Management CSCU9B2 CSCU9B2 1

Transcription

1 Management CSCU9B2 CSCU9B2 1

2 Contents clients choosing and using message header and content ing to lists of people In and out message management Mime attachments and HTML SMTP, HTTP, POP, IMAP Web mail Spam: why is so c**p? CSCU9B2 2

3 Client The software that receives, displays, and allows the creation and sending of s What you use on your computer to read & write Lists messages, usually has an address book for contacts, should offer folders for organising s etc. Some security support such as spam and scam detection (possibly) CSCU9B2 3

4 Choosing One Open Source Eudora - Thunderbird - Proprietary MS Outlook (probably most used) Apple Mail.app (which I use) There s lots of others CSCU9B2 4

5 MIME Protocol Why is it needed? The original mail system supported only ASCII text. For the history of see MIME = Multipurpose Internet Mail Extension MIME allows: Attachments to messages Not just ASCII characters Alternative character sets Multi-part messages Tells the client how to handle the message content What character sets to use How to handle files such as media and application files CSCU9B2 5

6 HTML Content Early clients displayed text and nothing more MIME allows attachments and other character sets Very important now! HTML enabled clients allow HTML to be used to design the display of an message s content Text that is obviously a URL is made into a link addresses link to compose a message CSCU9B2 6

7 Writing HTML Content Not everyone has a HTML enabled client, and some people turn it off, so you can t be sure a HTML message will be readable E.g. some webmail clients like SquirrelMail Also: some people simply turn HTML off Because they prefer simple textual Because a great deal of the non-textual is advertising Or just rubbish CSCU9B2 7

8 Headers header body The message part of an is its body messages also have a header, which contains information about the message, the sender and the recipient Made up of Key:Value pairs CSCU9B2 8

9 Header From: address of sender Date: date message was sent Message-ID: automatically generated ID In-Reply-To: ID of message being replied to To: addresses Subject: Subject of message Cc, Bcc: other recipient addresses Content-Type: Usually a MIME type Reply-To: address to send replies to CSCU9B2 9

10 Routing Info The header also tells you the route an took between the sender and recipient Received: server name and IP address, mail server name A message can have multiple received: lines Read from bottom up to go from origin to destination CSCU9B2 10

11 Example Received: from lek.cs.stir.ac.uk by yen.cs.stir.ac.uk (8.14.5) id qb3dsh9m019419; Mon, 3 Dec :28:17 GMT Received: from mail-pb0-f45.google.com by lek.cs.stir.ac.uk (8.14.5) with ESMTP id qb3dsfrb003986; Mon, 3 Dec :28:16 GMT Received: by mail-pb0-f45.google.com with SMTP id mc8so pbc.32 for <kms@cs.stir.ac.uk>; Mon, 03 Dec :28: (PST) MIME-Version: 1.0 Received: by with SMTP id yg4mr pbc ; Mon, 03 Dec :27: (PST) Received: by with HTTP; Mon, 3 Dec :27: (PST) Date: Mon, 3 Dec :27: Message-ID: <CAB4axPcAFcRK1xxFqYb7RUS933VCjUQ2xPLaNzwcwbAV +rg_=a@mail.gmail.com> Subject: Example Header From: Kevin Swingler <kevswingler@googl .com> To: Kevin Swingler <kms@cs.stir.ac.uk> CSCU9B2 11

12 Faking/forging the Header You can put what you want in most of the header, You can pretend to be sending an from somebody else, for example You can add fake Received: lines too, but only at the bottom of the header real ones are added by other servers once it has been sent Unfortunately this is very easy to do. is extremely insecure in all sorts of ways You cannot trust any of the header fields. CSCU9B2 12

13 Mail Architecture Outgoing Server SMTP Client Person A User Mail Boxes SMTP Internet SMTP Inbound Server POP3 IMAP Client Person B CSCU9B2 13

14 Mail Servers To send and receive , you need access to two mail servers: Incoming Outgoing The outgoing mail server will be an SMTP server Simple Mail Transfer Protocol This handles moving from the sender to a mailbox for the recipient on the recipient s incoming mail server CSCU9B2 14

15 Incoming Mail Server SMTP gets the mail from the sender to the recipient s inbound mail server There are a few options for getting the message from the inbound server to the mail client Main two are: POP3: Post Office Protocol IMAP: Internet Message Access Protocol CSCU9B2 15

16 Post Office Protocol POP3 Used back when internet connections involved dialling in to a server Allowed you to download all messages onto the client Generally deleted them from the server Allows offline working on s Problem if you have more than one client CSCU9B2 16

17 IMAP Internet Message Access Protocol Mail client interacts directly with the server Messages stay on the server Headers downloaded before messages Messages can be deleted without ever downloading them (if the header suggests it) Messages can be cached locally to allow offline working, but cache is synchronised with server CSCU9B2 17

18 Web Mail Hotmail, Googl (gmail), etc. are examples of web mail services You interact with your mail through a website Really a portal Advantages are that you can gain access from any computer you don t need an client set up to read it Disadvantages are that it can be slower and less flexible than a good client And you cant read old s when you re off-line Note you can read some Web mail using an IMAP client, e.g. Google CSCU9B2 18

19 Spam Unwanted , either trying to sell you something or con you or Takes advantage of being free being insecure Illegal in many countries, including the UK Ha bloody ha! I get between 10 and 100 spam s daily! CSCU9B2 19

20 Spam Law, UK The Privacy and Electronic Communications Regulations 2003 It is illegal to send marketing to individuals unless: you have their express consent you have a clear customer relationship But the law isn t working. Is that a surprise? CSCU9B2 20

21 Spam Law, UK If you do send such messages, they must: Reveal the identity of the sender Give a valid address for opt-out requests Opt-out preferences must be respected You can also send messages if It is part of a sale negotiation It relates to similar products or services An opt-out option was given and not taken CSCU9B2 21

22 Spam Protection Spammers get addresses from a variety of sources, including web pages If yours is on a web page, protect it to make automated harvesting impossible: Put it in an image, rather than using text Spell it: lss(at sign)cs dot stir dot ac dot uk CSCU9B2 22

23 Un-Subscribing A legitimate business must let you opt-out of receiving Should be by sending a short message ( op-out, for example) to a specified address Illegal spammers might treat this as proof that your address is live and sell it to others, so think before you opt-out CSCU9B2 23

24 Spam Filter Most spam filters need to be trained They learn what your genuine looks like and how it differs from spam Take a little time to train yours by flagging spam messages as such Most clients have a facility for this But spammers are very clever: don t be taken in If it looks to good to be true it almost certainly is! Be very careful in following links in s And remember that because it appears to come from (say) a bank, that means nothing at all And never provide secret information (like passwords, pin numbers etc.) to a web form. CSCU9B2 24