OE vs Web Based email

[rjshenal]

Hello:
I have been getting my email using Outlook Express. With alot of todays viruses/worms, alot of them come into your computer thru outlook and outlook express.
My ISP also has a web based eamil feature which I also use. I was told by the people at my ISP that these viruses/worms can't affect my computer using web based email because I only read the email from my ISP and don't really download anything.
Can anyone tell me if this is true or not?

Many Thanks.

rjshenal

rjshenal@nlcomm.com

[Budfred]

It is probably true that you won't get infected just opening a message, but if you open an attachment you can be.... If your ISP strips attachments, that would not be a problem, but then friends can't send attachments....

[ErnieK]

You could also install mailwasher to enable you to check your mail prior to downloading onto your computer. This would enable you to delete any unknowns or suspicious mails before you actually download your mails. (there is a free version as well as the paid for version)

http://www.mailwasher.net/

[sleddog]

Webmail is much safer than Outlook or Outlook Express, as many email viruses are targetted specifically at these email programs.

Opening a file is also less of a danger, as most browsers won't let you run an executable file directly. You need to save it to disk first (and when you do that your antivirus program should check it). There is a possibility however of getting a virus from an infected file like a Word document, which you may be able to open directly and which may contain macro viruses.

Does the webmail program display HTML mail as HTML, or as plain text? Plain text is much preferred for security. If you're seeing some messages formatted with font sizes and colours, see if there's an option to display plain text only in the webmail options.

Of course, the safest way to read webmail is with a browser other than Internet Explorer, for example Mozilla Firebird. You then avoid the myriad security problems associated with IE.

[Budfred]

Unfortunately, the free version of MailWasher won't let you scan webmail, but it will work fine for the standard email accounts...

[sleddog]

In the context of ISP mail, "webmail" and "standard mail" is the same thing -- meaning the same mailbox, just different ways of accessing it.

[sleddog]

A MailWasher question for Budfred et al.: when MailWasher downloads mail for analysis (to rank it) does it download only headers + body, or does it download headers + body + attachments?

For example, if there is a 5kb email with a 150kb attachment, does it download 5kb for analysis or 155kb?

[rjshenal]

Hi:

The people at my ISP told me that nothing is actually downloaded onto my computer, that I just read what is on their server email program, and noway I can get a virus onto my computer because I just read messages and download nothing.

rjshenal

rjshenal@nlcomm.com

[Budfred]

sleddog,

When I say standard email, I mean POP based email. The paid version will now apparently do IMAP and AOL now, but the free version won't...

I don't think MailWasher downloads anything. I would have to read the details to know for sure, but it appears that it reads the email on the server and you then decide to download, delete, or delete & bounce. When I delete, it seems to get scanned by Norton as it disappears, but it is gone
from the server and doesn't end up in my Trash file...

rjshenal,

It is true that nothing is normally downloaded to your computer, but if someone send you a file through the email, you have to download it to read it and it can be contaminated. If you are using a good antivirus, it would catch a virus usually, but there are the exceptions already noted for that and it wouldn't necessarily pick up on a trojan or spyware anyway...

[sleddog]

Originally posted by Budfred
When I say standard email, I mean POP based email. The paid version will now apparently do IMAP and AOL now, but the free version won't...

Just to be clear for everyone: POP and IMAP are standard protocols for accessing a mailbox file. Webmail can be another way of accessing the same file. An email provider may support one, or two or all three methods. For example, I can access my mail accounts using either POP or IMAP or webmail.

I don't think MailWasher downloads anything. I would have to read the details to know for sure, but it appears that it reads the email on the server and you then decide to download, delete, or delete & bounce. When I delete, it seems to get scanned by Norton as it disappears, but it is gone from the server and doesn't end up in my Trash file...

If MailWasher is going to examine it, then it has to download it. The MailWasher webpage is a little fuzzy on what it does with respect to downloading, to quote:

Delete unwanted e-mails before you download them. You’ll be able to see who the email is from, the subject, and the attachment. This will enable you to decide if you want to delete the email or keep it...

Analyse. MailWasher analyses each email as it arrives and warns you if it is suspected junk mail or a virus by heuristic checking and filtering.

The first paragraph suggests that only headers are downloaded, and it is up to the user to decide what to keep or delete. This is equivalent of using IMAP or one of the many free mailbox "preview" programs available.

The second paragraph implies that mail is downloaded to the local machine: "MailWasher analyses each email as it arrives." Heuristic analysis is performed on the local machine, not on the server. In order to do the analysis and categorize the mail, MailWasher must download it for reading. The question remains whether it downloads only the body or also file attachments. My suspicion is that it downloads the file attachments as well. I guess I should test it

The point I'm getting at is that MailWasher doesn't really address the problem of downloading unwanted email. What it seems to do is (a) give you an opportunity to delete mail on the server, basing your decision only on the mail headers, and (b) download other mail in its entirety, then discard stuff classified as spam. For dialup users, this is still a nuisance as the same bandwidth is used as in an ordinary mailcheck. There are more bandwidth-efficient ways of doing it than that.

[Budfred]

I dug a little deeper and found that it previews mail in text form, so it provides some security with that. It also doesn't take nearly as long to preview and process email with MailWasher as it does doing it by downloading it and deleting from your own computer. It will mark most garbage as garbage so it is easy to delete. I have used it with dialup and it is very quick, presumably because it is only showing some basic info about the email and then it doesn't have to come on my computer at all. I can delete 16 SPAM messages (my record so far) in less time than it takes to download a couple of notices from PCGuide that someone has responded to a thread I am following. I would suggest that you do as you said: "I guess I should test it" before you determine that it doesn't help. I have found it to be quite handy...

[sleddog]

I didn't "determine that it doesn't help." I was merely attempting to understand how it functions by soliciting input from users. There's been much talk of MailWasher in these forums, and I thought someone could clarify the method by which it works. I guess I will indeed have to test to find that out.

[ErnieK]

MAilwasher "downloads" (NOT onto computer) any mails waiting for you and lets you pre-view the contents.

When you click on a mail there, it will let you see and read the body of the mail in TEXT form. You can also ask to see the full header for the mail.

It WILLNOT open any HTML mail, it just "converts" what it can to text (my explanation here)

You can set MW to show if there is an attachment, BUT it will NOT give you access to that attachment until you actually download onto your computer.

If you click on a web-link from within MW it gives a warning.

If you can get your hands on Version 2.0.19beta this will let you check one webmail address as well (Hotmail only) as another 2 pop mail accounts

[Paul Komski]

The people at my ISP told me that nothing is actually downloaded onto my computer

.

To be completely pedantic, if nothing is downloaded to your computer you would not be able to view anything in your browser. All webpages are downloaded into the temporary internet files folder, where they remain until "dealt with" in a number of ways. Which ISP are you using?

If you get sent an attachment - then does your ISP strip this off your eMail. If not, and you can download it, then "something else" is actually downloaded or downloadable onto your computer.

If you can view pages in HTML aka Formatted Text aka Rich Text and you dont have your browser configured to block them, then Scripts and ActiveX controls will be downloadable to your computer and will be a security threat.

The only completely safe mail clients that I know of only download plain text. Popcorn is a good example - it only works for POP accounts - the mails will be bland - and you will not be able to download attachments. It is however highly portable (fits on a floppy) and fast and you can delete your mails on the server if you so desire.

[sleddog]

Originally posted by Paul Komski
.

To be completely pedantic, if nothing is downloaded to your computer you would not be able to view anything in your browser. All webpages are downloaded into the temporary internet files folder, where they remain until "dealt with" in a number of ways. Which ISP are you using?

To be utterly pedantic about it, webpages are downloaded and save in your web browser's disk cache which, if you happen to use Internet Explorer, is called "temporary internet files".

If you can view pages in HTML aka Formatted Text aka Rich Text and you dont have your browser configured to block them, then Scripts and ActiveX controls will be downloadable to your computer and will be a security threat.

This is absolutely true for Internet Explorer, but not so for other browsers that do not support Microsoft's ActiveX and vbscript. While Javascript may provide potential security holes for other browsers, the seriousness of that threat is miniscule compared to the dangers of ActiveX and vbscript.

[Paul Komski]

LOL

Pedant caught by pedant.

Should have stipulated IE

[pave_spectre]

I dont have any of the previous mentioned issues with my email as I have a free purely web-based email account (sort of like hotmail but not as crap). I can also use an email client to download files if I want.

If anyone sends HTML formatted e-mails all I am able to see is the actual source code, so if there was anything hostile I could happily search it out and delete it before pasting the text into notepad or even dreamweaver and viewing the actual file. A bit of effort but it means anything I read can be trusted.

[Mitch Hatfield]

The second paragraph implies that mail is downloaded to the local machine: "MailWasher analyses each email as it arrives." Heuristic analysis is performed on the local machine, not on the server. In order to do the analysis and categorize the mail, MailWasher must download it for reading. The question remains whether it downloads only the body or also file attachments. My suspicion is that it downloads the file attachments as well. I guess I should test it

Well here's what my Mailwasher actually does so far as image attachments are concerned:



With body copy, I have the choice of viewing the message itself, or the headers.

I too don't believe that Mailwasher "reads" messages whilst they are still on the mail servers - and certainly not in the case of Hotmail!

On the other hand, used in conjunction with OE6, I enjoy using the program - now without its "Bounce " feature enabled - and it does save me a little time in my daily elimination of spam.

I suppose if I'm totally honest, Mailwasher does little that is useful and which cannot be achieved by using just Outlook Express 6, but it's free fun - for me at least!