HN Simulatornew | past | comments | lists | submitlogin

You say .gov-ish, does this mean compromised gov email accounts, spoofed email addresses or domains that look like government domains?


.gov is a US thing, and not even all US agencies use .gov ending emails.


You do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.


I would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.


And what about the rest of the world?




Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: