Timeline for Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Current License: CC BY-SA 4.0
28 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 2, 2019 at 0:49 | comment | added | forest | with file extensions hidden in something like Windows File Explorer. Even if you set it to show full file extensions, it could still be an executable with unicode reversal characters in the filename. I wrote an example of that in an unrelated answer. | |
| Apr 1, 2019 at 20:33 | history | edited | Matthew | CC BY-SA 4.0 |
added 54 characters in body
|
| Apr 1, 2019 at 13:15 | answer | added | rydwolf | timeline score: 0 | |
| S Apr 1, 2019 at 9:23 | history | suggested | unor |
added tag --
|
|
| Mar 31, 2019 at 21:29 | review | Suggested edits | |||
| S Apr 1, 2019 at 9:23 | |||||
| Mar 31, 2019 at 14:02 | comment | added | Lightness Races in Orbit | I also have a sneaking suspicion that the colleagues' reactions were not due to a risk analysis of opening HTML source in a text editor (or sedding to screen), but due to a lack of understanding. Though that's hard to prove of course. | |
| Mar 31, 2019 at 13:59 | comment | added | Lightness Races in Orbit | @mckenzm Peter's point, and he's correct, is that if we reduce this to a binary yes/no answer, the answer is NO (as in, no it's not safe). But, in reality few things are binary yes/no, and the true answer here, per my post, is that this is well below the threshold for tolerance in my view. | |
| Mar 31, 2019 at 13:05 | comment | added | Sebastiaan van den Broek | If you’re in the kind of environment where opening a html file in a text editor is considered risky, you’re in an environment that shouldn’t have access to the internet in the first place. | |
| Mar 31, 2019 at 2:28 | comment | added | mckenzm | @ Peter Cordes The question seeks a binary yes/no answer. Looking at TNEP text or filtered (sed) cat of the content is safe, as is printing it to paper. It has to be transport neutral (Base64, say), and there is always hexdump. So yes, there are safe ways. It does not have to be nano/pico/vi/emacs/gedit. | |
| Mar 31, 2019 at 2:21 | answer | added | AnonSecurityUser95 | timeline score: 3 | |
| Mar 31, 2019 at 0:47 | comment | added | Peter Cordes | @mckenzm: did you look at the existing answers before commenting? The question is not that trivial to answer "no" to. A bug in handling invalid UTF-8 sequences could exist, for example. | |
| Mar 30, 2019 at 22:57 | comment | added | mckenzm | Opened as text nothing can run, so no risk. | |
| Mar 30, 2019 at 20:05 | answer | added | Lightness Races in Orbit | timeline score: 20 | |
| S Mar 30, 2019 at 15:50 | history | suggested | Peter Mortensen | CC BY-SA 4.0 |
Copy edited (e.g. ref. <http://en.wikipedia.org/wiki/HTML>, <http://en.wikipedia.org/wiki/Notepad_%28software%29>, and <https://en.wiktionary.org/wiki/browser#Noun>).
|
| Mar 30, 2019 at 15:09 | comment | added | ctrl-alt-delor | Yes. It the file is a test, and you open it, and see that it is a test, then you may be tempted to tell others. Thus destroying the efficacy of the test. Also if people are being punished for making mistakes, then your company can not learn; mistakes will be covered up. | |
| Mar 30, 2019 at 13:58 | answer | added | tasket | timeline score: 7 | |
| Mar 30, 2019 at 8:21 | comment | added | Jerry B | @PeterMortensen : A VBS file is not an HTML file… | |
| Mar 30, 2019 at 0:43 | comment | added | Peter Mortensen |
A famous example is AnnaKournikova.jpg.vbs (Anna Kournikova (computer virus))
|
|
| Mar 30, 2019 at 0:41 | review | Suggested edits | |||
| S Mar 30, 2019 at 15:50 | |||||
| Mar 30, 2019 at 0:11 | answer | added | George M Reinstate Monica | timeline score: 20 | |
| Mar 29, 2019 at 17:48 | comment | added | Vit | All these answers are way to extreme. If you want to open a html file in a text editor go ahead, as long as there is nothing executable with it. | |
| Mar 29, 2019 at 17:32 | answer | added | reed | timeline score: 7 | |
| Mar 29, 2019 at 15:00 | history | tweeted | twitter.com/StackSecurity/status/1111644357080293377 | ||
| Mar 29, 2019 at 13:43 | history | became hot network question | |||
| Mar 29, 2019 at 12:54 | answer | added | Thomas | timeline score: 41 | |
| Mar 29, 2019 at 12:42 | answer | added | Overmind | timeline score: 1 | |
| Mar 29, 2019 at 12:28 | history | migrated | from serverfault.com (revisions) | ||
| Mar 29, 2019 at 11:39 | history | asked | Matthew | CC BY-SA 4.0 |