{"id":5456,"date":"2019-01-10T14:00:02","date_gmt":"2019-01-10T12:00:02","guid":{"rendered":"https:\/\/igloonet.cz\/blog\/?p=5456"},"modified":"2020-07-23T13:15:46","modified_gmt":"2020-07-23T11:15:46","slug":"jak-zabezpecit-e-mail-pred-zneuzitim","status":"publish","type":"post","link":"https:\/\/igloonet.cz\/blog\/jak-zabezpecit-e-mail-pred-zneuzitim\/","title":{"rendered":"Jak zabezpe\u010dit e-mail p\u0159ed zneu\u017eit\u00edm"},"content":{"rendered":"
<\/div>\n

Zfal\u0161ovat e\u2011mailovou adresu odesilatele je dnes velmi jednoduch\u00e9. Spousta u\u017eivatel\u016f o tomhle riziku v\u016fbec nev\u00ed, p\u0159itom re\u00e1ln\u011b hroz\u00ed, \u017ee z v\u00e1s podvodn\u00edk vytah\u00e1 citliv\u00e1 data nebo pen\u00edze. Uk\u00e1\u017eu v\u00e1m proto, jak si zabezpe\u010dit e\u2011mail, aby ho ne\u0161lo podvrhnout.<\/p>\n

<\/p>\n

Pro\u010d \u0159e\u0161it zabezpe\u010den\u00ed e\u2011mail\u016f?<\/h2>\n

Protokol pro zas\u00edl\u00e1n\u00ed e\u2011mailov\u00fdch zpr\u00e1v SMTP byl u samotn\u00e9ho zrodu internetu, od t\u00e9 doby ale trochu zaspal dobu. Kamenem \u00farazu je zvl\u00e1\u0161\u0165 jeho bezpe\u010dnost, kter\u00e1 nepo\u010d\u00edt\u00e1 s \u017e\u00e1dn\u00fdm ov\u011b\u0159ov\u00e1n\u00edm \u00fadaj\u016f o odes\u00edlateli, a snadno tak m\u016f\u017ee doj\u00edt k zneu\u017eit\u00ed e\u2011mailov\u00e9 adresy. Je to jako s po\u0161tovn\u00ed ob\u00e1lkou, na kterou jde napsat vymy\u0161len\u00e1 adresa odes\u00edlatele, jen mnohem nebezpe\u010dn\u011bj\u0161\u00ed. Podvodn\u00edk se m\u016f\u017ee vyd\u00e1vat za kamar\u00e1da a vym\u00e1mit z v\u00e1s t\u0159eba pen\u00edze nebo p\u0159\u00edstupov\u00e9 \u00fadaje.<\/span><\/p>\n

P\u0159\u00edkladem zneu\u017eit\u00ed je t\u0159eba tenhle nep\u0159\u00edjemn\u00fd spam. Informuje o napaden\u00ed \u00fa\u010dtu a sna\u017e\u00ed se to dok\u00e1zat fale\u0161nou adresou odes\u00edlatele.<\/span><\/p>\n

<\/p>\n

Poslat <\/span>e\u2011mail, kter\u00fd se tv\u00e1\u0159\u00ed, \u017ee je odeslan\u00fd z ciz\u00ed adresy, <\/span>je p\u0159itom velice jednoduch\u00e9. Nepot\u0159ebujete \u017e\u00e1dn\u00e9 technick\u00e9 znalosti, na internetu je voln\u011b dostupn\u00e1 cel\u00e1 \u0159ada n\u00e1stroj\u016f. Zkuste si t\u0159eba p\u0159es https:\/\/emkei.cz\/<\/a> poslat zpr\u00e1vu sami sob\u011b. Dorazila do doru\u010den\u00e9 po\u0161ty? Pak rozhodn\u011b pokra\u010dujte ve \u010dten\u00ed, v\u00e1\u0161 e\u2011mail pot\u0159ebuje zabezpe\u010dit. <\/span><\/p>\n

Vymezen\u00ed po\u0161tovn\u00edch server\u016f pro va\u0161i dom\u00e9nu (SPF)<\/span><\/h2>\n

Prvn\u00ed ochranou p\u0159ed zneu\u017eit\u00edm je omezen\u00ed po\u0161tovn\u00edch server\u016f, kter\u00e9 maj\u00ed povoleno e\u2011mailov\u00e9 zpr\u00e1vy z va\u0161\u00ed dom\u00e9ny odes\u00edlat. Po\u0161tovn\u00ed server p\u0159\u00edjemce v\u017edy kontroluje, zda nov\u00e1 zpr\u00e1va p\u0159i\u0161la od povolen\u00e9ho serveru. <\/span>Kdy\u017e ne, <\/span>bu\u010f ji ozna\u010d\u00ed jako podez\u0159elou nebo \u00fapln\u011b zahod\u00ed.<\/span><\/p>\n

Spr\u00e1vce z\u00e1znam\u016f zapisuje seznam povolen\u00fdch po\u0161tovn\u00ed server\u016f do DNS jako SPF z\u00e1znam dom\u00e9ny. Nap\u0159\u00edklad pro igloonet.cz vypad\u00e1 n\u00e1sledovn\u011b:<\/span><\/p>\n

v=spf<\/strong>1 mx include:spf.igloonet.cz include:spf.mailkit.eu include:registrarmail.net ~all <\/span><\/p><\/blockquote>\n

Do SPF z\u00e1znamu je pot\u0159eba p\u0159idat v\u0161echny po\u0161tovn\u00ed servery, kter\u00e9 va\u0161e dom\u00e9na m\u016f\u017ee pou\u017e\u00edvat. Dob\u0159e si to rozmyslete, nemus\u00ed to b\u00fdt pouze server odchoz\u00ed po\u0161ty z e\u2011mailov\u00e9ho klienta, ale i webov\u00fd server e-shopu nebo n\u00e1stroj pro rozes\u00edl\u00e1n\u00ed newsletter\u016f. Uka\u017eme si to na v\u00fd\u0161e zm\u00edn\u011bn\u00e9 dom\u00e9n\u011b igloonetu: Z\u00e1znam obsahuje na\u0161e po\u0161tovn\u00ed servery, d\u00e1le servery Mailkitu<\/a>, kter\u00fdm klient\u016fm pos\u00edl\u00e1me hromadn\u00e9 rozes\u00edlky a servery registru dom\u00e9n, kter\u00e9 rozes\u00edlaj\u00ed z na\u0161\u00ed dom\u00e9ny informace k registrovan\u00fdm dom\u00e9n\u00e1m na\u0161im klient\u016fm.<\/span><\/p>\n

Posledn\u00ed \u010d\u00e1st \u0159\u00edk\u00e1 po\u0161tovn\u00edmu serveru p\u0159\u00edjemce, jak by se m\u011bl chovat ke zpr\u00e1v\u011b, kter\u00e1 dorazila z nepovolen\u00e9ho serveru. Hlavn\u00ed dv\u011b mo\u017enosti jsou:<\/span><\/p>\n

    \n
  • softfail (~all)<\/strong> - zpr\u00e1va nej\u010dast\u011bji spadne do spamu<\/span><\/li>\n
  • fail (-all)<\/strong> - zpr\u00e1va by se v\u016fbec nem\u011bla dostat do schr\u00e1nky p\u0159\u00edjemce<\/span><\/li>\n<\/ul>\n

    Mo\u017enost softfail v SPF z\u00e1znamu je docela o\u0161emetn\u00e1. V lep\u0161\u00edm p\u0159\u00edpad\u011b zpr\u00e1va spadne do spamu, v hor\u0161\u00edm se do p\u0159edm\u011btu p\u0159id\u00e1 pro b\u011b\u017en\u00e9ho u\u017eivatele nic ne\u0159\u00edkaj\u00edc\u00ed [SPFSOFTFAIL]. Server p\u0159\u00edjemce tak\u00e9 nemus\u00ed ud\u011blat v\u016fbec nic. P\u0159esn\u011b tohle se ned\u00e1vno stalo v p\u0159\u00edpad\u011b fale\u0161n\u00e9 zpr\u00e1vy s nab\u00eddkou orient\u00e1ln\u00edch produkt\u016f na V\u00e1noce, kter\u00e1 p\u0159i\u0161la do poslaneck\u00fdch e\u2011mail\u016f zd\u00e1nliv\u011b od Tomia Okamury. Dom\u00e9na psp.cz<\/a> m\u011bla sice nastaven\u00fd v SPF z\u00e1znamu softfail, nicm\u00e9n\u011b po\u0161tovn\u00ed server sn\u011bmovny zpr\u00e1vu odeslanou z jin\u00e9ho serveru v\u016fbec neozna\u010dil, a hodn\u011b poslanc\u016f se nachytalo. Jist\u011bj\u0161\u00ed je tedy nastavovat nejtvrd\u0161\u00ed politiku -all.<\/span><\/p>\n

    \n

    Ad Tomiovo sushi, je to hoax, za jeho\u017e \u0161\u00ed\u0159en\u00ed se omlouv\u00e1m. Smutn\u00e9 je, \u017ee mn\u011b nenapadlo kontrolovat hlavi\u010dku. V\u016fbec m\u011b to od Tomia nep\u0159ekvapovalo a nenapadlo m\u011b, \u017ee sn\u011bmovn\u00ed mail nezvl\u00e1dne odfiltrovat maily poslan\u00e9 z jin\u00e9 dom\u00e9ny, kter\u00fd se tv\u00e1\u0159\u00ed prav\u011b. \u010clov\u011bk se po\u0159\u00e1d u\u010d\u00ed, pardon.<\/p>\n

    \u2014 Mikulas Ferjencik (@Mikiferjencik) 20. listopadu 2018<\/a><\/p><\/blockquote>\n