. It holds the DOD hostage to continually hiring the same contractor because his software is proprietary and cannot be easily "reverse engineered" without risk of software copyright violations. In the end this synergy of profits and control leaves the US DOD bleeding money, never able to do its job as effectively and wedded to MS systems.
If the taxpayers get involved they will ban such OS like Microsoft because this is completely contrary to the interest of the taxpayers. It however; requires the US DOD to recognize that its only true security lies in the loyalty of its people. In doing so it will have to retract from foreign (non-USA) suppliers and contractors. It will have to seriously look into who it is hiring and it will have to weed out those it has on payroll who are being more selfish than loyal. Let me assure you that if this situation is dealt with properly it will be a top to bottom 10 on the Richter Scale earthquake in US Government operations. Imagine if you will actually not being able to have the management read every document in someones computer without them knowing. Imagine having someone who works for you who you actually have to be able to trust! Imagine real government security! (WOW!)As They Should (Score:5, Insightful)
I guess I should get back to chiseling my notes on stone slabs now.....
Re:As They Should (Score:5, Funny)
Email should be just text, period.
In my day email was dashes and dots, and we liked it that way.
Re: (Score:2, Funny)
Re:As They Should (Score:5, Interesting)
Personally I'd miss the formatting features of HTML. Bold, Italic, etc. I'm a little surprised there hasn't been a middle ground estbalished at some point. You know... pretty text, no exploits. Well, I can dream. In the mean time, gotta give kudos to GMail. One of my favorite features is that it disables images until you turn them on. That's a feature Outlook 2000 could have used.
Re: (Score:2)
Re:As They Should (Score:5, Funny)
I think that you have
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
LOL. If the OP wants bold and underlining in his emails, I'd suggest he starts with reading
T^HTh^Hhe^He M^HMu^Hut^Htt^Ht E^HE-^H-M^HMa^Hai^Hil^Hl^HCl^Hli^Hie^Hen^Hnt^Ht
Personally, I'd find that annoying, like every other attempt to be interesting, or creative or otherw
tables are HARDER, no? (Score:2)
Re: (Score:3, Interesting)
You should be aware that there has been such a format [wikipedia.org] for quite a while, using the MIME type of text/enriched. I used to receive quite a few emails that used it (no, I don't remember what the originating client was and I'm not interested in looking it up right now) but it never seemed to catch on more widely. (At a wild guess, that's because Outlook didn'
Microsoft RTF (was text/enriched) (Score:2)
I chose RTF as the format for my reply. I thought that was reasonable. (I forget what mail client I was using- maybe Eudora.)
They wrote me back, again in RTF.
"WTF is this? We can't open it."
No, not WTF.
Microsoft RTF.
Re: (Score:2)
Re: (Score:2)
There is. Enriched text:
http://www.ietf.org/rfc/rfc1896.txt [ietf.org]
Which is really just a subset of HTML for the most part.
Re: (Score:2)
There is (was) a "rich text" for email, looked like a subset of HTML. It was used by early versions of Eudora and other mail clients. I think we can blame Netscape for putting HTML into email, and this was cemented when Outlook came along and started doing it by default. All the other mail clients had to follow though they knew it was a Bad Idea.
My middle ground - both (Score:3, Insightful)
I read all my e-mail as "plain text". After all, HTML is plain-text too.
95% of the time that is all you need. Yeah, I can see they marked it italics or bold, but they are the same words.
If, after looking at the "raw" text, and I really think the formatting will convey some additional info, I might look at it as "html". Looking at the raw text gives you a pretty good idea if there is anything sinister about it.
In my experience,
Re: (Score:3, Funny)
Be... all that you can be... in ASCII (Score:2)
Re: (Score:2)
Re: (Score:2)
I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with <FONT SIZE=8 COLOR=BLUE> [1]. Text is wonderful because it allows me to specify the color, font family, and size of the email so I can read the blasted thing.
Plain text isn't perfect either. Things like text formating is often done in awkward ways that can get screwed up fairly easily. (The 80 column line wrapp
Re: (Score:2)
I don't know how old you are, but I'm still a college student and I share your feelings as well. What annoys me the worst is that retarted mail client called Outlook that has a love afair with .
ARGH! I know exactly what you mean. I used to work at a mostly MS-dominated company, full of people using Outhouse and MSexchange, and most e-mails would have those defaults, which would appear at an annoyingly small size under the OS X mail program. I always had to just give up and hit the command keys to show them as plain text. Having a mail program specify the font size BY DEFAULT in HTML mail is completely and thoroughly brain damaged, doubly so when the default is so small.
And there's a small a
Re: (Score:2)
For those who are interested, this is one of the (many) moves the DOD has taken over that past year or two in response to the continuing series of "F" grades DOD networks have received regarding their security. I'm the CIO at my command; I've had the "joy" of implemeting these changes - I took over the job right around the time the changes started.
Better yet, just pitch all the email...... (Score:2, Insightful)
Although the focus is on Outlook, it seems like there's an outside chance there may be other clients and web interfaces (namely all of them) that are vulnerable to most of the same problems....
Re:Better yet, just pitch all the email...... (Score:5, Informative)
---John Holmes...
Doesn't that break digital signing? (Score:5, Interesting)
Or is the DoD just skipping the concept of digitally signing email?
Re: (Score:2, Informative)
The content doesn't change, just the rendering.
The HTML determines the rendering. (Score:4, Insightful)
Therefore, the digital signature will no longer reflect the "data" portion of the message and will be invalid.
Re: (Score:2)
You could still sign plain text and send that. Or send an attachment with a detached or builtin signature. Microsoft Word documents could have a signature and timestamp through the USPS Electronic Postmark system.
Re:Doesn't that break digital signing? (Score:4, Insightful)
Re: (Score:2)
By way of a Windows GPO the ability to compose email in HTML format is completely disabled. The default format for Outlook has been set to "Rich Text" so that people are still able to use a small subset of formatting. Users are capable of composing in plain text, but most will stick with the default.
Additionally, the Outlook preview pane is set to "convert" all inbound email to plain text. Ho
Stupid (Score:3, Interesting)
Re:Stupid (Score:5, Insightful)
Up-to-date patches would mitigate those, but do you think somebody might be saving some zero-days for the DoD?
Re: (Score:2)
software stupidity (Score:2)
The fact that none of the major E-mail clients can be trusted to do this is a testament to the sad state of software engineering.
Re: (Score:2)
I think it's more that to get the same look as intended by the sender using an MS client, you have to use the IE renderer built in to Windows. Otherwise people complained it looked wrong. And this was no doubt a lot easier than writing your own renderer and keeping it up to date.
Personally I stick with an ancient version of Eudora, which does have its own renderer. Sometimes i
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
While its true that many users unwittingly generate HTML email, pretty much all clients that do g
Re: (Score:2)
I know what calendaring does (and note that there are free alternatives to Outlook under development [mozilla.org]) but what are "public folders" and "centralized rules administration"? Are public folders like an NNTP server, possibly with server-local or domain-local groups, which Thunderbird handles excellently? (Googling for "centralized rules administration" doesn't seem to lead to much enlightenment; too many other probably-unrelated sche
Re: (Score:3, Insightful)
Re: (Score:2)
Rendering engines aren't rewritten frequently. Typically the code you have available for reuse supports many features you don't want: embedding, javascript, images (don't forget the GDI exploit). It is true that you can provide knobs to disable these dangerous features in the rendering engine. *BUT* have you ever been involved in real software verification efforts? Too many knobs means too little coverage.
Writing good tests is hard.
Re: (Score:2)
Re: (Score:2)
Maybe in the utopian land of happiness and glee. But for those of who live in the real world, it doesn't work so well. The fact is that software is buggy, and the more features it has, but buggier it tends to get. Security isn't a black and white thing. Most of the real decisions us real people have to make is based on a number of factors that we aren't quite certain about. Something like HTML email provides a much larger surface of attack and potential places for programmers to screw up. The most mail clie
Re: (Score:2)
Can you please point me to this option. Thanks.
Re: (Score:3, Interesting)
Let them outsource! (Score:2)
Re: (Score:2)
Um, they just did enact a solution.
And, no. You don't really have Indian outsourcing operations involved in the day-to-day admin of communications to and from the Pentagon. No.
Re: (Score:2)
Also compared to what was happening they were not outsourcing it, since it was already outsourced, it was run by company based in another country. That was the only funny thing about about the whole thing, the Democrates were there yelling how about some evil forgein country would run the operation when a forgein country was
That's pretty obvious! (Score:4, Funny)
I applaud the effort, but why did they take so long to wise up even this much?
Still ways to get email from outside the network (Score:5, Interesting)
So instead of just plain old OWA sitting out there waiting for anyone to type in a username and password, they've upped the security a little bit. Yes, it's making us jump through hoops a little (for myself, need to stand up an ASA5510 as a VPN concentrator to receive outside connections), but it's not impossible.
Besides... not being able to check your work email from home can only be a good thing, no?? I know, I know, it's for people on travel, leave, etc. too...
As for the "blocking" of HTML email, can't say that I've seen that at all. Maybe it's only for emails that originate from outside of the network since we use HTML email all the time from within Outlook (formatting is useful in this case).
---John Holmes...
Moronic Policy (Score:2, Funny)
Re: (Score:2)
Good! (Score:5, Informative)
Re: (Score:3, Insightful)
Re: (Score:2)
"Alice, Bob and I have read your earlier queries and here are our replies. The black text below is the specific part of your email that we wish to comment on; the blue text is Bob's comments; the red text is my comments."
Temporary? (Score:5, Interesting)
If the Infocon levels work anything like the other readiness levels in the DoD, then a shift to Infocon 4 requires a change (temporary) in policy. So it seems that a shift back to level 5 would mean HTML e-mail is no longer blocked.
It's like after 9-11, when all DoD installations had much stricter physical access rules and extra guards at the gates.
Which is a shame, because saying goodbye to html email entirely would be fine by me.
Re: (Score:2)
Who knows, maybe they will 86 MS LookOut.
LoB
Blocking? Looked to me they were just converting. (Score:2, Informative)
I've been doing this for work for ages (Score:2)
There's no excuse for it (Score:2, Insightful)
If you don't know how to use HTML, you shouldn't use it, period.
I know this is redundant, but... (Score:2)
Re: (Score:2)
Given the topic of the OP, there's definitely some sort of irony here.
Re: (Score:2)
HTML doesn't belong in emails.
And the problem with this is? (Score:2, Interesting)
I block html email myself simply because it is annoying and 90+% is spam anyway. Why is this a problem?
Re: (Score:2, Insightful)
data + code = screwed (Score:2)
That said, it's the JavaScript, not the HTML - formatting is data not code.
Now if only they would figure out the same about Word/Excel.
why doesn't Microsoft indemnify such flaws (Score:2)
LoB
Slashdot strikes again......sigh. (Score:5, Informative)
Instead of facts, we get just another bash Microsoft thread. Figures.
NMCI goes even further (Score:5, Interesting)
A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.
Most, including middle management, refer to NMCI as No More Computing In-house.
In order to get idea just how bad things are, upper management conducted "customer satisfaction surveys". Even though the NMCI program office controlled the content, distribution, and analysis of the survey the results indicated overwhelming dissatisfaction. The NMCI program office has declined to release the raw data from the survey, instead issuing a release about the results. Rear Admiral J. B. Godwin III said releasing the results would challenge the "integrity of our data." Hmmm....
Most Navy labs that are under the burden of the NMCI contract maintain two networks, the legacy and the NMCI - the one to get work done on an the other to read email. This leads to double the costs and double the vulnerability exposure, and halves the resources to concentrate on security and usability.
Worst I hear that the Navy just extended the contract to 2010. Your tax dollars at work.
Re: (Score:2)
Of course, paying $5000 for a shitty computer sucks ass. Plus what, $500 per user? On top of that, you have to pay retail for every app you want.
I have a CD-Burner in my NMCI machine. If I want NERO installed, I have to pay $300 for a cd-burner (because my build does not show a burner even though any idiot c
NMCI: One of the great defeats in Naval history (Score:2)
A NMCI laptop takes over 10 minutes to boot and load the dozens of background processes and roving preferences. Once booted the machine is near useless performance wise.
That is so true. The Navy needed technical standards, not NMCI. The organization is too big and diverse for a one-size-fits-all solution. Application development has all but stopped outside of San Diego and EDS is running...or should say ruining...most of that. Layers of process and bureaucracy between the users and a usable product.
Enemies! (Score:2)
Damn - there goes my (to be patented) security (Score:2)
Good! As an IT guy it pisses me off! (Score:2)
Merry Christmas by the way.
Incidentally, if those bloody angle brackets are the wrong way round - blame the sodding HTML! Merry Christmas again... and yes, I've been out getting lathered, deal with it!
In most contexts, this is overkilll, but DoD... (Score:2)
Why Treat Only Unknown Senders as Hostile? (Score:3, Funny)
From: Donald Rumsfield
To: General Whosit
Subject: My final Orders
This email contains a computer trogan.
You are so pwned!!!
Sincerely
Osama Bin Ladin.
____
Yeah... Typos are on purpose
Converting Gateway (Score:2)
Then again, maybe they use Exchange, and can't implement something of this sort. I know it is, if not trivial, relatively easy to implement on many F/OSS MTAs (namely exim).
Re:I like some HTML email (Score:4, Insightful)
* what
* the
* hell
* is
* wrong
* with
* asterisks?
Re:I like some HTML email (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
one more point (Score:2)
Re: (Score:2)
Re: (Score:2)
Still, it's a better solution just to telnet to a real computer.
Re: (Score:2)
Yeah, they're not losing anything by banning HTML email.
Good to hear... (Score:2)