Foiling Phishing

TaosNet will NEVER email you requiring you to confirm your email password or any personal information (username, etc).

We will email your invoice each month. If your invoice is not paid by the due date, we will followup with an automated late notice/past due email. For our internet service customers, that’s really it, aside from responding to your requests for service or support and letting you know when an upgrade/maintainance will interrupt service. Our email-hosting and/or web-hosting customers may also get emails about domain registration expiration/renewal and SmartVPS alerts. We also do email receipts for credit-card payments, occassionally for other payment methods.

It bears repeating however, that TaosNet will not email you asking you to verify/enter any personal information, usernames, passwords, etc.

Anything else that says it’s from us should be considered very warily. The more urgency the email states, the more wary you should be. The more dramatic the stated consequences, the more wary you should be. The more perfect the email appears, the more wary you should be. The more typos an email contains, the more wary you should be. The fewer typos an email contains, the more wary you should be (thank AI and LLMs). If the sun is up, the more wary you should be. If the sun is down, the more wary you should be. If there’s a solar eclipse, the more wary should be. If the sun has exploded, stop reading your email.

Being wary means:

  • Slowing down to critically inspect the message (haste makes waste)
  • Rather than looking for details to trust, look for details to distrust (scammers can copy legit details into their ploys)
  • Not trusting the context of the message (scammers are not above lying)
  • Email addresses are often hidden behind display names, display names are no more trustworthy than nametags in a hotel bar
  • Not clicking any links in the email (links can be malicious, so merely clicking one could lead to malware getting onto your device)
  • Weblinks, aka URLs, can be hidden behind what looks like other weblinks (wolf in sheep’s clothing)
  • Websites, especially login pages, can be copied (so even if it LOOKS like the site you expect, it could be part of a scam). Do not test the legitimacy with your password!
No Nigerian princes were harmed or even consulted during the creation of this document.  Still hungry for more info on phishing, try Phishing Biology.

Phishing Biology

What they don’t want you to know…

As we learned in Thank You for Smoking (2005), humans share many everyday concerns like food and shelter. Aside from the 1%ers, most of us undertake some activity to help finance our daily concerns. Some fraction of us make use of the internet for those undertaken activities. And since time immemorial, some of those undertaken activities involve barter/trade/commerce. While some of those dealings are equitable, others are more-accurately labelled schemes. So it should be no surprise that the internet has dark alleys and red light districts. And as a core communication means on the internet, email is not isolated from the schemes carried out in those dark alleys. Thus, it is incumbent on all us to recognize these schemes that seek to prey upon us.

Within the vastness of online schemes, phishing attacks specifically try to trick people to divulge details that have value to the schemer. Those details can be email credentials, which can then be leveraged to carry out more schemes. The details may be sensitive data from a business, that might be valuable to their competitors or financial markets. The details can be bank or credit card info that’s more directly adding to a schemer’s bottom-line. Or the details might simply provide a toehold for future schemes.

Asked how to identify phishing, many answer “they’ll know it when they see it”. Unfortunately, that criteria is not helpful to anyone else. Thus listing some common traits is helpful. Firstly, remember that the goal of the scheme is to trick you by any means necessary. Concealing their true identity is almost a given. So a phishing email will never be sent from the actual schemer’s email address. The actual source of the email is most often some prior victim, at least until that user’s email provider detects the abuse and suspends the compromised account. But the schemer often tries to conceal the first victim’s email address, to make the phishing email appear more legitimate. Thus hovering your mouse/cursor over the sender may reveal that “WHITEHOUSE ADMIN” was sent by “sales@mydomain.com”. Microsoft does not send unsolicited tech support notices to users. A second common trait is creating an appearance of need. Few recipients would open an email with a subject “Sky is blue” as opposed to “URGENT-Action Required”. A third common trait is creating a sense of trust. By using a friend’s name or “IRS Agent” to hide an email’s actual source, the schemer tries to trick you into taking their bait. Copying boilerplate from legitimate messages is another way they try to feed that sense of trust. A fourth common trait is spurring you to act hastily. This Picaso may be priced to sell, but why is the paint dripping on the floor? Bold actions sometimes save the day IRL, but in cyberspace it’s the fasttrack to extinction. Pause, breathe, contemplate, and then act. It’s the only way to be sure.

Sometimes, despite our best intentions, a hyper-caffeinated finger and overly-sensitive trackpad conspire to betray our best interests. Before our left hemisphere can form an “oh, sh-“, we’ve fallen for the scheme and given our vital fluids to the void. What then? To start, note (ideally on paper) details about the scheme to include what details you divulged. Next, reset any passwords that you shared on the targetted (legitimate) site and anywhere else that you used the same password. When available, enable MFA (multi-factor authentication) since it can help limit abuse when an attacker knows your password. Inform the organization (legitimate website) of the compromise. When identity theft happens or money is lost, contact local law enforcement and the Federal Trade Commision (https://ftc.gov). Also realize that the info you divulged to the schemer is frequently shared with other schemers. So prepare yourself for things to get worse before they get better.

In the end, we’re all human. Fallible, loving, caring, sharing beings. Striving to meet our everyday concerns. Trying to make it thru the day as best we can. We will make mistakes. Let’s learn from them.

How do I send mail from Gmail using my Taosnet email address?

It is possible to send mail from a Taosnet hosted email using Gmail’s online interface.

  1. In your browser, sign it to the Gmail account you want to import to.
  2. In the top right, click the gear shaped icon and pick”See all settings”.
  3. Click the “Accounts and Import” tab.
  4. In the Send Mail As section, click on “Add another email address”
  5. Add another email address
  6. Follow the prompts.
  7. When asked about SMTP server, enter mail.newmex.com (if not already pre-filled).
  8. Send mail through your SMTP server
  9. Enter your full email address as Username.
  10. Enter your Taosnet email password, then click Add Account.
  11. Check your Taosnet email for a code/link from Google.
  12. Click on Verify.

Done.

How do I forward my emails to Gmail?

We do NOT allow forwarding emails to Gmail accounts.  The preferred method is for you to have Gmail check your account on the TaosNet servers directly, which will ensure that you receive all of your email.

To configure your Gmail as a POP client and import your emails from TaosNet’s servers, follow these steps:

  1. In your browser, sign in to the Gmail account you want to retrieve your TaosNet mail.
  2. In the top right, click the gear shaped icon, and pick “See all settings”.
  3. Click the “Accounts and Import” tab.
  4. In the “Check mail from other accounts” section, click “Add a mail account”.
  5. Type the full email address of your TaosNet email account, then click Next.
  6. Select “Import emails from my other account (POP3)”, then click Next.
  7. Make sure the Username is your full email address.
  8. Type your TaosNet email password (not your Gmail password).
  9. Make sure the POP server says “mail.newmex.com” (without the quotes).
  10. Change the Port to 995.
  11. Check the box “Always use a secure connection (SSL) when retrieving mail”.
    Select port 995 and check the box to use SSL.
  12. Click “Add Account”.
  13. Select “No” on the Your mail account has been added page, then click “Finish”.

    To send mail from within Gmail as a TaosNet account, see these instructions.

    How to Setup Email on iPhone or iPad

    STEP 1 – Click on Settings on your iPhone or iPad

    STEP 2 – On left-side panel, scroll down to select “Mail”, and then on right-side, select “Accounts” and then “Add Account”.

    STEP 3 – Select “Other”

    STEP 4 – Click on “Add Mail Account”

    STEP 5 – Enter name that you want on the account. For Email, enter your FULL EMAIL ADDRESS. Enter your password. Enter a description that you want to identify the account. Click Next.

    STEP 6 – In the Incoming Mail Server section, enter mail.newmex.com as the Host Name. Enter your FULL EMAIL ADDRESS for User Name. Enter your email password again. Repeat with the same information for the Outgoing Mail Server. Click Next.

    STEP 7 – Click Save and Voila! You are now ready to send and receive mail on your iPhone/iPad.

    How to Setup Email in Mac Mail

    STEP 1 – Click on the Mac Mail icon in your toolbar and then click on Mail > Preferences

    STEP 2 – In Accounts click on the “+” sign at the bottom of the left-side pane

    STEP 3 – Select “Other Mail Account…” and click Continue.

    STEP 4 – Enter the Name you want to appear on the account. Enter Email Address and Password. Disregard the “Unable to verify account…”, and click “Sign In”.

    STEP 5 – Enter your Full Email Address in the Username. Enter mail.newmex.com in both the Income and Outgoing Servers. Click Sign In.

    STEP 6 – Voila! Email should now be set up and you can start sending and receiving email in Mac Mail.

    How to Setup Email in Thunderbird

    STEP 1 Download and install Thunderbird, if you haven’t already.

    STEP 2 – Open Thunderbird and then click on “Local Folders” and then “Email”

    STEP 3 – Enter Your name; Full email address; and your password. The Remember password is checked by default. Click Continue.

    STEP 4 – By default the server name will default to the extension of your email address (in this case mail.taosnet.com). Click on Advanced config.

    STEP 5 – Edit the Server for both Incoming and Outgoing servers to be mail.newmex.com (if you are setting up email with newmex.com extension, you won’t need to edit the server). Edit your Username to be the FULL EMAIL ADDRESS. Click done.

    STEP 6 – Voila! Your email account has been successfully been set up!

    STEP 7 – In order for the server sub-folders to be synced to your Thunderbird, you’ll need to quit Thunderbird and then restart it. Once you do that you should have the sub-folders (Drafts; Sent; Spam; Trash)

    My Apple mobile device cannot send mail

    Before leveraging the vast resources available from Apple to it’s minions (https://support.apple.com/en-al/HT201320), make note of one helpful hint from TaosNet…

    Although iOS displays the Outgoing Mail Server’s fields of Username and Password as Optional, in grey text, nearly every server worldwide requires those to be filled in. So, hunt and peck your complete email address for Username and your email password for Password.

    Should I setup my email as IMAP or POP?

    Yes, everyone using a TaosNet email should use either IMAP or POP. People using multiple devices to access the same email should generally use IMAP. People concerned about maintaining a copy of their email, for legal/etc requirements, should learn more specifics to ensure they meet those needs, but might prefer POP.

    © 2019 TAOSNET. ALL RIGHTS RESERVED © 2019 TAOSNET