Tagged Questions
4
votes
5answers
62 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
6
votes
3answers
133 views
Is there any sense in using two-step authentication for personal email address?
There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
1
vote
1answer
55 views
How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA
I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
5
votes
2answers
337 views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
4
votes
4answers
223 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
7
votes
3answers
259 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
2
votes
3answers
147 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
1
vote
2answers
307 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
0
votes
0answers
129 views
Roundcube login only looks at first 8 characters of password entered? [closed]
I have two hosting accounts with WebFaction, and I am using RoundCube webmail interface to access my mail that is associated with those accounts. I have multiple mailboxes on both accounts. It seems ...
6
votes
5answers
253 views
POP3/IMAP Stronger Authentication
We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access)
Most of the users who have ...
0
votes
1answer
306 views
What user was this spammer trying to authenticate as?
I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay.
Is it possible to determine what username they are trying to ...
3
votes
3answers
1k views
Delivery Failure Notification spam protection?
My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
10
votes
7answers
8k views
Can my email account be accessed without the password? How secure is it?
Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to ...
2
votes
1answer
335 views
Implementing 2-step verification via email for web apps?
I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
1answer
92 views
Should the email server/application be protected by 2 factor authentication? What applications should be protected?
When should email be protected by 2 factor authentication?
Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
10
votes
2answers
367 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
