Academia Stack Exchange is a question and answer site for academics and those enrolled in higher education. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A relatively old professor from another institute "forwarded" to me, using his work email, a work-related message he had received on his Gmail account.

However, he actually saved the entire Gmail webpage and attached it. A saved Gmail webpage may contain personal information and should not be shared with others.

He is based in a distant city and I didn't meet him in person (yet), but we work remotely on the same project.

Should I care and tell him about this bad security practice? How?

share|improve this question
6  
Yes. You should form it as a question though. "when you attach a whole web-page, is there a security risk... like personal info that might show up in the code or something?" Or something to that effect. Because maybe the professor considered it already and it's H(is/er) POV that matters, since it's H(is/er) life. This is my opinion. And I'm stupid, so take it as a grain of salt :P – Jakar Mar 2 at 20:23
24  
@Jakar I don't think it helps to phrase it as a question, especially when you know the answer. – David Richerby Mar 2 at 21:28
15  
I must say, I find it somewhat funny one would be highly concerned about the possibility that a one-time snapshot of the GMail web interface sent to one other person might contain some excerpts of personal information, while, at the same time, there is apparently not the slightest trace of concern that the sender seems to divulge their entire work-related correspondence to Google, and whoever can backdoor-in there, by routing it through GMail. – O. R. Mapper Mar 2 at 22:24
5  
@DavidRicherby framing something as a question (when you actually know the answer) is actually an effective technique for teaching someone without causing offense, particularly when the subject is accustomed to being recognized as an authority. – Dan Henderson Mar 2 at 22:59
16  
@DanHenderson When the question is so leading that it's obvious the asker knows the answer, it can look patronising or even sarcastic, especially in a tone-of-voice-deaf medium like email. If you ask, "Is there a security risk?" it's pretty obvious that you know there's a risk -- that's just not the sort of question one tends to ask apropos of nothing. – David Richerby Mar 2 at 23:13

If this was a one-time thing and you don't know this person very well, I would avoid bringing it up.

Once you know this person fairly well or communicate with them on a semi-regular basis, then sure, in your next email to the person just put as a note at the end of the email that they might be cautious about including the entire webpage.

The concern is that it might be off-putting to someone if they don't know you well and perhaps this professor actually verified that no personal info was included.

share|improve this answer
28  
It's possible that he verified no personal information was included, but this doesn't seem likely. (I can't imagine a good reason to want to save the gmail web page and send that instead of forwarding the e-mail, and I'm skeptical that anyone who would do this would be capable of verifying that it was safe to do so.) – Anonymous Mathematician Mar 2 at 19:22
9  
Anyone savvy enough to verify that properly would know how to forward an email properly instead of saving and attaching the entire page. – user2357112 Mar 2 at 21:58
5  
@user2357112 I have seen [old] professors do far stranger things. Maybe the professor did it for some other reason, who knows, my point is to not jump to assumptions about someone that you barely know. – Austin Henley Mar 2 at 22:00
    
@AnonymousMathematician There is an easy way for a person who doesn't understand much about security. Don't fill in any informations that should be kept private, and delete every email containing them. They may feel even more confident than following the right way, though technically they may still leave some traces by accident. – user23013 Mar 4 at 11:42

I think it is first necessary to evaluate the actual risks involved in such practice. Forwarding an entire email web-page is indeed a bad habit in terms of security, but it does not necessarily point to specific vulnerabilities (like remote code execution, injection-based attacks...) with a clear risk assessment.

My point from the above is, given the circumstances, it's hard to articulate the exact risks caused by this incident. If this is an isolated incident, especially if you don't have a relatively close relationship with this professor, I would strongly discourage you from bringing it up. Keep in mind that it's hard to express the right degree of sympathy through an e-mail, and therefore, you might come across as picky, arrogant or even rude. (This is especially true if you're emailing someone who isn't familiar with you personally)

EDIT: I also agree with @Austin Henley's answer, especially the last part: "he might have actually verified that no personal info was included"

share|improve this answer
4  
Do you think he also verified that the saved html did not contain a random token which could allow a third-party to hijack his account? – Ángel Mar 3 at 0:10
1  
Judging by his bad security practice I doubt he verified anything but the actual content itself. Bear in mind that random tokens and session cookies are not saved in the HTML body, but rather in the response sent back to the client's user-agent (e.g Firefox). In any case, the argument is not whether this is bad security practice or not (for which the answer is obvious). The argument is whether the OP should bring it up despite all the circumstances mentioned above. – Abbas Javan Jafari Mar 3 at 5:10
1  
@AbbasJavanJafari In many cases, web pages will include a random key along with the cookie. That random key is often embedded in the page as a meta tag or in embedded JS. Compromising that key is often useless without cookies, but it's a layer of compromised security. Not something to shrug off. – Undo Mar 3 at 16:42
    
Once again, the discussion is not whether or not this is bad security practice (for which the answer is obvious). It's about whether the OP should mention this issue despite the circumstances. One of these circumstances is the fact that this incident does not lead to any obvious vulnerabilities (session cookies are not compromised). In my opinion the circumstances are not enough to email and warn the other party (especially when you don't know that person very well) – Abbas Javan Jafari Mar 3 at 21:57
    
@AbbasJavanJafari random tokens are used for things like CSRF protection in the html, and the session might have ended up in the url of the page. It is admittedly unlikely that gmail would have such security hole, since it is well-known for some time that passing sessions in urls parameters is quite insecure, and it's only safe to do so through cookies (plus csrf!). Yet, I'm sure many sites are still vulnerable. OTRS didn't remove ids from URLs until version 4. There's even the -now deprecated- use_trans_sid php setting that automatically add them. – Ángel Mar 4 at 0:27

You shouldn't do this, because there's no point in doing so. If this person isn't tech savvy enough to be able to properly forward an email, they're certainly not going to be able to understand a subtle security risk like this one. As long as he's not doing something egregious (like sending you his password in plain-text), don't worry about it and just be glad that he didn't print out the email and snail-mail it to you.

share|improve this answer

I think that there is no need to worry about protection risks because google gmail solved this problem already. And HTML page contains text content + tags + css + js etc. Important information is located in browser cookies which is impossible to be sent to each other by save page. The most important user session information located in cookies but not in HTML.

share|improve this answer

If you have to send him an email in reply anyway, I would. Just write your email, and then as a PS something like "Maybe it would be better not to forward a saved Gmail page, since it might contain private information." That way you have mentioned it, and if the professor is interested in improving his security, he could ask you what would be a better way. Otherwise he could just ignore it.

share|improve this answer

I don't think you're in position to educate people you don't know very well about computer security. So, unless the professor actually shared some information he shouldn't have, you shouldn't express your concerns.

If the Gmail page you have received does contain sensitive information, then it's entirely appropriate to give him a fair warning. In that case, I would also reassure the sender that I have deleted the sensitive part and didn't transfer it to anyone else, if that is the case. And of course, if there's a password or pin code in plain sight, I would advice him to change it ASAP.

share|improve this answer

The best gift to a person is to let them know about their faults, but give it to them in the same way that you give gifts to people. You wrap it up in a gift wrap, you don't just say " Hey you! You are very uneducated with the way you are sending mail" instead you use the best and most humble worlds. Most of the times when you do such people are pleased with it. Don't you ever remember when you had some coffee on your face from the morning and no one told you till you got home! The same day you walked into 3 different meetings that day, You would want to bang your head on the wall that why didn't someone tell me!!!?!???:|

People would love to know about their faults so they could improve theirselves all the time. Unless if the person is very childish.

I would go indirect and say: " ...btw How are you avoiding the security risk when doing such..."

Either he would admit that he doesn't know anything and would just ask you more about it. [ The whole point is for you to just ask a question, and let him conclude his mistake] Or he would say that he knows what he's doing.

Obviously your tone in the moment that you say such should be be very humble.

share|improve this answer

I concur with Jasper. Writing a email (or even giving a call) centered around the potential security risk might have negative impact on your relation. Or might not, but who can tell?

Some professors really hate when it when they got "taught" something by a student.

Or you may get a response like "Why are you hacking me?", after presenting results of an (unasked for) security risk assessment.

Adding a harmless side note ("PS") to a conversation dealing with something else entirely might be more palatable.

Still, there's a risk that a recipient misunderstands your message or motive, even when the wording is, in theory, totally clear. Especially when the recipient believes that he indeed has some deficiencies in that area you discuss. He might even consider it as a hidden insult. Write your mail, think about it for a day or two, then send it. Or not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.