On 05/10/2018 05:16 AM, Rupert Gallagher wrote:
On Thu, May 10, 2018 at 00:54, David B Funk
<dbf...@engineering.uiowa.edu <mailto:dbf...@engineering.uiowa.edu>> wrote:
4) Less technical sophistication of the server side filtering VS google
Both Google and Microsoft deliver a product for the masses. They are a
mcdonald after all: you get the quality that you pay for.
Google rejects messages with either failed dmarc or a banned file type,
which is good, but also accepts advertisements, because it is *free*
after all. A relative of mine, who insists in using
gmail, spotted authentic messages to her from IRS and pension fund
buried in thousands of spam.
O365 is a paid-for service in the sense that one pays to receive spam.
2FA helps against intrusions, but I find people annoyed by the
technology, so they disable it. Hence the hacked accounts with poor
passwords.
It's not only compromised well-established accounts. Based on the odd
domain names I have seen, I am pretty sure that Microsoft allows trials
of O365 so spammers are signing up and blasting out junk/phishing emails
until they are discovered. These spammers can spoof anyone on O365 like
toysrus.com and the SPF checks will pass.
They really need to enable rate limiting and unusual GeoIP-usage
detection. Maybe they need to setup a well-tuned SpamAssassin platform
internally to properly detect spam and lock compromised/abusive accounts
quickly. :)
--
David Jones
