Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
2answers
96 views

Emailing debit card details to a guesthouse

I'm trying to arrange a holiday out to the Aran Islands, and the guesthouse emailed me back confirming that they do have a room available. But here is the catch: they want me to email my credit card ...
0
votes
1answer
54 views

Why does Sidekick say that my boyfriend who emails me from Malaysia is in the US? [on hold]

I am emailing my boyfriend. He is working in Malaysia right now. I use Sidekick for all my emails. He always opens them by his computer and that does not tell me his location. One time he opened ...
3
votes
1answer
161 views

Why does my SHA256 certificate get encrypted with 168 bit 3DES?

We use S/Mime certificates for internal emails within our company. The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits). ...
0
votes
1answer
60 views

Avast attempts to connect to the Internet when I try to download email [on hold]

The file AVAST (Software\Avast\AvastSvc.exe) tries to connect when I check my email. When I forbid access to the internet for AvastSvc.exe, I can't connect to POP3 & SMTP. I'm not sure where all ...
1
vote
0answers
33 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
1
vote
1answer
46 views

How can I contract an email tracking service and be silent about it?

I use a customized e-mail and my web-master, who is also the domain owner, doesn't allow me to see DNS settings. I'm suspicious that he's forwarding the messages addressed to myname@company.com to ...
2
votes
0answers
50 views

Looking for a “spam feed”

I am looking for a feed of e-mail spam messages. I searched for a feed but found nothing that I can use. Does anyone know a site or service that offers a feed of actual spam messgaes that are ...
4
votes
1answer
80 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
-3
votes
0answers
34 views

How many email accounts should one have? [closed]

How many different email accounts should a person have, and how should they be distributed? Should there be a separate personal email, an email for online accounts and newsletters, a professional, ...
4
votes
0answers
120 views

Using your full name as your work email address? [on hold]

Standard practice in the workplace appears to be using your full name as your email address. This presents some privacy concerns to me. Even though we all grew up being told it's advisable to use a ...
1
vote
0answers
36 views

How does avast! add a signature into my webmail? [migrated]

I have the free version of avast! installed on my computer. When I just sent an email on https://mail.google.com with Firefox a signature was added, saying that the sent mail is Virus-free. ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
0
votes
2answers
51 views

Reducing the success ratio of email harvesting

Would / does the following work to hamper email harvesting by spammers ? Since spammers - among other things - do automated email harvesting by looking for email addresses in web pages, it follows ...
-3
votes
2answers
110 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
3
votes
1answer
62 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
1
vote
1answer
20 views

How does Mail.app handle account credentials?

I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
1
vote
0answers
15 views

relationship between anti-spam solutions and whois databases

Are there anti-spam SMTP proxies(like ASSP, qpsmtpd) or e-mail spam filtering solutions in general(like SpamAssassin) out there which create for example block filters based on objects in RIR ...
1
vote
2answers
81 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
1
vote
1answer
26 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
1
vote
1answer
43 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
3
votes
3answers
174 views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
-1
votes
0answers
67 views

Gmail never actually deletes emails? [migrated]

I'm getting a bad feeling about gmail. I've had used it for years and lately I deleted all of my private conversations from all possible devices and folders. When I go to the search box of gmail ...
11
votes
2answers
639 views

Replay attacks and PGP email encryption

From my understanding of PGP email, the following is possible: Alice sends a message to Bob. Then Bob can take that exact same message and send to Carol while making it seem to Carol like it is from ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
4
votes
1answer
102 views

“Hacking” account when someone uses your email?

I have, on multiple occasions, received this email from Twitter: Since I have received it multiple times either this person clearly thinks the email is theirs or it's spelled similarly, something to ...
1
vote
1answer
57 views

How does my unused e-mail address get spoofed? [closed]

I have 2 e-mail accounts - one on GMail and other one on a popular mail provider in my country (O2). GMail has a secondary e-mail set for security - that is the O2. I started getting e-mails from ...
1
vote
1answer
29 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
1
vote
1answer
70 views

How to deal with spam that contains my personal details?

I just noticed some spam in my inbox in GMail that is from a very suspicious e-mail address (partially redacted anonymous@webXXXXXXX.ad.aruba.it) containing a link to a similarly suspect URL ...
1
vote
5answers
77 views

Using an e-mail service anonymously [closed]

What are the options, to use an e-mail service anonymously without exposing yourself (your private info, name etc.) ?
3
votes
1answer
97 views

What happens when encrypted email is in-transit?

If you're using a service that offers end-to-end encryption, what happens when you send an email to another non-encrypted email address? Let's say I write my email in ProtonMail and then send it to a ...
3
votes
1answer
163 views

Has my server been compromised? (Ransomware related)

I just received an email that corresponds to the description here, which was posted just a couple of hours ago: ...
3
votes
1answer
81 views

How does ProtonMail manage search?

There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and sends it encrypted in some fashion (depending on what email service the recipient ...
3
votes
2answers
90 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
3
votes
1answer
41 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
7
votes
3answers
78 views

Best practices for sending tax data to and from a tax professional

I started doing business with my tax preparers when we all lived in the same city. Recently I moved to a different state. I requested that they send my "Tax Organizer" which contains some personal ...
4
votes
2answers
93 views

Notifying users of a possible security breach

Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open. I undertook the usual steps to prevent the malware from spreading to ...
2
votes
4answers
117 views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
1
vote
1answer
76 views

How does MailChimp authenticate emails?

Keeping it short, MailChimp states that: Authentication Should Be Simple Email authentication is useless if it's too hard to implement. Many email service providers require server setup in ...
2
votes
1answer
71 views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
2
votes
1answer
183 views

How Risky is Paribus?

Paribus (https://paribus.co/) is a service that automatically gets money back for you if there's a price drop on a product you purchased. It seems to work by monitoring your email, to which you must ...
0
votes
1answer
66 views

Where email orginates [duplicate]

I keep getting emails from an unknown person. In the header file, I see this: authentication-results: spf=softfail (sender IP is 25.152.82.59) smtp.mailfrom=outlook.com; gmail.com; dkim=none (message ...
20
votes
3answers
3k views

How does a company like CloudFlare block bot crawling and email harvesters?

I saw this on CloudFlares homepage: CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more. How ...
3
votes
1answer
190 views

Is this encrypted information? Why is it in a URL?

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this: ...
29
votes
5answers
3k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: ...
1
vote
2answers
113 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
9
votes
3answers
487 views

Email unsubscribe handling security

There is another question with similar title: Unsubscribe safely however my question addresses completely another issue. I am trying to set up a notification system in the website, that will send ...
1
vote
0answers
144 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
3
votes
4answers
143 views

TLS and e-mail security

Our client has asked us to send sensitive data via TLS and to install a certificate on our mail servers so that they can verify the authenticity of our e-mails. If I understand correctly, TLS ...
1
vote
1answer
64 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...