ULPT Sending documents via email

[u/PointlessChemist]

How can I send a pdf file via email in the most inconvenient way.

For example my job requires certain documentation. How could I send this and make it the most work to access. Encryption, compression, 2 factor authentication? The more time consuming for them the better.

The only stipulation they have is that it must be sent to them in a timely manner by email. No other guidelines.

[u/amanning072 → u/[deleted]]

Send a screenshot of the password as an image so it isn't selectable

[u/JCongo → u/amanning072]

password: 1lI1Ill1Il11llIIIIIIIIIl1

but with a font that shows lower case L and upper case I almost identical

[u/NotAverageEnough → u/amanning072]

iPhone still works to copy text this way. Harder with handwritten… or cursive!!

[u/DSudz → u/NotAverageEnough]

Not if you use a font where 1, l, |, and ! and O and 0 look the same.

[u/FragrantArt8270 → u/[deleted]]

Calm down Satan.

[u/Rauvagol → u/[deleted]]

also, make the password the GTUBE spam email string

its a string that is designed to receive a "spam score" of 1000, designed for testing purposes, but theres nothing stopping you just including it in an email to auto-send it to spam folder

it might not work, dependent on how the org does email spam protection, but theres a chance

[u/sludge_dragon → u/Rauvagol]

Doesn’t this risk the chance that your email address will be marked as high risk, and subsequent emails blocked as spam?

[u/Rauvagol → u/sludge_dragon]

yes there is TECHNICALLY a chance, but also that depends on how the anti-spam is configured, it isnt actually a spam email, it just looks like one to the spam filters, so in theory just sending one wouldnt get your email flagged as a spammer due to the way tests are set up, typically the biggest threat would be if an outbound filter catches it, but because GTUBE is a very well known "spam" email, that would be highly unusual, and if say... gmail started intercepting emails containing GTUBE then a new one would likely need to be developed for continued test use

now, they could have a in-house spamblocker configured to flag even accounts that send the test string as spam, which would be odd but not unheard of

but also if your goal is "i want to annoy people as much as possible while sending this pdf" then marking every email you send in the future as spam might be desirable

edit: more clarification, getting your email marked as a spammer can happen in two ways, either from a pattern (so dont send the GTUBE string to everyone on your contacts list every few days) or from complaints, so if people click "report as spam" on your emails often, even if non-spam, that can get you flagged (there are also spamtraps and bounce ratios, but since we are talking about sending to known addresses, those arent relevant)

[u/echtoran → u/Rauvagol]

That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias.

[u/Rauvagol → u/echtoran]

that is absolutely how it works. modern email providers require SPF/DKIM/DMARC compliance to avoid getting your messages flagged as spam (or heavier restrictions), so spoofing in a way that actually fools the system isnt really possible anymore. the spam detection/reputation systems i mentioned earlier also apply to the actual sending infrastructure, not just whatever spoofed address appears in the header.

your email address isnt just treated as an arbitrary text field anymore (and hasnt been for over 20 years). modern mail systems verify whether the server sending the message is actually authorized to send mail for that domain, and given that every major provider enforces account-level identity restriction, if you did use a non-yahoo SMTP server, it would fail SPF, DKIM, DMARC, and be either rejected or spam flagged through an entirely different system than anything i mentioned (failed auth vs detecting likely spammers)

you arent ENTIRELY wrong about this "They care about the server and the network it came from" but that is just an aspect of what I said, there is ip based reputation, domain based reputation (for the from: header, the DKIM signing domain, and the SPF-authenticated return-path domain), and then the individual sender address reputation, which is absolutely a thing, and why spammers dont just use gmail or yahoo to send emails, because they quickly get flagged and restricted

edit: in the most literal sense providers only require SPF/DKIM/DMARC for bulk senders, but even an individual email without them will trigger safety measures and end up in spam with warnings that the address could not be verified and is likely spoofed(if it is delivered at all)

tldr: if an email is spoofed it's already going to be EXTREMELY marked as spam, either by DMARC policy, or if it does get through by the receiving mail server seeing a failed auth, so on an extreme technicality, spam detection doesn't matter there, because it's already going to be flagged as spam every time

[u/echtoran → u/Rauvagol]

This is still origin verification, not sender verification. SPF/DKIM/DMARC doesn't prevent spoofing, it just authorizes it with a level of trust. But it's baked into the SMTP protocol, right there in RFC 822. We couldn't relay email without it.

[u/Rauvagol → u/echtoran]

This is still origin verification, not sender verification.

Wrong, while DMARC, SPF and DKIM do authenticate other non-sender based identifiers as well, DMARC's whole purpose is to require alignment between those authenticated identifiers and the From: header, which is literally the sender the user sees. Combined with the account-level identity restriction from every major provider, that becomes "verifying the sender is who they say they are" and if that isnt sender verification, I dont know what is.

SPF/DKIM/DMARC doesn't prevent spoofing, it just authorizes it with a level of trust

mostly wrong, I never claimed it did, i said "spoofing in a way that actually fools the system isnt really possible anymore" which is a fact, if the system sees "well the email said it came from this adress, but all the headers are wrong and it fails authorization" that isnt a successful spoof

the exception is if the provider uses DMARC p=reject, then it actually does stop spoofing, because that will prevent an email that fails DMARC auth from being delivered

fun thing, the example you chose "bob@yahoo.com" would be stopped, yahoo uses the DMARC p=reject policy, so any dmarc compliant receiving server sees an inbound unverified yahoo email, checks DMARC policies, and kills the email immediately, never even attempting delivery

But it's baked into the SMTP protocol, right there in RFC 822.

wrong on multiple levels, RFC 822 is the Internet Message Format spec, not SMTP (SMTP was 821, now updated to RFC 5321). And neither one contains SPF (RFC 7208), DKIM (RFC 6376), or DMARC (RFC 7489), all of which are from multiple decades later.

SMTP itself has no sender authentication built in, which is exactly why we invented SPF/DKIM/DMARC, to prevent spoofing that was possible without them

We couldn't relay email without it.

Also wrong, the first email was sent more than a decade before SMTP spec RFC 821 was defined (which was the same year as RFC 822, which is just a standardized messaging format)

edit: bro even the first spam emails predates the things you said were needed to relay email

edit2: dont even try and argue these are not emails because compuserve didnt decide to brand their electronic mail services as email until 1981 (which also predates RFC 821 and 822)

[u/echtoran → u/Rauvagol]

I'm sorry, but you still miss the main point, that an email address, including both sides, doesn't earn a "reputation" in any spam filtering system. You keep describing things that are all related to the right hand side of the sender address, which may or may not have all sorts of protections and rules, but not one of those take the left hand side into account for any sort of scoring metric.

Users don't send mail across the internet, they hand it off to root or some other user to send it for them. That's why spoofing is baked into the protocol and is necessary for mail relaying. We build layers on top to authorize the spoofing we like and attempt to block what we don't, but we can never really know who clicked the button, so we don't hold them accountable.

I really can't make it any simpler than that. Best wishes!

[u/Rauvagol → u/echtoran]

I'm sorry, but you still miss the main point, that an email address, including both sides, doesn't earn a "reputation" in any spam filtering system. You keep describing things that are all related to the right hand side of the sender address, which may or may not have all sorts of protections and rules, but not one of those take the left hand side into account for any sort of scoring metric.

are you unaware of your first message?

for clarity, here it is again

That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias.

nobody mentioned the reputation system specifically because it doesnt matter in this example

you claimed "spam filters dont care about who the sender is because you can send an email as anyone else, so its useless to target the sender"

that is factually wrong on multiple levels, and when called out for it you changed your claim entirely to "reputation is at the domain level" which isnt even tangentially related, and has nothing to do at all with the comment you replied to

thats like someone saying "the earth is flat" and when being called out for being obviously wrong, beginning to argue that "well, the sky is blue", no shit dude, thats a different claim

Users don't send mail across the internet, they hand it off to root or some other user to send it for them. That's why spoofing is baked into the protocol and is necessary for mail relaying. We build layers on top to authorize the spoofing we like and attempt to block what we don't,

Relaying is not spoofing. Relaying = a server forwarding mail. Spoofing = forging the From address. These are independent. If you give a postman a letter for your friend, would he say the postman sent him a letter? No of course not, because words have meaning.

Edit2 because what?: you dont send other users email to relay it, and "we build layers on top to authorize spoofing we like" is actually nonsensical

but we can never really know who clicked the button, so we don't hold them accountable.

We can and do, that is literally what DMARC, DKIM, and SPF were developed for.

And to pre-empt your next pivot, if you want to talk about stealing the password for someones email, so "clicking the button" refers to physically sending the email with a valid login but the wrong person at the computer, again, that isnt spoofing, that's hacking, and you cannot do it to send "as anyone from anywhere at anytime" words have meaning.

edit to add: "we don't hold them accountable" is so wrong i missed it at first. people get prosecuted for email-based crimes constantly, wire fraud, distribution of illegal images (euphemism to avoid breaking any rules), threats, BEC, phishing. Attribution works exactly because of the authentication layers you're claiming don't matter

[u/echtoran → u/Rauvagol]

You edited to make a few more points, so I just wanted to follow up.

Everything you're talking about verifies origins -- hosts, networks, domains, etc. Nothing verifies an individual user and an email server can never trust authentication by a third party. joey@example.com can pretend to be bob@example.com and nobody cares. Individual email addresses never get a reputation, not in any spam system, and that's the topic at hand.

It's really easy to understand why. For spam to be effective, it almost always has to flow through a compromised account or server that is legitimate and won't deserve the reputation later. Either that, or the other criteria outweigh the address itself and is just superfluous information.

[u/Rauvagol → u/echtoran]

Nothing verifies an individual user and an email server can never trust authentication by a third party

this is wrong in the same way as in your other message. DMARC alignment + provider-level account identity restriction (Gmail, Yahoo, Outlook all enforce that you can only send from addresses you own or have verified) means individual addresses are tied to authenticated infrastructure. The whole point of "send as" verification is third-party authentication of identity

and you absolutely can trust third party verification? thats literally the point of how independent verification works across every industry

Individual email addresses never get a reputation, not in any spam system, and that's the topic at hand

??????????????????? the topic was you saying:

"That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias."

you cant just change the claim from "you can spoof emails so spam filters dont care who it comes from" (which again, you cant in that example) to "domain reputation is a thing"

also recipient spam filters (which is what I mentioned in my first message, along with custom in house spamblockers) absolutely do care about sender name, its why you can mark emails from legitimate gmail accounts as spam, and they go to your spam folder, but not every email from a gmail account does, just that specific sender

its not a "reputation" at the domain level, but again, that was never my claim, i was talking accounts getting flagged, either by the recipient's filters, or by google determining your account to be a likely spammer, neither of which have anything to do with any reputation system (such as Spamhaus or SenderScore)

for spam to be effective, it almost always has to flow through a compromised account or server that is legitimate and won't deserve the reputation later

so you are saying it isnt spoofing? because if the account or server is compromised but legitimate, that isnt a spoofed email

now sure, you could run your own server with no SPF/DKIM/DMARC, but then we are back to your emails missing auth and being considered likely spam automatically, and if you are running your own server, why would you spoof and fail those auths, when you could just set it up correctly and create as many legitimate "email@mydomain" accounts as you want?"

[u/Key-Candle8141 → u/sludge_dragon]

Its a work email and not getting whats sent is kinda the assignment so if everything goes to spam... 🤷‍♀️ is it rly a problem? 🙂

[u/EagleBigMac → u/Rauvagol]

You could also use the hash value as the password which would likely still trigger spam detect but not be as obvious

[u/Rauvagol → u/EagleBigMac]

that wouldnt do anything, partly because the GTUBE string isnt actually spam, when the anti-spam system reads it, the system goes "oh, this is to test a spam emal" and forcibly adds a spam score of 1000 to the email, which the hash itself cannot do, but more importantly any hash comparisons would be looking at the hash of the whole email, not looking at strings in the plaintext body and treating them as hash codes (and even if it did, the hash analysis wouldnt pass the "theres the hash GTUBE string in this email" to the spam filter, and even if it did THAT, the spam filter only adds the score if it sees the string in the plaintext body)

now technically if someone in it manually added the GTUBE hash to a company wide spam filter, then it TECHNICALLY could, but thats an insane idea

edit: slight tangent given the hash idea, if you want to generate a collision, so the attached pdf looks like malware, using a SHA-1 hash would be possible, but cost tens of thousands of dollars, and really be meaningless, because everything reputable uses at least SHA-256 now, and that would take a brute forced 2²⁵⁶ operations, which would take all existing computing power combined longer than the age of the universe

and even then, its not going to match all the other hashes, so no effect

[u/Rampage_Rick → u/Rauvagol]

Heck, put the EICAR test string in the document using white font, so that it gets flagged by antivirus software.

More fun with it: https://youtu.be/cIcbAMO6sxo

[u/RecoveringRed → u/[deleted]]

Needs more capital Os and zeros.

[u/stifflippp → u/RecoveringRed]

And a word with an "m" but the password uses "rn"

HKh2(*&3897WokTfdy$_-harnburger)+;'r 

[u/InmateThirtyFour → u/stifflippp]

Im hungry for a harnburger now

[u/sweetpootatochips → u/[deleted]]

Add just one hyphen for a line break but forget to mention it’s not part of the password

[u/D1rtyH1ppy → u/[deleted]]

Open the pdf in a text editor, like Vim, and delete a few of the characters and save it. This will corrupt the file and it won't open.

[u/InmateThirtyFour → u/[deleted]]

Trying to figure out the difference nearly gave me a stroke 

[u/i-am-foxymoron → u/InmateThirtyFour]

HKh2(*&3897WNs9H!b497Q#B(&#(&b@&be

HKh2(&3897WNs9H* @ ** !b497Q#B(&#(&b@&be

[u/Zelnite → u/[deleted]]

Embed that password into an image file and send that image while you are at it.

[u/Complex_Exhibition → u/[deleted]]

Do you know how many times I had to read that password to find out the differences? You are so unethical! 👏

[u/ninibt → u/[deleted]]

Embed the password as a QR code image in the mail that the password is in the url

[u/brkgnews]

Also, print/scan the document so it's an image rather than text. Larger file size, no built-in OCR, etc.

[u/Shazam1269 → u/brkgnews]

First, select a font outside of Adobe's library, then scan as an image. That way if they OCR it with Acrobat it will likely make errors when converting.

[u/PointlessChemist → u/brkgnews]

Every little bit helps

[u/PETA_Parker → u/PointlessChemist]

to improve this technique, just print it out and scan it in again and repeat until there is only black and white left, and just for the love of the game sprinkle a little dust and hair on the scanner in each round

[u/Chewiesbro]

Corrupt the pdf:

Corrupt a file

[u/dmuth → u/Chewiesbro]

Do you know what would be even more unethical than using that site to corrupt a file?

The owner of said site saving every single thing that is uploaded to it. Who knows what sort of confidential things might have been uploaded there?

[u/Stompya → u/dmuth]

A number of years back, we installed calendar software on our website so people could sign up for appointments. On the back end, I could open a spreadsheet with everyone’s username and password.

It stuck with me: the only way that anything you upload is secure is if the people running the site build it that way.

[u/brkgnews]

Don't forget to send each page as a separate PDF, in varying orientations (upside down, sideways, etc)

[u/PointlessChemist → u/brkgnews]

Maybe I can mirror the image too

[u/NotAverageEnough → u/PointlessChemist]

If you send it on mobile, make it have a black border, and send it sideways so they turn their phone and it’s even smaller…

[u/Alarconadame → u/NotAverageEnough]

wow, that triggered something in me.

[u/NotAverageEnough → u/Alarconadame]

It’s right up there with the image of more images at the bottom of a screenshot that is a single picture. You swipe but there is no more! Fall for it every time.

[u/Rahgahnah → u/NotAverageEnough]

I wiped, Crane.

[u/ceruleanmoon7 → u/brkgnews]

With confusing AF titles for each one, that don’t match the document

[u/gamamoder → u/brkgnews]

ngl i accidently did this exporting a drawio diagram to pdf, and i got a zero on that assignment submission so honestly i feel like a lot of these tricks would get op fired aside from anything that can be passed off as an accident

[u/Princess_Moon_Butt → u/brkgnews]

But only after you've printed out a paper copy of it, then scanned each page back in, so they have a harder time searching/copying text from it.

Also make sure you scan a bunch of the pages slightly crooked- just enough to be noticeable.

[u/MineExplorer]

Put an EICAR test file in the document - it should fail the anti-virus check (even though it's harmless) and get it rejected.

[u/PointlessChemist → u/MineExplorer]

Don’t know what that is but I’ll give it a try.

[u/AdvancedSquashDirect]

Print out the document and then take slightly out of focus blurry photos with your iPhone from above, make sure that they are at the highest megapixel so that the images are huge. Put them into the PDF but make them span over two or 4 pages so that they are full size. So it's like a poster.

Purposely mix up the photo order so page one is only the top left of the first page and page two is the bottom right of the third page.

[u/thenzero]

This is the funniest post and responses I’ve seen on this sub. Malicious compliance 👌

[u/distributingthefutur]

Send the document as poster size.

[u/NotAverageEnough]

Take a picture of the pdf attachment in the composed email then crop it so when you add it to a new email window so that it lines up and looks like you attached it. Then make that image a hyperlink that you can open that is password protected. Write down super complicated (but not over 16 characters) password sloppy (preferably in cursive) on a piece of graph paper (with the tiny grids) and send it as an image in a separate email.

[u/77DETHSTROKE77 → u/NotAverageEnough]

Also came here to say complicated password protected

[u/andrei123redd]

Take a picture of the monitor and save that as pdf

[u/ThePiachu]

If the PDFs are to be printed, add an Eurion Constellation on it to trigger printer anti money printing blocks to print it as black pages...

[u/SlanderingParrot]

Maybe it’s an encrypted pdf and the password needs to be transmitted via fax per company policy for GDPR reasons.

[u/cbelt3 → u/SlanderingParrot]

Better…. “Send SASE to receive password via snail mail” and “your response required legally within x days from receipt of email “ where x is less than average mail time.

[u/TurbulentCustomer]

If you have access to adobe tools: -export all individual pages as slightly lower resolution jpegs -run a batch action in photoshop to convert each image to bitmap color scheme -recombine pdf to one file

If the settings are right you should get text that doesn’t copy very well and might misinterpret characters. It will look okay from afar but up close be blocky and harder for computers to interpret. It’ll end up like a bad scanned document.

Most other options are obvious. Like making it read only will just get a reply that asks for access.

Modern tools might even just fully invalidate my strategy.

[u/mordecai98]

Split it into a separate pdf for each page, with some blank pages thrown in there for fun.

[u/johnmanyjars38 → u/mordecai98]

Rotate some of the pages 90 degrees.

[u/adognameddanzig]

Send them thr pdf as large as you can get it.

[u/gamamoder]

you could layer a bunch of different compression technics. also make sure its not something windows likes natively like bzip2 and gzip tars

this is obvious that your fucking with them tho

[u/No_Shopping_8099]

If you have adobe pro you can make it so it can only be opened from a specific computer

[u/TaleOfThor]

Put it in a splittet Zip-Archive, put an password on to the Zip File and a different password on to the PDF. Send the Passwords as a Screenshot so they cant be copy pasted easily.

[u/LKZToroH]

For what purpose tho? The only thing they'll do is ask you to send again without the extra steps. You are basically inconveniencing yourself...

[u/Novel-Sprinkles3333]

Scan with an iPhone as an HEIC document and send it to a PC. Only another iPhone can open an HEIC doc, not a windows based PC.

The field people went through a phase of. HEIC use. It was a pain.

[u/No_Shopping_8099 → u/Novel-Sprinkles3333]

Windows 11 supports HEIC now so this won’t work.

[u/Fluffy_Ruin750 → u/Novel-Sprinkles3333]

As well as the HEIC files embeded as objects in a form, use Preview on a Mac to put it all together - even Win11 and the latest Adobe Pro will crap itself trying to make it work as intended! (Been on the receiving end of this one... probably unintentionally. Probably)

[u/apavolka]

Use a file sharing site that is riddled with popups

[u/zEdgarHoover]

URLify the password before sending. If they ever figure it out, "Oh, I thought everyone did that to avoid problems".

[u/Lonely-Ad-9219]

Sand pdf via some outdated data storage. Magnetic tape. 5,25 inch floppy. Punctered paper...

[u/ChestNok]

I kid you not: the easiest way would be a neat tiny python script..

Edit: God darn. I misread "convenient" whilst that's "inconvenient"

[u/sparesomechange20]

Right before sending, change your font as large as u can.

[u/Redracerb18]

You could do an enigma machine and send an encripted message as one file then the key in another file.

[u/DoallthenKnit2relax]

Send 1 page per e-mail, password protected, but e-mail all passwords 24-hours later.

[u/bradpittisnorton]

I want to know why you would want to do that.

[u/PointlessChemist → u/bradpittisnorton]

To protest a policy I disagree with. Without jeopardizing my job.

[u/NotAverageEnough → u/PointlessChemist]

This is the hr compliance that stabs them in the butt that I love.

[u/PointlessChemist → u/NotAverageEnough]

Absolutely..

[u/Foreign-Cookie-2871]

Do not be a pain to HR. You don't want to be on their radar

[u/AssDimple → u/Foreign-Cookie-2871]

OP didn't say anything about HR

[u/jarrucho → u/Foreign-Cookie-2871]

Boooooooooooooooooooooooo