Thursday, February 25, 2016

Send and view all email as TEXT in Microsoft Outlook

Phishing is popular activity in evil circles.  Avoiding HTML and rich-text formatted email is a level of defense; one that I've taken on recently as a matter of security hygiene. This post describes how to configure Microsoft Office 2016 to read and send all email as text, and discusses some of the opportunities lost in not well distinguishing good guys from bad guys.

Wear your black hat

Bad actors wishing to attack a specific company often start by attaching a payload to email which sent to everyone inside the company.  SOMEONE will click "run" and they have a foothold.  The evil payload can be packaged as attachments, packaged as bad images, macros or referenced from HTML tags inside the formatted email.  Payload can also be  packaged as harmless looking or even almost hidden links to rogue websites and this last one is probably the biggest issue of all.  Don't put the payload where email scanner will find it, instead provide a link and get the user to click.  Issues abound on "why this works", but a big one is that as a user, you cannot easily distinguish between mails that are worthy of your trust and those that are potentially evil.  Links embedded inside email text are a particularly large issue.  They are "small" and can be framed as nothing, but when you click, even by just switching windows and clicking random spot in message, evil is unleashed from the visited website.

Bottom line - email provides an avenue for evil.  Our mission is to keep the intruders away and getting away from rich-text and HTML formatted email is an important start.

Friend vs. foe

In many ways, I wish Outlook did a better job distinguishing "friendly" email from "suspect".  If I get email sent from someone inside my company, it has a higher level of trust than receiving email from outside.  From outside, there are actually people I trust MORE than unknown people inside, but all of these trusted and non-trusted show up the "same" in outlooks email list presentation.  One of the MOST important things in email listing is the DOMAIN of where that mail originated - but we have no view.  You can't easily figure out if email is good or bad until AFTER you open the email to view.  I would like to know more about the sender of an email before I open it, but this isn't today possible. The solution we are stuck with is rather harsh, treat everyone as suspect.  

Solution - View and send all mail as text

View all email as text and then clicking text in email doesn't open links and if we really want to follow a link, we can select text and paste into browser.  Yes, it is more steps and not nearly as convenient.  When we configure to view all email as text, we should also have the courtesy to SEND all email as text.  This makes a statement to the receiver that they should not invest time during reply to make the email pretty because all the formatting will be removed before I see it anyway.  I'm deep down hoping for a side benefit on this that it may assist in keeping emails SHORT.

Configuration settings

Default configuration for Microsoft Outlook 2016 is HTML formatted email.  To change to text, follow these steps.

File / Options.  Mail Tab.  Set all outbound email to be composed in Plain Text.

Yes, you can switch inside mail editor to make things HTML if that's appropriate for a discussion you are having, but by default, with this setting change made, all mail will be composed as text.

Read all email as plain text

Trust Center, Email Security - Read all email in plain text.  Notice below that I left the second box clear, saying that people who send me digitally signed mail can send HTML.  I expect most black hat hackers will not bother digitally signing email so this seems reasonable.  I may still turn it off and require an explicit step to view such email as HTML.

Trust Center - Attachment Preview

In a world of malware delivered via attachments, its hard to imagine why automatically showing attached documents in a preview handler is considered a good idea.  The default is wrong, fix it.

Disable picture download

A number of sub options on this one.  May take some tweaking to get it to desired state, but for the most part if viewing email in plain text, the idea of setting the options for downloading pictures is not that important.  This setting will come up only IF you decide to view a specific email in HTML format and by that point you have probably already concluded that the source is trustworthy so the particulars of this panel will not matter too much.  Still, turn it off and make yourself take an extra step if you want to see the images associated with an HTML formatted email.

Macros

SERIOUSLY!  Macros by default are enabled if digitially signed.  This sounds scary enough that if I were a bad guy, I'd digitally sign my malware macros to get them to auto run.  Turn this setting OFF.

Summary

With these security practices in place, I close by noting that I'm not precisely happy with it.  Reading email as text takes me back to mainframes and unix of the 1980s.  Yes, messages get through, but not nearly as beautifully as a colorful and elegantly formatted email "document".  Viewing in text though allows me to get the message across and makes my world a safer place.


If things change over time to better identify "good" vs. "bad" senders or even email encryption and signing could ever become mainstream, some of the "turn it off" aspects of this post could be relaxed.  For the moment, I'll be happier viewing in text.

Joe Nord

23 comments:

Srinadh said...

A smallish campaign with a homemade list would not be likely to yield much of a result. To achieve anything worthwhile, a much more aggressive effort is needed. Then, the age-old value analysis applies: projected earnings = margin on total projected sales - cost of campaign.

Trâm Trương said...

Ngày nay việc mua hàng online, order hàng hóa từ các kênh thương mại nước ngoài đã không còn xa lạ với nhiều người tiêu dùng tại Việt Nam Nên order hàng taobao ở đâu. Thời kì kinh nguyệt là khoảng thời gian rất nhạy cảm đối với các chị em phụ nữ, có thể có nhiều thay đổi khiếm cho bạn luôn cảm thấy mệt mỏi, ê ẩm có kinh nguyệt uống bia được không.
Khi bạn sở hữu một mái tóc ngắn, bạn nên chọn cho mình một chiếc váy dài, đây là một sử kết hợp rất hoàn hảo và thú vị Con gái tóc ngắn mặc váy gì. Ting.vn chính là một trong những kênh mua hàng trung gian của Aliexpress được nhiều người lựa chọn tại Việt Nam Hàng trên Aliexpress có tốt không. Với sự phát triển không ngừng của công nghệ, sự phát triển mạnh mẽ của các kênh mua sắm, TMĐT và đặc biệt Hướng dẫn mua hàng trên Aliexpress

Technical Support Number 18007234210 said...

Call +1-800-723-4210|Dell Technical Support Phone Number USA $ Canadahttp://dellsupporthelp247.com/

Help Number said...

We provide Support for all versions of Microsoft office Account including MS Outlook 2013, MS office 2011, MS office 2010, office 2007, Ms office 2003, office 2002, MS Outlook 2000, Microsoft access technical support etc.

Green Mary said...

Go site www.vanskeys.com to get genuine windows&office key here.

Allie Smith 0800-090-3234 said...
This comment has been removed by the author.
mike miller said...

Its awesome blog commenting blog. I regular posting comment and searching new website for blog commenting if anyone can have blog commenting site then reply on this comment.We are providing Mobile Repair Service in Jonesboro, AR

Sara said...

Hey, Get best Microsoft Outlook technical support only @ 0808-178-2624 Outlook phone number UK.

Rosie Smith said...

Outlook gives the best features with easy interface. Still, it users face some difficulties in its operation and to fix that immediately, they need to talk to the technical experts. Outlook Helpline Number UK

Blogger said...

Using AVG protection for a couple of years, and I'd recommend this Anti virus to you all.

Wow Thinking said...

Awesome post, Call our Team member at Microsoft Online Support Phone Number Canada and at the other hand Microsoft Support Number Canada at 1-888-582-4887 for instant help and support if you have any issue with MS Window.
Microsoft Office Support Canada 1-888-582-4887

manho valentine said...

hello guy :D
Get best Microsoft Outlook technical support only
thanks for sharing

gclub casino
gclub
golden slot mobile
gclub Casino online

whatsapp features said...

I was not aware of this. thank you for sharing it. thank you so much.

http://supportnumbers.net/

rock Miller said...

Technicians from our company understand the requirements of different device models. Qualified professionals enable renewing and management of antivirus licenses. Experts provide proper license keys that help in the optimal scanning of antivirus systems in computers.

AVG Support Number USA

Blogger said...

QUANTUM BINARY SIGNALS

Get professional trading signals sent to your cell phone daily.

Start following our trades right now and make up to 270% per day.

john alex said...

nice write up. 10 Awesome websites No one Told You About.

Mark Hanry said...

I have been through your blog and got some necessary information. Here, I am also sharing a solution to technical issue of product that is to contact the technicians at Keyword and to know more, visit the link. Outlook Help Number UK

Emily Hyden said...

Unable to turn on grammar and spellings check on Microsoft Word, at this time you should talk to the experts at 0800-090-3220 toll-free to get an instant solution for the issue. Microsoft Support Number UK

Customer Help Number UK said...

Discovering complications while using Outlook account like SMTP related issue and others, so you should contact the technical experts at 0800-090-3240 to get that resolved in a minute.
Outlook Help Number UK

Bella Jackson said...

I felt like ending it i lost my husband to another woman 2 weeks ago after 27 years of marriage. We had a lovely marriage but he started a relationship with a co worker who chased after him. He is living away near his work, and he refuses to talk to me or to come home . I am devastated and am finding it hard to cope i was emotionally down . I wish I did not love him and that I could move on but I can't . I don't know how to stop feeling like this I wish I could and its eating me away and I'm starting to feel ill. I have degraded myself begging him to come home all to no avail. I became very worried and needed help. As I was browsing through the internet one day, I came across a website that suggested that Dr Ogudugu can help solve marital problems, restore broken relationships and I also came across several testimonies about this particular man so on. So, I felt I should give him a try. I contacted him and he did a spell for me. 24 hours later, my husband came to me and apologized for the wrongs he did and promise never to do it again. Ever since then, everything has returned back to normal. I and my family are living together happily again.. All thanks to Dr Ogudugu . If you need a spell caster that can cast a spell that truly works, I suggest you contact him. He will not disappoint you. if you have any problem contact him, I give you 100% guarantee that he will help you, This is his details, E-mail: GREATOGUDUGU@GMAIL.COM. Thank you all for reading.

microsofttelephonenumber said...

fix the windows issues, Microsoft office installation issues, office update errors, windows fetal error, windows update issues and other Microsoft related problems by dialing the toll free Microsoft technical support number.

Nur Banu Zeniya said...


Wow! Thanks for sharing this informative post, Its really worth reading.

Microsoft Server 2016 Support
Microsoft Server 2016 Migration

Customer Help Number UK said...

A personal email service introduced by Microsoft is Outlook. It helps you to focus on what matters most and left the rest. But several technical issues are the barriers in between. Call our experts for proper assistance at Outlook Support Number UK.