Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

0
votes
3answers
25 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
8
votes
1answer
364 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
-2
votes
0answers
14 views

How to host email server From Windows server 2012 [on hold]

Hello I want to add unlimited email id with my domain.com and This to be done from my home server which is running on windows server 2012 Is it Possible to run email server from home or give some ...
3
votes
4answers
369 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
5
votes
2answers
83 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
-2
votes
0answers
33 views

are there commonly known risks of PHP generated email? [migrated]

In the following code, an email is sent via PHP, Apache, and Linux. A comment from a website user, $comment, and her $emailFrom address, are obviously potentially of an unknown nature. Do these fields ...
0
votes
0answers
12 views

generating public/private credentials for MS Outlook email encryption [migrated]

An app running on a CentOS 7 web server needs to receive encrypted emails sent from users of MS Outlook. Can someone please provide explicit instructions as to how I can generate or procure all of ...
0
votes
0answers
6 views

What Exchange permissions are given to each receive connector? (Bypass SPAM, etc) [migrated]

Exchange has a list of permissions that are assigned to each connector based on the checkbox selection below. Here are an example of some SMTP headers that are used internally (in routing) to ...
1
vote
0answers
15 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
2
votes
1answer
38 views
+100

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
-1
votes
0answers
45 views

most widely applicable email encryption technology [on hold]

A private web application needs to send and receive encrypted emails with perhaps a few dozen known users. This is a Java / Spring MVC app running on a CentOS 7 server, and using JavaMail to connect ...
-3
votes
0answers
58 views

Sent anonymous emails, might get in trouble [duplicate]

Let us say that someone createda a fake gmail account. They then proceeded to send some emails to a school. (The school uses gmail for education). They want to track down the person who sent it ...
1
vote
0answers
32 views

Using OpenSSL to generate encryption key for Outlook users [migrated]

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
1
vote
2answers
74 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
2
votes
2answers
58 views

Using anonymous email as official email

Assuming I have created an email in hushmail through of tor, and if I use it as my official email in a site such as Github. Will it throw my anonymity away as I use github from a regular browser?
22
votes
5answers
2k views

Are web scrapers fooled by obscured emails anymore? [duplicate]

It's a common practice online that instead of writing your email as someone@example.com people will instead write it as someone AT example.com in an attempt to make it harder for web scrapers to find ...
3
votes
1answer
121 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
2
votes
3answers
66 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
2
votes
1answer
27 views

Is a ptr mechanism in an SPF record secure?

If I understand http://www.openspf.org/SPF_Record_Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using ptr in my SPF record. ...
0
votes
0answers
33 views

How can I send an email using a GPG public key? [migrated]

I would like to send an email (on Windows), which I would like to encrypt using a GPG public key. I tried to use a Thunderbird plugin, but it requires both the public and the private key. But I have ...
0
votes
0answers
63 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
2
votes
0answers
126 views

How to hide my IP address in email headers [migrated]

I use thunderbird to send email. My mail server inserts my IP address into the header of my emails. Is there a way to hide this? I've thought of sending my mail to the server through Tor but my ...
5
votes
2answers
136 views

Should you let users know if an email has been taken during registration validation? [duplicate]

In many web applications, email is required to be a unique field, and users aren't allowed to register an account if their email already exists in the database. When performing validation on the ...
2
votes
4answers
68 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
3
votes
1answer
68 views

Generating token for email validation and registration security

My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses. I am using MVC 5 and ASP.NET ...
2
votes
1answer
44 views

Is e-mail authentication using a hashed ( address + string ) insecure?

I want to give a newsletter subscriber the possibility to change his information. Since we're using an external company for sending our newsletter I can't put a key right into the newsletter (or not ...
1
vote
1answer
52 views

What do I do about a forgotten, ancient PGP key?

So I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key ...
3
votes
1answer
138 views

My sendmail started sending spam; what is causing it to do so? [closed]

Today my sendmail service started sending e-mail to various addresses. /var/spool/mail: From MAILER-DAEMON@noxcommunity.com Fri Jan 30 22:15:30 2015 Return-Path: ...
0
votes
2answers
81 views

Could someone stop another from accessing their own online account?

Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send ...
-1
votes
1answer
115 views

Gmail disclosing your account name to recipients? [closed]

My Gmail setting has forever been set to send emails with just my Gmail address as the identifier, so it should not send out my account name (first or last name)... or so I thought! Recently I got a ...
1
vote
3answers
81 views

Strong email validation. Is it really necessary?

I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide email so that a confirmation link will be sent to their email address for ...
4
votes
1answer
51 views

phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
0
votes
0answers
36 views

SNORT only alerting on inbound traffic [migrated]

I am trying to raise an alert when someone is setting up a connection to PORT 25 (tcp), whatever source or destination. For this i came up with this simple rule: alert tcp any any -> any 25 ...
1
vote
0answers
25 views

Can't mail stolen session ID [closed]

I'm working on this platform: http://testfire.net/ With this script I can see the cookie: "><script>alert(document.cookie)</script> So now I'm trying to mail this cookie to me. ...
1
vote
0answers
39 views

Are old Android OS's a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
2
votes
3answers
166 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
3
votes
3answers
490 views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
3
votes
1answer
91 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
1
vote
1answer
118 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
2
votes
3answers
179 views

Fake “FROM” email to allocate to account

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the ...
-1
votes
1answer
82 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
2
votes
2answers
69 views

Email “privacy” when sending within same domain

Scenario: email is hosted third party (think Outlook, Gmail etc.) I am sending email to another person with an email account on the same domain (think from user1@example.com to user2@example.com) ...
1
vote
0answers
131 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
4
votes
1answer
117 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
2
votes
3answers
282 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
0
votes
1answer
64 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
0
votes
0answers
44 views

How can I secure a reply-via-email system?

I am working on setting up a reply-via-email system (similar in functionality to what Basecamp uses) in which a user can reply to an email generated by the system in order to add a message to a ...
0
votes
1answer
23 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
5
votes
2answers
96 views

Is e-mailing personal information significantly riskier than transmitting the same information another way?

I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address ...
0
votes
1answer
52 views

Disposable mail for anonymity

Initially asked in bitcoin, I wanted to know how is it supposed to be used for anonymity. I mean that I need to register wallets and buy bitcoins. For anonimity, guitedlines recommend to use ...