Security: visual spoofing of email (address, name), attachment name, etc.

[dumblob]

🗣 Suggestion

Current severe issues making it impossible to visually detect there is something wrong with the contents you're dealing with:

https://www.virtuesecurity.com/pentesting-user-interfaces/

Note, I didn't test this in Cypht, but I think there could be some more countermeasures implemented :wink:.

[jasonmunro]

I think we are safe from some of this, but I am definitely going to test it out :)

[marclaporte]

@dumblob Any chance you could do a quick test?

[dumblob]

No time now to set up a current Cypht version. But let us fill the following table first:

particular visual spoofing	permalink to source code line(s) dealing with it
URLs in email bodies (both in plain text and HTML)	MISSING
attachment names	MISSING
email addresses "everywhere" (in email headers, bodies, etc.)	MISSING
RTL/LTR domains	MISSING