On Sat, 11 Apr 2020 11:46:04 -0600 Grant Taylor wrote: > On 4/11/20 9:49 AM, RW wrote: > > I see that the plugin rules don't distinguish between the > > irresponsible format of: > > > > From: "Mr Bill (mb...@legitemail.com)" > > <sys...@sent-via.netsuite.com> > > > > and more seriously deceptive formats like: > > > > From: "mb...@legitemail.com" <f...@example.com> > > From: "Mr Bill <mb...@legitemail.com>" <f...@example.com> > > I feel like all three examples that you have provided include an > actual usable email address in the human friendly name of the From: > header. In my opinion, anything else in the double quotes is largely > window dressing. As such, I think that it doesn't matter if the > email address is in (...) or <...> or bare. The Mr Bill prefix also > doesn't matter. > > Given the above opinion, I would consider all three of these human > friendly names to be effectively identical.
The first one was cited as a format used in forwarded ham. The other two are common in spam. The point of this spamming technique is that many clients show only the display name in the message list. Consequently the three headers will display like this: Mr Bill (mb...@legitemail.com) mb...@legitemail.com Mr Bill <mb...@legitemail.com> IMO the middle one is the most convincing as it's exactly what would have been displayed if that address had been used without a display name. The last one at least looks like a from header. The first looks the > So, what would you like the plugin to do differently? How do you > think the three examples should be handled?
