Dave Burke - Freelance .NET Developer specializing in Online Communities

A freelance .NET Developer

Safe sex = celibacy = Outlook Level 1 File Type Security

The original title of this post was going to be “Outlook Level 1 Security Blows” but I didn't want to come off as too righteous.  Besides, my encounter with this ingenious approach to enhanced security was yesterday and I'm better now.

I needed an .MDB from our church secretary.  “Oh just send it to me as an email attachment,” I told her.  Then I discovered Microsoft Outlook Level 1 File Type Security, where 52 file extensions are blocked, and though your message may possess a paperclip, the infobar in the message window only tells you what file you cannot today, tomorrow, or ever retrieve...unless you want to hack the registery or something.

How does this work?  Do a bunch of mid-managers get together in a Redmond second floor office somewhere around an oval table and someone poses the question, “How do we make Outlook more secure?“  Then someone says, “We can turn off the ability to receive attachments.“  And someone else who happens to be awake at the time says, “What?  Turn off file attachments!!“  And the originator of the thought says, “No, no, no.  Only 52 or so different file types.  We'll let .DOC and .XLS files pass.  I don't think they have any executable virus issues.“  And the questioner says, “Ohhh.  Okay.“  Heads nod. 

Isn't this like the ultra-conservative line, that if you want to practice safe sex, you keep your winky in your pants?  And if you want to keep your pc safe from viruses, you cut off its ability to exchange files?

For whoever thinks I'm being too tough here, I can give you the phone number of the church secretary and YOU can walk her through the process of renaming an .MDB file to a .TXT (“but gee, Dave, nothing I do works!  It still has that icon with the key on it!“), or walking her through FTPing to a secure file location on the internet (“no, that's F-T-P, as in 'Paul,' colon, forward-slash, forward-slash...no, the other one“, or Zipping up the file (“uh, what's winzip, again, Dave?“) 

If I'm looking at this issue incorrectly, or if there IS a quick solution that I didn't discover in the two hours I wasted on it, then I'll apologize and promise never to use the word “winky“ again in my blog. 

Outlook help on “About Unblocking Attachments“...

If you need to share files that have file types blocked by this feature, you have several options, including the following:

  • Rename the files to include a temporary file type that is not on the list of blocked file types. For example, you might rename MyFile.exe to MyFile.exe_EXTRA, and then attach the file to the e-mail message. You can include instructions in the message to save the file with the correct name, for example, MyFile.exe, when the recipients save the file to their computers.
  • Use a program, such as WinZip, to package files before you attach them to your e-mail message. In your message, you can include instructions explaining how to extract the files from the package to make it easy for recipients to access the files.
  • Post the files to a secure network share. In your message, you can include a link to the share that you have given the recipients access to.

If your organization uses Microsoft Exchange Server, your e-mail administrator can control which file types are blocked. For more information, contact your administrator. If you are the e-mail administrator, you can learn more about configuring blocked attachment behavior in Outlook by referencing the Microsoft Office 2003 Resource Kit.

 

Comments

David said:

Where I work, .zip files are no longer allowed.
# April 28, 2004 3:31 PM

Dave Burke said:

Hmmm. Thanks, David. I've been working out of my home office for the last 4 years and forget about corporate policies. I appreciate those considerations, but blocking ZIPs just doesn't seem to, um, enhance productivity...
# April 28, 2004 3:36 PM

Shannon J Hager said:

the newer "no .zip" policies are becoming more and more popular because most of the newer viruses arrive as zip files. That does put a serious damper on business email abilities, though.

Outlook Express has a very simple but strange work-around for the over-protective built-in attachment security: when you get an email with a blocked attachment, open the message, then click "forward". The attachment will still be attached but no longer blocked. Now you can double click it and save it to disk.

I don't understand how a bug like that slipped in, but it is a life-saver at times.
# April 28, 2004 4:34 PM

Dave Burke said:

Shannon. Thanks! Yeah, funny, I tried asking the user to send the attachment to my Outlook Express account, which I have POP'd to my company's Exchange server. I was going to try the forward trick (since it failed in Outlook 2003.) The funny thing was that the .MDB was flagged by McAfee GroupShield Exchange at HQ. (Its funny now. Wasn't funny yesterday. :-)
Thanks for confirming the "bug."
# April 28, 2004 4:43 PM

Roy Osherove said:

That "forward" bug also works with Outlook.
# April 29, 2004 5:28 PM

Ben Fried said:

Actually, as far as Outlook Express is concerned, if you go to TOOLS, OPTIONS, SECURITY, you can turn off the attachment blocking. No idea about Microsoft's Outlook 'condom'... What on Earth...?!
# June 27, 2004 12:48 AM

Dave Burke said:

Ben, Thanks for your comments! No, Outlook Express isn't my problem. (I mean, as part of IE it hasn't been updated in two years, has it?) It's that fancy-schancy, top-dollar Office Outlook that wants to help me by turning-off basic email attachment services.
Grrr...still.
# June 27, 2004 1:03 AM
Leave a Comment

(required) 

(required) 

(optional)

(required)