Related to email protocols, clients, servers, content, and message format.
5
votes
5answers
108 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
5
votes
4answers
180 views
Technical security issues with proactively executing a phishing campaign targeting your own users
We've had some issues with compromised accounts due to users falling victim to phishing campaigns.
The possibility of us doing a phishing campaign against our own users to proactively shame them has ...
4
votes
2answers
95 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
2
votes
1answer
62 views
If a hacker gets into my PC can he get to my saved windows live mail passwords?
If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
-1
votes
0answers
54 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
4
votes
3answers
120 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
-6
votes
2answers
57 views
Why my Email are received in the spam folder? [closed]
I am using Mass email marketing or shoot out email campaign but my subscriber received my mail in spam folder what are the reason of this and how can I prevent them.
Question reference: Email ...
3
votes
4answers
140 views
Safe to reply to a suspicious email?
Can something happen to me (or my computer) if I respond to a suspicious plain text email?
I received an email from an unknown address, and I am not sure if this is a "real" person.
I would have ...
0
votes
2answers
126 views
“You have new mail” message
I received a message from Google saying someone entered my email account.
I confirmed that there were an access from an IP in another country.
I have noticed "You have new mail" message when I open ...
2
votes
1answer
90 views
Securely notify users about account changes
I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes:
...
6
votes
3answers
134 views
Is there any sense in using two-step authentication for personal email address?
There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
0
votes
2answers
261 views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
-3
votes
1answer
75 views
Automated scanning of personal email [closed]
I am a current user of gmail, and have recently become interested in the privacy policies of the large webmail providers like gmail, yahoo, hotmail etc. I understand that it is commonplace for them to ...
1
vote
1answer
60 views
How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA
I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
2
votes
1answer
80 views
The security of sending emails with SPF/DKIM, but not signed
We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM.
A few days ago we noticed that they allow any ...
2
votes
0answers
38 views
Is it the default in billing systems to send out the users password by email? [duplicate]
I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk.
One of their employees responded with ...
-1
votes
2answers
85 views
Keyloggers and Email Accounts [duplicate]
This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker.
How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
88 views
Ports used by Online Email Accounts such as Yahoo Mail, Gmail etc
Let us say that I send an email using Yahoo Mail or Gmail. Can this email be intercepted using a packet sniffer?
On which port does the email travel? HTTP, SMTP, POP3?
Thank you.
5
votes
2answers
340 views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
242 views
Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?
Our company policy is requires the local encryption of data for all email (in case the device is stolen)
Does the Windows Surface (either version) support local encryption?
Is the local device ...
0
votes
2answers
111 views
Keyloggers - Ports used by keyloggers
According to this article, keyloggers usually make use of the FTP ports and email ports:
http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html
My question is, can a ...
2
votes
1answer
85 views
How to determine source of e-mail and verify if the source is/could be legitimate?
I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
6
votes
5answers
317 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
4
votes
1answer
164 views
Is it safe to abandon a free webmail account that has been in use for a significant amount of time?
I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address.
I have concerns around accounts that I may have ...
-1
votes
2answers
146 views
Hiding emails from Google [closed]
From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons.
If a have a group of people who want to hide their emails from Google, how ...
2
votes
0answers
109 views
User friendly PGP email [closed]
Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience?
Generate new key at first startup, rather than asking the user if they have an ...
15
votes
6answers
791 views
When secure email, is not really secure
We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
0
votes
1answer
121 views
Using a separate email address for each contact
A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me ...
0
votes
5answers
2k views
Is update@em.facebookmail.com legitimate?
I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
2
votes
4answers
145 views
Open an e-mail account from only one particular system?
Is there a way to configure e-mail so that it can only be opened from one particular system? Or from multiple systems having some sort of unique key or particular static IP?
4
votes
4answers
229 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
2
votes
3answers
115 views
Is it possible to block emails (to all email accounts) that contain certain word/phrase patterns?
I'm not sure if this is the most appropriate SE group to ask this question but I'm hopeful that it will get some interesting and helpful input from the folks here before it is possibly moved.
A ...
8
votes
3answers
263 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
1
vote
3answers
127 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
2
votes
4answers
267 views
Yahoo Email Keeps Getting Phished
I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
0
votes
1answer
167 views
How do I know if my email account has been hijacked?
A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and ...
1
vote
1answer
74 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
4
votes
1answer
175 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
2
votes
4answers
237 views
How can an internet contest verify unique votes with only an email as an input parameter?
For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
15
votes
3answers
717 views
How can I protect against email tracking services?
Recently a free service came out for email tracking, bananatag.
It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
1
vote
1answer
367 views
is it possible to use smime in the webclient of gmail?
I could not find any options in the webinterface of Gmail.
all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
6
votes
4answers
430 views
Why is it even possible to forge sender header in e-mail? [duplicate]
With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the ...
0
votes
3answers
657 views
Email hacking myth
I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
4
votes
2answers
102 views
Security implications of storing email attachments on Centos Server
There is an application I am working on which requires processing the incoming mails to cs@company.com.
The company.com mail accounts are being run via Google Apps for Business.
So I fetch the ...
0
votes
3answers
126 views
Secure design for handling mail attachments
I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific ...
2
votes
1answer
86 views
Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?
From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
-1
votes
4answers
107 views
Is there any way to know the contact email on a contact form? [closed]
When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
2
votes
2answers
368 views
How does the Yahoo webmail exploit work?
I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
3
votes
4answers
261 views
Good, simple list of reasons that email is inherently insecure
I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
1
vote
3answers
275 views
Emails wrongly flagged as spam by filter, claiming suspicious URLs
My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the ...
