Never seen it before, isn’t clickable, is only on one post which doesn’t seem to have anything else special about it.
What is that?
4 Likes
someone replied by email.
It’s a badge, I don’t have it.
5 Likes
Someone replied to THAT post by sending the poster a PM?
That makes a lot of sense…thanks!
3 Likes
Not a PM, an email reply to BB.
4 Likes
How does one do an email reply to BB?
Does that mean the person sent or received an email, thanks to the receiver’s address being on the profile page? But how would the website know that?
Apparently I am now more confused!
1 Like
You can reply by email to the “you got this comment” email the site will send to you.
7 Likes
And so then there’s a marker on this site that you did that off-site?
The more you know…thanks!
9 Likes
I don’t know about the mark but I replied at least once before from my mail client. I actually wouldn’t want the marker. Poor opsec!
Update for Autocorrect madness.
It’s not so much a security issue as a notification that because the reply was sent via email, it may have been delayed from the time the commenter actually replied (as emails sometimes are).
3 Likes
I replied to this via email!!!
8 Likes
Using it without knowing what it did would be poor opsec, maybe. It does serve a function though, on BBS.
What is your threat model in which knowing whether you replied via web or email blows your opsec?
1 Like
This site is served over SSL. Theoretically, I can type a reponse here or send a private message without it being man-in-the-middled because of it. Email responses have no such protections.
So “knowing,” probably not so much but the act itself…
Right. I thought you were referring to the marker showing up. Sending an email response very well could be bad opsec, but that’s on you, not the site. (Which I’m pretty sure we are both in agreement on.)
Seeing that posts are public anyway, aside from possibly altering a post, I can’t see much detriment. Maybe in the case of a lounge post, but still…
Well, it gives insight into workflow, which is data exposure. 
1 Like
Not just that but email formatting is often… messed up. Because email. So putting the icon on the message tells you
Please forgive any formatting or typo weirdness, this was sent via email, probably by someone on a hurry on a mobile device.
See above @enso ↑
2 Likes
Dude, any time I type anything here on my phone, directly on the site, my error rate goes up 1000% because I have 45 year old eyes, big thumbs, and I’m usually walking at the same time. 
I’m not complaining. I didn’t even know the badge existed as it didn’t used to (I’ve replied by email in years past but only got the badge today).
Right. Because Security hasn’t been my job for literally decades 
I get what you are saying though, security from the perspective of BBS vs personal security are different. Easy fix though, just don’t use the feature.
4 Likes
The real question is can I SMTP relay spam another user’s reply to a message by pretending to be whatever email address they’ve registered under if I figure it out? Is there a code in each message sent to a user that has to match (I haven’t looked at the headers or the reply to address to check).
If so, I could probably get a problematic user thrown off by pushing their envelope a little bit when impersonating a reply…
