Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

2
votes
4answers
77 views

How can I stop an IP from trying to use my mail server?

I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks ...
2
votes
1answer
113 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
6
votes
3answers
374 views

Is there any security reason that mail services like gmail or yahoomail limit the size of file attachment?

Despite the fact that Email standards such as MIME don't specify any file size limits, but in practice email users will find that they can't send very large files(more than 20 or 25 MB). Some experts ...
2
votes
1answer
78 views

What is the best setup to keep my email private from both attackers and government agencies?

I am attempting to setup a secure and private email account for my company. we currently use gmail which actually requests the emails from a hosting service provider that is configured with our ...
1
vote
0answers
23 views

Use DANE to authentify mail sender

Background: I have my own virtual DNS infrastructure, from the root to the mail server mail.example.com. Everything is signed using DNSSEC. client1@example.com can send email to client2@example.com, ...
0
votes
1answer
25 views

Is secure tokens send by email secure? [duplicate]

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its ...
0
votes
1answer
43 views

Opening mail without any risk [closed]

Before opening unknown email (not in spam folder) how we can identify no any danger inside the mail (with availability of active virus guard)
8
votes
3answers
535 views

Does OpenPGP encryption mean that not even I can see my data?

Say I have an email and I want to send it to someone else. I encrypt it with his public key. This ensures that only he can read my message. Does this also means that I won't be able to read it? If so, ...
1
vote
1answer
76 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
-1
votes
0answers
8 views

How do I Uninstall HubSpot [migrated]

How do I uninstall Hubspot on a Mac. I do not use it and everytime I open up email I am asked to sign in. I have no idea what your quality standards are - all I want to do is get rid of the program
1
vote
1answer
68 views

Android email encryption [closed]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
2answers
61 views

How can I stop an account I don't control from sending spam email in my name to my contacts?

Recently I received an email from a friend with "My" email to them attached. The email "I" sent them was obviously spam, one of those "You have to see this..." emails. The email had been sent to ...
2
votes
1answer
86 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...
-3
votes
2answers
82 views

Can free email provider's partners and affiliates read your emails? [closed]

I read that if you use free email, these entities have access to your very personal info!: "Your email provider company itself, like Google Their partners and affiliates Your ISP Various ...
1
vote
1answer
66 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
4
votes
2answers
123 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
1
vote
1answer
47 views

Short Lived Email account for VPN signup [closed]

I'm curious about how the process of signing up for a VPN service with a short lived 'disposable' email address would work. Firstly, what benefit (if any) is there to creating the account ...
2
votes
1answer
61 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
1
vote
2answers
49 views

Are there any anti-virus programs that have a bot that clicks email links? [closed]

Just started a new job, and it looks like we have some bots that are clicking every link in some % of e-mails. The problem is, I can verify that at least a few of these people are real. The only ...
7
votes
2answers
48 views

Does Outlook “trusted domain” actually do any sort of checking?

When you receive an email containing pictures from a new domain in Outlook you can right-click on the address and "Mark this domain as trusted" which will autoload all the photos on future emails. ...
5
votes
2answers
244 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
0
votes
1answer
95 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
0
votes
0answers
68 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
0
votes
1answer
57 views

What is the risk of using SHA1 in PGP email signatures?

SHA-1 is being phased out by a lot of major companies due to vulnerabilities. For example Chrome no longer considers it safe for public web PKI. Is it insecure to use SHA-1 for PGP email signatures?
2
votes
4answers
41 views

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
1
vote
2answers
39 views

Dealing with Spam with an unkown party harvesting the email address [closed]

I have a situation where I keep receiving spam from several IT companies (solicitations, marketing etc.). I think I gave away my email to a company in the last couple of years for reading a white ...
16
votes
9answers
3k views

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...
1
vote
1answer
38 views

How someone would routinely email out a Google Doc [closed]

I have seen an issue where an account has been compromised and someone is routinely emailing out the contents of a google doc to another gmail account. The account password has been changed and the ...
1
vote
0answers
25 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
0
votes
2answers
35 views

Does forwarding email result in an extra “persistence” of it's copy?

I understand that when an email is sent from point A to B, it can persist in other locations while in transit from A to B. When forwarding email, can this increase the extra locations where one's ...
0
votes
1answer
42 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
4
votes
3answers
168 views

How do I recover from an email breach?

I recently reported a religious figure who gave me extended harassment lasting a period of months. Details preferably withheld for now. A few days ago, I noticed something a little bit off from my ...
11
votes
3answers
307 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
0
votes
0answers
53 views

Webmail for both deepnet and clearnet [closed]

I am looking for a free anonymous encrypted webmail I can access from both tor and the clearnet (i.e., no .onion) that is not based in the U.S., Canada, or in any way connected to a U.S. company.(I ...
0
votes
1answer
38 views

How do apps tell if there is a problem with ssl?

Email clients and other software use ssl. But what if someone is doing a mitm with sslstrip? how can i tell?
5
votes
1answer
243 views

What are the security differences between SMIME email and PGP email? [closed]

Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP? Example comparisons Security ...
21
votes
2answers
1k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
0
votes
1answer
71 views

Outlook Client and DKIM [closed]

We have our domain email setup with SPF and DKIM - both which seem to be operating normally. When sending emails from webmail, DKIM (and SPF) are working correctly. We have some users using Outlook as ...
1
vote
0answers
40 views

what security features a good Email Service Provider (for marketing) should have?

To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors? In other ...
2
votes
2answers
287 views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
3
votes
1answer
66 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
2
votes
3answers
229 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
8
votes
2answers
491 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
3
votes
4answers
398 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
6
votes
2answers
172 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
1
vote
0answers
29 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
3
votes
1answer
77 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
1
vote
5answers
109 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
2
votes
2answers
85 views

Using anonymous email as official email

Assuming I have created an email in hushmail through of tor, and if I use it as my official email in a site such as Github. Will it throw my anonymity away as I use github from a regular browser?
22
votes
5answers
2k views

Are web scrapers fooled by obscured emails anymore? [duplicate]

It's a common practice online that instead of writing your email as someone@example.com people will instead write it as someone AT example.com in an attempt to make it harder for web scrapers to find ...