Email's Inherent Insecurity Fuels Impersonation Scams Over Technical Weakness
TL;DR
- Email's inherent lack of authentication allows for widespread fraud, enabling scams like payroll diversion and escrow theft by impersonating authorized individuals without technical hacking.
- The fundamental insecurity of email, analogous to an unverified return address on an envelope, persists because technical solutions are complex and often conflict with desires for content scanning.
- Implementing effective network-level content filtering for adult material is impractical in home environments, requiring endpoint solutions due to HTTPS and DNS-over-HTTPS encryption obscuring traffic.
- VLANs offer limited security benefits for wired devices unless port-locked, and even then, sophisticated users can bypass them, making them more useful for Wi-Fi segmentation.
- Relying solely on technology for parental controls is insufficient, as conversations, household culture, and device placement are more effective than technical measures for managing children's internet access.
- Advanced technical solutions like S/MIME and PGP failed to gain widespread adoption because they were designed for technical users, not normal people who require extreme simplicity for security.
Deep Dive
Email remains an inherently insecure communication protocol, a vulnerability exploited by increasingly sophisticated scams that prey on human trust rather than technological weakness. This lack of inherent security means that even seemingly official communications can be easily faked, leading to significant financial losses for individuals and organizations alike. The core issue is not a lack of technical solutions, but a persistent human tendency to trust what appears to be legitimate without proper verification.
The fundamental flaw of email lies in its design, which allows for easy spoofing of sender information. This is analogous to a physical letter where the return address has no inherent validation; anyone can write anything in the upper-left corner, regardless of its truth. Despite decades of awareness and the availability of technologies like DKIM, S/MIME, and PGP, the widespread adoption of secure email practices has been hindered by complexity and a reluctance to abandon the ability to scan email content. Consequently, scams involving payroll diversion, real estate escrow theft, and large-scale project payments are common, with potential losses ranging from thousands to millions of dollars. These fraudulent activities are often characterized by creating a false sense of urgency and impersonating trusted entities, exploiting the human desire to be helpful or avoid negative consequences.
The most effective and common email frauds bypass intricate technical hacking entirely, relying instead on simple impersonation where the displayed name is trusted over the actual, often obscured, email address. This is exacerbated by email clients that prioritize displaying only the sender's name, making it difficult for users to discern legitimacy. While some email services offer warnings about suspicious emails, these measures are insufficient against determined actors. Furthermore, the trend towards encrypted communication protocols like HTTPS and DNS over HTTPS complicates network-level content filtering, making endpoint-based solutions more practical for robust security. However, even these technical solutions are secondary to non-technical strategies.
Ultimately, addressing the risks associated with email fraud requires a multi-layered approach that prioritizes human awareness and established procedures over technical safeguards alone. Implementing clear, written policies that explicitly prohibit financial transactions or sensitive actions based solely on email is crucial. These policies should be communicated to business partners to establish a shared understanding of secure communication practices. Beyond formal policies, fostering open communication and a culture of verification within households and organizations is paramount. While technical controls can offer some protection, especially for younger users, the most resilient defense against email-based scams lies in cultivating critical thinking and reinforcing the understanding that technology is a tool, not an infallible guarantor of truth.
Action Items
- Audit email authentication: Implement DKIM and SPF checks across 100% of inbound mail to prevent spoofing.
- Create network policy: Define written rules for financial transactions, prohibiting actions based solely on email.
- Evaluate VLAN security: Document port-locking requirements for wired devices to prevent unauthorized network access.
- Implement endpoint filtering: Deploy parental control software on 3-5 family devices for granular content blocking.
- Establish device placement policy: Define rules for tablet and phone usage in shared vs. private spaces for 3 children.
Key Quotes
"If you're listening to Two and a Half Admins, I think we can probably assume you already know that email is an insecure protocol and should not be trusted. And, you know, just because you got an email that says it's from me or Alan doesn't mean that you got an email from me or Alan necessarily. It's not an authentication protocol."
The author, Jim Salter, argues that despite common knowledge among tech-savvy individuals, the general public still misunderstands the inherent insecurity of email. He emphasizes that the "From" address in an email is not a reliable form of authentication, meaning an email appearing to be from a known sender could easily be a forgery.
"For decades now, I have dealt with people just anguished because like, 'But it said that it came from this person.' So, you know, and it's like, 'Yeah, okay, well, if a letter shows up in your mailbox and it's got a kitten stamp on it and a postmark from Slapout, Alabama, but up in the upper left corner of the envelope it says, you know, 'The Oval Office, 1600 Pennsylvania Avenue, Washington D.C. 20500,' did you get a letter from the president?' Most people would pretty quickly pick up on the fact that, no, no, I did not."
Jim Salter uses an analogy to illustrate the unreliability of email sender information. He compares the "From" field in an email to the return address on a physical letter, explaining that just as a forged return address on an envelope does not mean the letter is from the purported sender, the "From" line in an email does not guarantee its origin.
"The only way to make email secure would be to remove all the ways that you can screw around with it. And is that something that we could do? Yes, it is. Is it something we have done? No, absolutely not. If we actually wanted to be able to trust emails, at a bare minimum, we should have something like the green lock icon that we have in the browser that tells you whether or not a site has a valid SSL certificate for the domain it's attempting to be from. We could do that with email really easily."
Jim Salter explains that true email security would require removing its inherent flexibility for manipulation, a step that has not been taken. He suggests that a simple, easily implementable solution, similar to the browser's green lock icon indicating a secure website, could be applied to email to verify its authenticity.
"All of which is still aiming north of where you really need to aim as an attacker, because in actual fact, the most common successful email fraud that I see is there's no technical hacking of any kind whatsoever. You literally just write 'Joe Resington' in the From, and the actual email address that also shows in the From is like, 'I am a Nigerian scammer at, you know, gmail.com.' But the recipient doesn't care, they just see 'Joe Resington' and say, 'Yep, this is from Joe.'"
Jim Salter highlights that the most prevalent and successful email scams do not involve complex technical exploits. He points out that simply displaying a recognizable name in the "From" field, even when the actual email address is clearly fraudulent, is often enough to deceive recipients who do not scrutinize the sender's details.
"The actual flaws being exploited have nothing to do with technology and everything to do with the human mind."
Jim Salter concludes that the persistent success of email scams is not due to technological vulnerabilities but rather to inherent human psychological traits. He argues that these scams exploit human tendencies, which have remained consistent across different communication technologies throughout history.
"I find that most people haven't really thought the security implications through, and what they wind up doing is making life harder for themselves on their network without materially improving the actual security."
Jim Salter expresses skepticism about the widespread adoption of VLANs for home network security. He argues that many users implement VLANs without fully understanding their security implications, leading to increased network complexity and management overhead without providing a significant improvement in actual security.
Resources
External Resources
Articles & Papers
- "Lead The Target" (2.5 Admins) - Discussed as a cautionary piece on the insecurity of email and the prevalence of email-based fraud.
- "top zfs capabilities delivered by clara in 2025" (Clara) - Mentioned as a recap of features upstreamed for OpenZFS in 2025.
People
- Jim Salter - Author of an article discussing the insecurity of email and email-based fraud.
- Alan Jude - Co-host of the podcast, mentioned in relation to the Clara article and discussing network security.
- Joe - Co-host of the podcast.
- Zachary - Listener who submitted a question about setting up DNS query blocking profiles per VLAN.
Websites & Online Resources
- latenightlinux.com/support - Referenced for patron support details and joining the Patreon community.
- 25admins.com/support - Referenced for patron support details and joining the Patreon community.
- jares.com - Jim Salter's website.
- mercenarysysadmin.com - Alan Jude's website.
Other Resources
- OpenZFS - Mentioned in relation to features upstreamed in 2025, including fragmentation fixes and NVMe disk support.
- VLANs - Discussed as a network segmentation tool, with considerations for security implications and practical implementation.
- AdGuard Home - Mentioned as a tool for ad blocking and content filtering, with limitations regarding profile features.
- Unbound - Mentioned as a potential alternative for DNS query blocking.
- DKIM - Discussed as an email authentication method that allows mail servers to sign emails.
- S/MIME - Mentioned as an effort for email authentication using certificates, noted for its complexity for average users.
- PGP - Mentioned alongside S/MIME as an email authentication method.
- HTTPS - Referenced in the context of secure web browsing and its implications for network-level content filtering.
- DNS over HTTPS (DoH) - Discussed as a technology that makes it harder to control DNS resolution at the network level.
- AI voice emulation - Mentioned as a technique used in scams to impersonate individuals.
- Safe Search - Mentioned as a basic content filtering method used by Google.