Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
2answers
47 views

Does having a seperate e-mail account only for security, increase security?

In this article about increasing the security of lastpass the author suggests For additional security, you can have LastPass send security-related emails to a special security email address ...
1
vote
2answers
139 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
2
votes
1answer
49 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
12
votes
3answers
1k views

Is this “Domain Registration Service” email a scam?

I received an email to the email address listed on our website (it's a generic info@ourcompany.com to help "weed out" spam, whereas each employee has something like andreas@ourcompany.com to which I ...
1
vote
2answers
28 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
18
votes
6answers
993 views

What needs to happen for email encryption to go mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
1
vote
3answers
25 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
1answer
24 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
1answer
44 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
3answers
66 views

How can get email about latest vulnerabilities [closed]

Today my friend got email for the latest vulnerablility heartbleed. But i could not find where i can subscribe so that i can also get emails about latest vulnerabilities Can anyone please help me ...
3
votes
0answers
83 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
0
votes
1answer
36 views

Email hacking/masking prevention

Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it. When I look at the ...
3
votes
1answer
186 views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
0
votes
2answers
299 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
1
vote
0answers
123 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
-1
votes
0answers
12 views

Remove specific header information sent from Thunderbird to Google servers [migrated]

If I'm using the web interface of Gmail, it doesn't add my ip address to the email headers (only adds the Google ip addresses) but if I use Thunderbird, it add my ip address to it and Google mail ...
62
votes
12answers
20k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
3
votes
1answer
60 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
3
votes
2answers
80 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
0
votes
2answers
110 views

Best practice for sending IP Addresses

IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a ...
0
votes
1answer
60 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
0
votes
2answers
32 views

How likely would /var/mail be encrypted in a paid host? [closed]

I pay for a very basic web hosting plan, which includes a personal email address. Would the sysadmin of said host be able to read the content of my messages? How likely would my personal mail folder ...
1
vote
3answers
151 views

Email activation string with MD5'd random number and email secure?

For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address. $key = ...
4
votes
5answers
168 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
1
vote
1answer
88 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
2
votes
3answers
65 views

Is it a good practice to include a download URL of my GPG public key in my email signature?

I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature. Is this a good practice? If not, what's a good alternative?
1
vote
1answer
76 views

How could a third-party know the contents of an email I sent to someone?

Apparently, a third party knew the contents of an email I sent to someone within an hour after I sent it. The following possibilities come into mind: The recipient forwarded the email to the third ...
6
votes
5answers
708 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
0
votes
1answer
392 views

Yahoo Account hacked, changed pw, spam still going out elsewhere?

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts. I changed the password, then saw (via rejected emails sent to my Yahoo ...
0
votes
3answers
79 views

Is it insecure to send an email from a PHP script to an email address on the same domain?

I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.
2
votes
2answers
72 views

How to find out the email host of a vanity email address?

Assuming a person gets his own domain address, say, theperson.com. He then goes on to create a vanity email address with that domain. e.g. me@theperson.com. me@theperson.com may be hosted by the ...
6
votes
1answer
85 views

Reading older mails signed with a certificate that has meanwhile expired

A few years ago I have used S/MIME certs to sign (and encrypt) my mails. The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It ...
142
votes
2answers
13k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
2
votes
1answer
95 views

How can I prove to a third party that I'm sending the emails I'm supposed to?

Suppose one of my duties for a small organization is to send out statements to clients by email. Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
3
votes
1answer
101 views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
3
votes
1answer
108 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
0
votes
2answers
91 views

Is sending authorizing links through e-mail a vulnerability?

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability? Password-reset partly ...
2
votes
2answers
183 views

E-mail already in use exploit

I have a registration portal where user inputs his details and then a valid email account. Currently I check the email is not used already and if it is I reply with the classic: "email already in ...
0
votes
1answer
67 views

Emails are forwarded to wrong addresses and possible hacking?

Multiple email addresses for my domain have been compromised. My client forwarded me an old email which he sent me few days ago but I haven't received that email. That email was sent to an email ...
7
votes
3answers
488 views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
2
votes
1answer
81 views

Why would an attacker try to guess random email usernames on a small domain?

My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, ...
2
votes
1answer
44 views

What Information is Exposed When I Send A Message From My Mobile Device

When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
1
vote
0answers
61 views

Is winmail.dat a malware propagation vector?

Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
2
votes
1answer
227 views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
1
vote
3answers
186 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
4
votes
2answers
79 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
0
votes
1answer
104 views

Hack profile identification

What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my ...
-1
votes
2answers
104 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
5
votes
3answers
401 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
1
vote
0answers
30 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...