The idea of blocking FlowCrypt users from attaching potentially malicious files based on their file extension is the initial idea - but somehow, that isn't that great as other users can compose an encrypted message using other PGP-compatible client apps and bypass restrictions.
So we came up with the idea of blocking potentially malicious files based on their file extension at runtime when the attachment was about to render or the user interact with it thru the download button (or related actions).
We can refer to this link https://support.google.com/mail/answer/6590#zippy=%2Cmessages-that-have-attachments were a blacklisted file extension is collected. It's the same list used by Gmail when users try to block certain file types.
_Originally posted by @tomholub in https://github.com/FlowCrypt/flowcrypt-security/issues/224#issuecomment-1369867665
The idea of blocking FlowCrypt users from attaching potentially malicious files based on their file extension is the initial idea - but somehow, that isn't that great as other users can compose an encrypted message using other PGP-compatible client apps and bypass restrictions.
So we came up with the idea of blocking potentially malicious files based on their file extension at runtime when the attachment was about to render or the user interact with it thru the download button (or related actions).
We can refer to this link https://support.google.com/mail/answer/6590#zippy=%2Cmessages-that-have-attachments were a blacklisted file extension is collected. It's the same list used by Gmail when users try to block certain file types.
_Originally posted by @tomholub in https://github.com/FlowCrypt/flowcrypt-security/issues/224#issuecomment-1369867665