Hacker News Reader

Comment by iptel | Hacker News Reader

Fax is not more secure than email.

It is more secure in some senses. You can't get a PDF-borne virus from an old-school fax reception. My tax preparer only accepts mailed documents and faxed documents. It's sometimes a pain, but I have to admit that I'm a little bit happy that he's more paranoid than I am about my financial information.

> You can't get a PDF-borne virus from an old-school fax reception.

How about a JPEG-borne virus instead? https://research.checkpoint.com/sending-fax-back-to-the-dark...

"not fax" doesn't have to mean "use one of the least secure digital formats in existence". If you're goal is to replicate a fax you should probably limit yourself to a basic bitmap encoding similar to group 3/4 encoded faxes and create a validated decoder (something many fax machines lack).

Actually, you can! There was a presentation at DEFCON this year (DEFCON 26) showing exactly this:

https://www.youtube.com/watch?v=qLCE8spVX9Q

> "See for yourself first-hand as we give a live demonstration of the first ever full fax exploitation, leading to complete control over the entire device as well as the network, using nothing but a standard telephone line. "

Maybe it's time for you to find another tax preparer. Mine accepts encrypted documents with her public key.

I need my tax guy to be an expert on tax law way more than I need them to be on the cutting edge of computer communications and security.

If he wants to stick to his old-school fax machine and keeps me on the right side of the tax agencies, I can accommodate his preferences on tech.

Funny, if somebody had told me they only accepted mail documents I would ask for their email. Not to be annoying or whatever, but because today I assume mail means e-mail, not snail or physical mail.

It is more secure as long as you regard PSTN as more secure than internet. Which is a view that has some merit.

> It is more secure as long as you regard PSTN as more secure than internet. Which is a view that has some merit.

Not as long as you can send faxes from the Internet.

https://faxzero.com/

FaxZero even allows you to put in the phone number the fax comes from. It's $1.99/fax to remove the FaxZero cover letter, and they accept PayPal.

(Also, someone with the username iptel might know a bit about this.)

I meant it in the confidentiality sense. The fact that you can put anything on the cover sheet and header line as sender number and that it has exactly zero relevance as authenticator should be obvious to anyone who actually ever set up a fax machine.

Edit: and exactly how that differs from SMTP?

An office fax machine sitting out in the open is going to be less confidential than email on an SMTP server where only a sysadmin or the recipient can see it, yes.

Reply on news.ycombinator.com