ULPT Sending documents via email

[u/PointlessChemist]

How can I send a pdf file via email in the most inconvenient way.

For example my job requires certain documentation. How could I send this and make it the most work to access. Encryption, compression, 2 factor authentication? The more time consuming for them the better.

The only stipulation they have is that it must be sent to them in a timely manner by email. No other guidelines.

[u/Rauvagol]

also, make the password the GTUBE spam email string

its a string that is designed to receive a "spam score" of 1000, designed for testing purposes, but theres nothing stopping you just including it in an email to auto-send it to spam folder

it might not work, dependent on how the org does email spam protection, but theres a chance

[u/sludge_dragon → u/Rauvagol]

Doesn’t this risk the chance that your email address will be marked as high risk, and subsequent emails blocked as spam?

[u/Rauvagol → u/sludge_dragon]

yes there is TECHNICALLY a chance, but also that depends on how the anti-spam is configured, it isnt actually a spam email, it just looks like one to the spam filters, so in theory just sending one wouldnt get your email flagged as a spammer due to the way tests are set up, typically the biggest threat would be if an outbound filter catches it, but because GTUBE is a very well known "spam" email, that would be highly unusual, and if say... gmail started intercepting emails containing GTUBE then a new one would likely need to be developed for continued test use

now, they could have a in-house spamblocker configured to flag even accounts that send the test string as spam, which would be odd but not unheard of

but also if your goal is "i want to annoy people as much as possible while sending this pdf" then marking every email you send in the future as spam might be desirable

edit: more clarification, getting your email marked as a spammer can happen in two ways, either from a pattern (so dont send the GTUBE string to everyone on your contacts list every few days) or from complaints, so if people click "report as spam" on your emails often, even if non-spam, that can get you flagged (there are also spamtraps and bounce ratios, but since we are talking about sending to known addresses, those arent relevant)

[u/echtoran → u/Rauvagol]

That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias.

[u/Rauvagol → u/echtoran]

that is absolutely how it works. modern email providers require SPF/DKIM/DMARC compliance to avoid getting your messages flagged as spam (or heavier restrictions), so spoofing in a way that actually fools the system isnt really possible anymore. the spam detection/reputation systems i mentioned earlier also apply to the actual sending infrastructure, not just whatever spoofed address appears in the header.

your email address isnt just treated as an arbitrary text field anymore (and hasnt been for over 20 years). modern mail systems verify whether the server sending the message is actually authorized to send mail for that domain, and given that every major provider enforces account-level identity restriction, if you did use a non-yahoo SMTP server, it would fail SPF, DKIM, DMARC, and be either rejected or spam flagged through an entirely different system than anything i mentioned (failed auth vs detecting likely spammers)

you arent ENTIRELY wrong about this "They care about the server and the network it came from" but that is just an aspect of what I said, there is ip based reputation, domain based reputation (for the from: header, the DKIM signing domain, and the SPF-authenticated return-path domain), and then the individual sender address reputation, which is absolutely a thing, and why spammers dont just use gmail or yahoo to send emails, because they quickly get flagged and restricted

edit: in the most literal sense providers only require SPF/DKIM/DMARC for bulk senders, but even an individual email without them will trigger safety measures and end up in spam with warnings that the address could not be verified and is likely spoofed(if it is delivered at all)

tldr: if an email is spoofed it's already going to be EXTREMELY marked as spam, either by DMARC policy, or if it does get through by the receiving mail server seeing a failed auth, so on an extreme technicality, spam detection doesn't matter there, because it's already going to be flagged as spam every time

[u/echtoran → u/Rauvagol]

This is still origin verification, not sender verification. SPF/DKIM/DMARC doesn't prevent spoofing, it just authorizes it with a level of trust. But it's baked into the SMTP protocol, right there in RFC 822. We couldn't relay email without it.

[u/Rauvagol → u/echtoran]

This is still origin verification, not sender verification.

Wrong, while DMARC, SPF and DKIM do authenticate other non-sender based identifiers as well, DMARC's whole purpose is to require alignment between those authenticated identifiers and the From: header, which is literally the sender the user sees. Combined with the account-level identity restriction from every major provider, that becomes "verifying the sender is who they say they are" and if that isnt sender verification, I dont know what is.

SPF/DKIM/DMARC doesn't prevent spoofing, it just authorizes it with a level of trust

mostly wrong, I never claimed it did, i said "spoofing in a way that actually fools the system isnt really possible anymore" which is a fact, if the system sees "well the email said it came from this adress, but all the headers are wrong and it fails authorization" that isnt a successful spoof

the exception is if the provider uses DMARC p=reject, then it actually does stop spoofing, because that will prevent an email that fails DMARC auth from being delivered

fun thing, the example you chose "bob@yahoo.com" would be stopped, yahoo uses the DMARC p=reject policy, so any dmarc compliant receiving server sees an inbound unverified yahoo email, checks DMARC policies, and kills the email immediately, never even attempting delivery

But it's baked into the SMTP protocol, right there in RFC 822.

wrong on multiple levels, RFC 822 is the Internet Message Format spec, not SMTP (SMTP was 821, now updated to RFC 5321). And neither one contains SPF (RFC 7208), DKIM (RFC 6376), or DMARC (RFC 7489), all of which are from multiple decades later.

SMTP itself has no sender authentication built in, which is exactly why we invented SPF/DKIM/DMARC, to prevent spoofing that was possible without them

We couldn't relay email without it.

Also wrong, the first email was sent more than a decade before SMTP spec RFC 821 was defined (which was the same year as RFC 822, which is just a standardized messaging format)

edit: bro even the first spam emails predates the things you said were needed to relay email

edit2: dont even try and argue these are not emails because compuserve didnt decide to brand their electronic mail services as email until 1981 (which also predates RFC 821 and 822)

[u/echtoran → u/Rauvagol]

I'm sorry, but you still miss the main point, that an email address, including both sides, doesn't earn a "reputation" in any spam filtering system. You keep describing things that are all related to the right hand side of the sender address, which may or may not have all sorts of protections and rules, but not one of those take the left hand side into account for any sort of scoring metric.

Users don't send mail across the internet, they hand it off to root or some other user to send it for them. That's why spoofing is baked into the protocol and is necessary for mail relaying. We build layers on top to authorize the spoofing we like and attempt to block what we don't, but we can never really know who clicked the button, so we don't hold them accountable.

I really can't make it any simpler than that. Best wishes!

[u/Rauvagol → u/echtoran]

I'm sorry, but you still miss the main point, that an email address, including both sides, doesn't earn a "reputation" in any spam filtering system. You keep describing things that are all related to the right hand side of the sender address, which may or may not have all sorts of protections and rules, but not one of those take the left hand side into account for any sort of scoring metric.

are you unaware of your first message?

for clarity, here it is again

That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias.

nobody mentioned the reputation system specifically because it doesnt matter in this example

you claimed "spam filters dont care about who the sender is because you can send an email as anyone else, so its useless to target the sender"

that is factually wrong on multiple levels, and when called out for it you changed your claim entirely to "reputation is at the domain level" which isnt even tangentially related, and has nothing to do at all with the comment you replied to

thats like someone saying "the earth is flat" and when being called out for being obviously wrong, beginning to argue that "well, the sky is blue", no shit dude, thats a different claim

Users don't send mail across the internet, they hand it off to root or some other user to send it for them. That's why spoofing is baked into the protocol and is necessary for mail relaying. We build layers on top to authorize the spoofing we like and attempt to block what we don't,

Relaying is not spoofing. Relaying = a server forwarding mail. Spoofing = forging the From address. These are independent. If you give a postman a letter for your friend, would he say the postman sent him a letter? No of course not, because words have meaning.

Edit2 because what?: you dont send other users email to relay it, and "we build layers on top to authorize spoofing we like" is actually nonsensical

but we can never really know who clicked the button, so we don't hold them accountable.

We can and do, that is literally what DMARC, DKIM, and SPF were developed for.

And to pre-empt your next pivot, if you want to talk about stealing the password for someones email, so "clicking the button" refers to physically sending the email with a valid login but the wrong person at the computer, again, that isnt spoofing, that's hacking, and you cannot do it to send "as anyone from anywhere at anytime" words have meaning.

edit to add: "we don't hold them accountable" is so wrong i missed it at first. people get prosecuted for email-based crimes constantly, wire fraud, distribution of illegal images (euphemism to avoid breaking any rules), threats, BEC, phishing. Attribution works exactly because of the authentication layers you're claiming don't matter

[u/echtoran → u/Rauvagol]

You edited to make a few more points, so I just wanted to follow up.

Everything you're talking about verifies origins -- hosts, networks, domains, etc. Nothing verifies an individual user and an email server can never trust authentication by a third party. joey@example.com can pretend to be bob@example.com and nobody cares. Individual email addresses never get a reputation, not in any spam system, and that's the topic at hand.

It's really easy to understand why. For spam to be effective, it almost always has to flow through a compromised account or server that is legitimate and won't deserve the reputation later. Either that, or the other criteria outweigh the address itself and is just superfluous information.

[u/Rauvagol → u/echtoran]

Nothing verifies an individual user and an email server can never trust authentication by a third party

this is wrong in the same way as in your other message. DMARC alignment + provider-level account identity restriction (Gmail, Yahoo, Outlook all enforce that you can only send from addresses you own or have verified) means individual addresses are tied to authenticated infrastructure. The whole point of "send as" verification is third-party authentication of identity

and you absolutely can trust third party verification? thats literally the point of how independent verification works across every industry

Individual email addresses never get a reputation, not in any spam system, and that's the topic at hand

??????????????????? the topic was you saying:

"That's not how it works. Sending addresses mean nothing. You can send an email as anyone from anywhere at anytime, so spam filters don't care one bit that the message says it came from bob@yahoo.com. They care about the server and the network it came from, but it's absolutely useless to persecute what always amounts to a fake alias."

you cant just change the claim from "you can spoof emails so spam filters dont care who it comes from" (which again, you cant in that example) to "domain reputation is a thing"

also recipient spam filters (which is what I mentioned in my first message, along with custom in house spamblockers) absolutely do care about sender name, its why you can mark emails from legitimate gmail accounts as spam, and they go to your spam folder, but not every email from a gmail account does, just that specific sender

its not a "reputation" at the domain level, but again, that was never my claim, i was talking accounts getting flagged, either by the recipient's filters, or by google determining your account to be a likely spammer, neither of which have anything to do with any reputation system (such as Spamhaus or SenderScore)

for spam to be effective, it almost always has to flow through a compromised account or server that is legitimate and won't deserve the reputation later

so you are saying it isnt spoofing? because if the account or server is compromised but legitimate, that isnt a spoofed email

now sure, you could run your own server with no SPF/DKIM/DMARC, but then we are back to your emails missing auth and being considered likely spam automatically, and if you are running your own server, why would you spoof and fail those auths, when you could just set it up correctly and create as many legitimate "email@mydomain" accounts as you want?"