Is email forwarding an altogether unsafe practice?

Question

Some folks like the idea of keeping the same email address for life. It permits a personal and permanent email address (e.g. [email protected]) even as you change internet service providers. You can easily forward to your new provider account (Comcast, Earthlink, etc.) or your cloud account (gmail, hotmail, yahoo, etc.).

When doing this you are now relying on the security of two platforms (host and destination).

Though I'm not a security person, my thought is that forwarding in any situation is incredibly unsafe. If a criminal compromises someone's host account he could start hacking that person's accounts. He could issue password recovery requests intercepting correspondence that would alert the victim and pass on the rest. The victim would remain none the wiser since he'd get his normal deluge of emails.

If I'm correct, no one should use any sort of email forwarding.

Answer 1

You're right, but consider this:

Most E-Mail traffic happens in plain text. E-Mails take several hops while being routed to the target mail server. All the routers in between can read the email if they want to. This includes notoriously unsafe home routers which never get security updates.

Finding the target mail server involves MX record retrieval for the domain name. This opens up a whole other venue of attacks. If you manage to convince the sending server that you are the correct destination, you can reroute all emails for a given domain to yourself and then forward them to the actual target, without anybody noticing unless some automated system warns an administrator about changed mx records.

You can easily fake the sender address of an E-Mail, which opens various other avenues of social engineering or pushing your victim into unwise actions because they think they're acting on something someone they trust told them.

E-Mail is unsafe, period. I don't see how adding another level of indirection makes this much worse. There's already a large number of attack venues against the distributed mail system without email forwarding even entering the picture. Following your argument, nobody should ever use E-Mail at all, forwarded or not.

Still, we do, and by and large, see E-Mail as a valuable form of communication. Also, E Mail Forwarding may actually improve security, since you can get a very cheap kind of minimal anonymity by registering throwaway forwarding adresses, switch mail adresses when your old one gets flooded with spam etc (eg use the forwarding in the opposite way - as a temporary address that protects your permanent one).

Answer 2

Yeah, there is certain risk factors like you've noticed with account resetting your credentials. If you wish to reduce the security scope of your account been compromised then you should migrate your account from your old e-mail address to your new e-mail address. So, the old e-mail address wouldn't have to deal with sensitive account information. Though, doing this would also make your account higher risk due to having all your accounts on an single e-mail account. So, question is what level do you stop worrying about security? If someone compromised an website which you had an account on or website which makes your email address visible to public? And so on.

The forwarder still has good purpose though such as let's say friends or family or someone trying to contact you to get them to move onto the correct e-mail address.

Answer 3

@Pascal is essentially correct

The main avenues to keep in mind here are

• Email (SMTP specifically) is inherently insecure, and should not be considered safe
  • It's not encrypted and so can be intercepted by any hop along the path
  • It's not innately signed which means you can't actually trust it comes from whom it claims to be sent from (*there are ways to do this but they're advanced enough that if you were using this you'd probably have known not to trust vanilla email already)
  • Email pathing is dependent on other systems (like DNS) which can be attacked themselves (such as a DNS Cache Poison attack among others)
• While a redirect potentially does open another avenue for attack, this is not a significant increase in vulnerability beyond the existing risks unless either
  • You're trusting it beyond a level that it deserves
  • Or you have more advanced security in place (like automatic certificate signing and verification + manually verifying the chain of trust for important emails)

Also as a footnote towards the op comment, it's not analogous to using a password manager. Password managers, if used properly, increase security because

• Most people use variants of the same password across multiple sites, which means you don't have 1 or 2 points of failure, you have as many points of failure as sites where you use any variant of that password
• Most people don't segment different passwords based on security boundaries. If you use the same password for your banking as you do on forums.oldgames.com and the latter has weak security (because it's a budget site run by fans), then it's trivial to compromise that password, regardless of how good the bank's security systems are
• The password manager shifts that risk from many sites with questionable security to a single site that's specifically focused on security and enables you to verify it's doing it's job correctly with a reasonable amount of effort (a task that's infeasable for trying to verify security for 100+ sites that don't disclose their security measures)

There are bad password managers out there, and there are sites for which you should be using separate, unique passwords that aren't saved in a password manager. But they are very good for mitigating the potential risk for the vast majority of your accounts, freeing you up to focus time and effort on better securing the few sites that deserve special attention.

Answer 4

Email is a vulnerable place - if it's compromised, your passwords are effectively gone (use 2FA!). I'll admit I think Google is more secure than most companies, so by using Pobox to forward there I'm making it at least a bit easier to attack me. (I'm the author of the post OP links to.)

But I'm also never logging into Pobox, and most email attacks are interactive (rather than hacking into the email provider's underlying infrastructure). Fooling me into clicking something from within Pobox isn't going to happen because it's not my active inbox, and fooling me into logging into a fake Pobox is going to be tougher because I don't ever need to do that. Pobox uses 2FA, so someone would have to find a weakness in Pobox's implementation, or otherwise penetrate Pobox's systems, in order to plausibly access my account.

So the risk is non-zero, but I don't think it's high, and it's certainly not like doubling or squaring the risk of using a single inbox. You can legitimately choose not to forward out of security concerns, but I don't think it's accurate to say that "no one should use any sort of email forwarding".