[PLUG-TALK] Cisco Secure Email Encryption Service (CRES)

[Nathan Williams]

Hilariously, this is also the approach used by a large number of
"cold-storage wallet generators" for various cryptocurrencies. IMO, you
might as well curl-bash with all your website passwords saved in a
passwords.txt file in your home directory.

On Fri, Mar 19, 2021 at 8:34 AM Ash (Richard) Powell <rpowell at lucidheart.com>
wrote:

> I know this isn't a security list, and there's probably better lists to
> pose this question to.  But, despite my limited active conversation
> here, I feel more comfortable here (Portland locals) than the
> global/larger lists.
>
> After conducting a security awareness training about phishing scams,
> someone on my billing department ran this by me to be safe.  And I was
> somewhat shocked to see that a reputable company such as Cisco has a
> product where they encourage people to save .html files with Javascript
> in them to their local machine, and then to open those files and enter
> their password.  I understand browser developers have probably made
> great strides in "sandboxing" Javascript in a browser.  But I remember
> the days when running an html file with Javascript from a local machine
> would enable the script to run in the context of that local computer,
> rather than the sandbox.  It was some scary shit, and still is for me.
>
> Anyway.  I have always cautioned users against opening and running
> attachments that run code.  So what the hell?  Has Cisco just thrown
> this recommendation out the window for me?  Do I need to now monitor
> these things on a case by case basis for my company employees?
>
> Just looking for thoughts.  Am I overreacting?  Should I reevaluate my
> understanding on opening html email attachments?
>
> _______________________________________________
> PLUG: https://pdxlinux.org
> PLUG-talk mailing list
> PLUG-talk at pdxlinux.org
> http://lists.pdxlinux.org/mailman/listinfo/plug-talk
>