A relatively old professor from another institute "forwarded" to me, using his work email, a work-related message he had received on his Gmail account.
However, he actually saved the entire Gmail webpage and attached it. A saved Gmail webpage may contain personal information and should not be shared with others.
He is based in a distant city and I didn't meet him in person (yet), but we work remotely on the same project.
Should I care and tell him about this bad security practice? How?
If this was a one-time thing and you don't know this person very well, I would avoid bringing it up.
Once you know this person fairly well or communicate with them on a semi-regular basis, then sure, in your next email to the person just put as a note at the end of the email that they might be cautious about including the entire webpage.
The concern is that it might be off-putting to someone if they don't know you well and perhaps this professor actually verified that no personal info was included.
I think it is first necessary to evaluate the actual risks involved in such practice. Forwarding an entire email web-page is indeed a bad habit in terms of security, but it does not necessarily point to specific vulnerabilities (like remote code execution, injection-based attacks...) with a clear risk assessment.
My point from the above is, given the circumstances, it's hard to articulate the exact risks caused by this incident. If this is an isolated incident, especially if you don't have a relatively close relationship with this professor, I would strongly discourage you from bringing it up. Keep in mind that it's hard to express the right degree of sympathy through an e-mail, and therefore, you might come across as picky, arrogant or even rude. (This is especially true if you're emailing someone who isn't familiar with you personally)
EDIT: I also agree with @Austin Henley's answer, especially the last part: "he might have actually verified that no personal info was included"
You shouldn't do this, because there's no point in doing so. If this person isn't tech savvy enough to be able to properly forward an email, they're certainly not going to be able to understand a subtle security risk like this one. As long as he's not doing something egregious (like sending you his password in plain-text), don't worry about it and just be glad that he didn't print out the email and snail-mail it to you.
If you have to send him an email in reply anyway, I would. Just write your email, and then as a PS something like "Maybe it would be better not to forward a saved Gmail page, since it might contain private information." That way you have mentioned it, and if the professor is interested in improving his security, he could ask you what would be a better way. Otherwise he could just ignore it.
I think that there is no need to worry about protection risks because google gmail solved this problem already. And HTML page contains text content + tags + css + js etc. Important information is located in browser cookies which is impossible to be sent to each other by save page. The most important user session information located in cookies but not in HTML.
I don't think you're in position to educate people you don't know very well about computer security. So, unless the professor actually shared some information he shouldn't have, you shouldn't express your concerns.
If the Gmail page you have received does contain sensitive information, then it's entirely appropriate to give him a fair warning. In that case, I would also reassure the sender that I have deleted the sensitive part and didn't transfer it to anyone else, if that is the case. And of course, if there's a password or pin code in plain sight, I would advice him to change it ASAP.
The best gift to a person is to let them know about their faults, but give it to them in the same way that you give gifts to people. You wrap it up in a gift wrap, you don't just say " Hey you! You are very uneducated with the way you are sending mail" instead you use the best and most humble worlds. Most of the times when you do such people are pleased with it. Don't you ever remember when you had some coffee on your face from the morning and no one told you till you got home! The same day you walked into 3 different meetings that day, You would want to bang your head on the wall that why didn't someone tell me!!!?!???:|
People would love to know about their faults so they could improve theirselves all the time. Unless if the person is very childish.
I would go indirect and say: " ...btw How are you avoiding the security risk when doing such..."
Either he would admit that he doesn't know anything and would just ask you more about it. [ The whole point is for you to just ask a question, and let him conclude his mistake] Or he would say that he knows what he's doing.
Obviously your tone in the moment that you say such should be be very humble.
I concur with Jasper. Writing a email (or even giving a call) centered around the potential security risk might have negative impact on your relation. Or might not, but who can tell?
Some professors really hate when it when they got "taught" something by a student.
Or you may get a response like "Why are you hacking me?", after presenting results of an (unasked for) security risk assessment.
Adding a harmless side note ("PS") to a conversation dealing with something else entirely might be more palatable.
Still, there's a risk that a recipient misunderstands your message or motive, even when the wording is, in theory, totally clear. Especially when the recipient believes that he indeed has some deficiencies in that area you discuss. He might even consider it as a hidden insult. Write your mail, think about it for a day or two, then send it. Or not.
