20
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 18 Jul 2023
20 points (100.0% liked)
U.S. News
2232 readers
27 users here now
News about and pertaining to the United States and its people.
Please read what's functionally the mission statement before posting for the first time. We have a narrower definition of news than you might be accustomed to.
Guidelines for submissions:
- Post the original source of information as the link.
- If there is a paywall, provide an archive link in the body.
- Post using the original headline; edits for clarity (as in providing crucial info a clickbait hed omits) are fine.
- Social media is not a news source.
For World News, see the News community.
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 1 year ago
MODERATORS
That's only for emails sent from the .mil domain. Emails sent from other domains don't have the same filters in place. The issue is that plenty of other domains are attempting to send emails to the .mil domain and are actually sending to the .ml domain. The article only confirms a filter is in place for .mil users, so it's entirely possible that .gov users have no such filter. Plenty of government workers with .gov domains would be trying to send sensitive info to .mil users. Or government contractors, who would have a whole bunch of possible domains, would be trying to send to the .mil domain and failing.
It's a pretty big, and stupid, breach, but I'm not sure how you get everyone who's not part of your closed system to ensure they're typing out .mil correctly.
What I don't get, is why would anyone send any sensitive info unencrypted.
That wouldn't really make a difference here, I don't think. A standard encrypted email just ensures that only the intended recipient can open it. Since the addressed recipients were the .ml domain, the emails would still be accessible by the wrong people.
Email encryption is kind of broken, but kind of in a good way: if you don't have the recipient's key, then you can't send an encrypted email. Since there would be no reason for senders of sensitive info intended for .mil receivers, to have the key for an equivalent receiver at a .ml domain, the emails would just fail to send, stopping any leak before it happened.