3

I apologize in advance for any inaccuracy.

I am part of a yoga community which has no particular activity on the web or in the informatic sector. All we have that can be regarded as web-related is that we communicate through a mailing list of about 100 people.

However, since a few months we have been under attack of hackers who crack personal email accounts and facebook accounts. They also have circulated accurate emails with name and salutations that are proper of our community, so I believe there is a human effort behind this, and not just a software.

I myself do not know much on the internet account protection, but once my account was hacked, I took my actions to protect it and do not make it happen again. I changed all my passwords and made them way more complex, I activated two-factors protection, I have installed an authenticator program which warns me (and put a code-protected wall) everytime someone tries to log in my account through a device that is not one of those I specified as secure, and I am going to work more on this direction.

Anyway, there are still people in that mailing list who are older, or just do not know very well what to do, so their account keeps getting cracked. Of course, their incapacity puts to risk all the others connected through the mailing list, which is annoying.

I was looking here for advice to hire a company, or a service, which can take care of this specific group of accounts, perhaps migrating all the accounts to a common, independent provider, such as person_name@yogaeurope.com.

I have tried for days to google something that might help, but have not really found what I think I need, I giving here a try. Someone told me to buy a WebRoot service but to me it looks it gives more protection against viruses and such, while security packages have a limit of 5 devices, so it seems to me that is not designed to protect communities against what we are experiencing (maybe I am wrong).

Is there any kind of service that we can hire to protect our mailing list? If of any relevance, we reside in Europe (not just one single country).

I do not even know if such a thing exists, especially for private communities and not for business companies, but I though this was a good point to start.

  • There is not enough information to answer your question. How do the people who are older put everyone at jeopardy? By "replying all" to the mailing list? – hft Jul 10 '18 at 5:23
  • You can't possibly have a free-to-join mailing list and still try to "protect" the computers of everyone who joins. Maybe what you want is not really a mailing list... Must you have a mailing list? What are you actually trying to accomplish with the mailing list? A mailing list might not be the best choice for your group communication... – hft Jul 10 '18 at 5:25
  • @hft mailing lists are to communicate with everybody editing a single address in the recipient of the email. There have been emails circulated by the hackers which contained programs and links, that have been clicked by someone, and this is (mostly) how people put themselves and others at risk. Once the email address has been cracked, that can be used to send others apparently reliable emails. – Py-ser Jul 10 '18 at 14:21
  • There is no way to secure this system if everyone can edit/add/send email and all the addresses are literally listed in the clear. If you want to do a more secure "broadcast" email you could put all of the other addresses in the bcc field. But in general, you will need to restrict the problem users... Probably you should start to transition away from the mailing list. For example, you could start a wiki page for your group communication. A wiki would not totally solve the security problems, but probably would be better than an open mailing list. Another option is a private group Slack. – hft Jul 10 '18 at 22:41
  • @hft you could write an answer so that others can verify what you say and I can accept your answer. Thanks anyway. – Py-ser Jul 10 '18 at 22:47
1

Per OP request, I've re-written my comments as an answer.

It seems to me that, in general, there is no reasonable way to secure your current mailing list communication system. This is because everyone on the list can edit/add/send email and all the recipient addresses are literally listed in the clear. Thus, in order to really protect this current system from all "problem users," you would have to secure all of the computers of all the users on the mailing list, including the problem users. This is infeasible.

In some cases, an email mailing list could be used securely, For example, if you want to have more of "broadcast" email system you could put all of the receiving addresses in the bcc field, so the receivers could not see each other and thus not "reply-all."

But in general, to protect your communication system, you will need to have some way to restrict the problem users. This is possible with managed enterprise email systems such as an internal corporate Outlook/Exchange system, but might not be easy for you to maintain yourself with your current email platform and heterogeneous membership.

Most likely, you will want to transition away from the large group mailing list.

You could use a wiki page instead of a mailing list for your group communication. A wiki would not totally solve the security problems, but probably would be better than an open mailing list. You can get a wiki page for free if you are okay with having advertisements shown on the wiki page.

Another option for group communication as an alternative to an open mailing list would be a private group Slack. You can get a Slack for free for small teams (google "Slack" for details).

You could also have a hybrid solution. For example, use one of the above mentioned alternatives in place of your large group mailing list, but still keep a smaller trusted mailing list that only includes known tech-savvy members.

1

If everyone can agree to have a Facebook account, you may want to consider Facebook groups.

They can be private (join only via invitation, membership not publicly visible) and be quite large. You can restrict posting so that the do not get "overcrowded" with posts.

A relative uses this for their "social help group".

See https://www.facebook.com/help/1629740080681586/

  • thank you. We already have a group on facebook. Are you suggesting to eliminate the mailing list at all? – Py-ser Jul 10 '18 at 14:23
  • 1
    Not necessarily. You may use both, at your convenience. However, I am no fan on mailing lists. Anyone can spoof and intercept email. They are useful only for information that is public anyway. – Marcel Jul 10 '18 at 20:22
  • This does not really help or answer the question. Also, as I specified in the original question, some of the breached email accounts have been used to breach the facebook accounts too. – Py-ser Jul 13 '18 at 2:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.