You can be perfectly spearphished by a plaintext email, sent by your “colleague”, mentioning some current issue at work, and asking to verify some ticket
or by your “friend” mentioning a highly personal issue that only you two were supposed to know, asking you to phone someone on their behalf
Security is eliminating attack vectors one at a time. HTML in email is a gigantic hole. We don’t throw up our hands and say “whelp this only solves 90% of issues. Guess we don’t bother.”
Comments
You can be perfectly spearphished by a plaintext email, sent by your “colleague”, mentioning some current issue at work, and asking to verify some ticket
or by your “friend” mentioning a highly personal issue that only you two were supposed to know, asking you to phone someone on their behalf
or by your “relative”, etc.
Security is eliminating attack vectors one at a time. HTML in email is a gigantic hole. We don’t throw up our hands and say “whelp this only solves 90% of issues. Guess we don’t bother.”