WebMail Configuration Change REQUEST to enhance user privacy and security.
When sending Email via the Sonic hosted WebMail interfaces two of the informational "X-" Headers that
are added cannot be configured by the Sonic User. These two Email Headers expose potentially sensitive
and exploitable data related to that Sonic User.
Email Headers can and often are easily, even routinely harvested by various BOTS, Viruses, Malware,
etc., as email traverses and/or gets cached on servers, client systems, various networks or while
it is being routed over the Internet. The harvested Email Headers and/or the entire email can then be
used/stored/sold/shared for often unsavory purposes by spammers, scammers, hackers, identity thieves,
unscrupulous businesses, various rouge agents/agencies and other individuals or groups that do not
generally have the best interests of Sonic.net or the respective Sonic customer/User in mind.
The incredible usefulness of the Header details to those that use them for unsavory purposes is quite
amazing. A few of the countless possible or typical uses are; to assist with user tracking and the
building of linked user profiles for targeted marketing, for spamming and related uses, for the
gathering of data which is then used for more advanced/sophisticated attacks against individuals or
businesses via phishing or social engineering based scams, etc.
Normally the "X-" Headers are intended to be used only for "informational" purposes and aren't
typically required for actual email routing. However, the specific headers of concern mentioned below
are generally used to aid Admins with email system troubleshooting and also to help track email
system abuse and to find the source of that abuse.
Fortunately Sonic is a sophisticated ISP and likely does not need to rely on the presence of the
below listed Headers at all or at least NOT in an un-encrypted "clear text" format for the
purposes of troubleshooting and abuse tracking. Sonic can accomplish these goals with various
existing network, router and server logs and other tools available to them along with existing
email Headers like the "Message-ID".
The Email "X-" Headers of concern that are added by WebMail to outgoing email and which the Sonic User
currently cannot, configure, modify or delete, are those...
1)
Added by the (new, beta) Sonic RoundCube WebMail Client:
X-Sender:
[email protected] (
[email protected]) <--
Actual Sonic User Account E-mail
Received: from myStaticRDNS.mydomain.com ([xxx.xxx.xxx.xxx]) <--
Actual Sonic User: RDNS and IP
by webmail-beta.sonic.net
with HTTP (HTTP/1.1 POST); Fri, 12 Apr 2013 09:09:09 -0700
2)
Added by the (current) Sonic AtMail WebMail Clients:
X-Atmail-Account:
[email protected] <--
Actual Sonic User Account E-mail
X-Origin: xxx.xxx.xxx.xxx <--
Actual Sonic User IP
The other E-mail Headers ("From" and "Reply-To") and the associated "Email Name" only list info
taken from the selected "Alias" profile which was previously configured by the Sonic User.
An Alias email address is often or at least can be used and then discarded when/if it is or gets
compromised by Spammers but, unfortunately the primary Sonic account email address can't be easily
changed and is vulnerable to becoming a permanent SPAM target. Alias email addresses are also
useful to help a user track down which companies or individuals are helping spammers to target them.
There are many other reasons why a user and/or business may choose to use a private Domain
and/or Sonic based "Alias" Email addresses. Theses include among others, privacy, email handling
efficiency, etc. The presence of the above listed "X-" Headers in an un-encrypted form may serve
to undermine or compromise these goals.
I'd like to request that Sonic alter the WebMail Configurations to provide Sonic Users with
an additional layer of Security/Privacy and SPAM Harvesting protection by either removing the
above listed "X-" Headers from outbound email OR, at the very least, encrypting the data!
Possible Solution that could be considered for RoundCube WebMail...
The RoundCube WebMail software should make the above tasks very easy...
1) In the RoundCube Main Configuration File, "main.inc.php" that should be located in the
etc/ directory on the server box(s) running RoundCube add/change the following option:
Code: Select all
$rcmail_config['http_received_header_encrypt'] = true;
This will encrypt the IP/RDNS related info in the "http_received_header", "Received" Header.
This setting of "true" will then cause the following plug-in to encrypt the data of the "
X-Sender" Header.
2) Add the following FREE RoundCube Plug-in and activate it on the RoundCube Server(s)...
I've attached the plug-in for your convenience
or, you can download it yourself at:
http://code.google.com/p/roundcube-plug ... 1.0.tar.gz
This plug-in ENCRYPTS the "
X-Sender" Header on outgoing Email when the "http_received_header",
"Received" Header is also encrypted.
Alternatively you may choose to configure RoundCube to NOT add the optional
"http_received_header", "Received" Header at all, by setting...
Code: Select all
$rcmail_config['http_received_header'] = false;
You could also choose to modify the plug-in script to always use an empty string as the
data for the "
X-Sender" Header, regardless of any "encryption" setting and/or the presence
of the "http_received_header", "Received" Header.
Possible Solution for AtMail WebMail...
Probably irrelevant at this point if Sonic continues to follow through with the recently
announced plan to completely shut down AtMail WebMail on 4/22/2013 or at sometime in the
near future.
