0

Most common email services don't allow to attach file like exe files, or similar files that may contain security threats to a computer.

This can be bugging for users, but I can understand that, in general, the benefits are likely to outweight the damages.

But what I don't get is that it's forbidden to send a dangerous file if you are sending it to the same addres you are sending it from. Honestly, it is a file that the user itself has attached from his computer, so, it looks kind of pointless to try to protect the user from malicious files with a file he already owns.

Maybe no email service has ever wondered about this special case and they just block by default, but I extremely doubt nobody has ever considered that special use case, in which I believe, it would be better to allow to send whatever the user wants.

Is there any special risk for a situation like this, or some type of attack that could be taken advantage of?

Improve this question
5
  • 1
    a malicious file could be harmful for the server where you email is hosted.
    – elsadek
    Aug 26, 2021 at 9:02
  • In my opinion, this question is too broad, and has no factual answer. Nevertheless, one "risk" i can already spot is an attacker who powned the mailbox could do such action to make the legitimate owner of the mailbox download and execute the file.
    – binarym
    Aug 26, 2021 at 9:41
  • Why would you send an email to yourself with a programm or data attached in the first place? Misusing a mail inbox as a storage / archive system is not a good practice. Especially when its a dangerous / malicious files.
    – Valentin
    Aug 26, 2021 at 11:31
  • You can try the old trick of attaching the .exe to a draft message, saving the draft, and then accessing the saved draft - if the mail provider only filters when mail is sent, you'll evade their prohibition on malicious attachments. (Of course this is, as Valentin warns against, misusing mail as a storage system :)
    – gowenfawr
    Aug 26, 2021 at 18:10
  • Zip the file with a password. Send as you like. Note that your corporate rules likely will take umbrage.
    – user10216038
    Aug 26, 2021 at 19:12

1 Answer 1

Reset to default
1

It's actually quite difficult to determine that you're sending to yourself and that there are no other recipients (via email alias, forwarding, etc) ... I'd also call that quite the corner case.

There are security risks even beyond other recipients triggered by your own email address. For example, somebody else could gain access to your account and then send out an attack, even if solely to your account.

Your options as I see them:

  1. Use a shared network drive like Dropbox, Keybase, or Google
  2. Save the email as a draft and move it into your inbox (pure IMAP, no SMTP)*
  3. Encrypt it so it's not visible to the server (e.g. password-protected ZIP file)**

*: If you consider #2, be aware that your IMAP server might be scanning your content for threats after delivery, in which case it could be removed. This is possible but unlikely.

**: Your mail server might reject encrypted documents (because attackers are starting to use them to deliver malicious payloads). If this is the case, go for a more obscure format or try a different technique.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .