Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
25 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
0
votes
1answer
17 views

emailing a direct link to executable file blacklist risk

I hope this is in the right place, don't know where else to ask. I would like to automatically send a download link to people that directly downloads an executable. The executable is a verified and ...
24
votes
4answers
13k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
0
votes
0answers
25 views

How to build the End-to-End GPG extension for Chrome [on hold]

In June 2014, Google announced work on a Chrome extension for Gmail to provide End-to-End email encryption using GPG. Has anyone managed to build this extension? I've followed the build instructions ...
1
vote
1answer
52 views

How to tell computer of origin sending email messages? [duplicate]

I’m not a security expert. I wasn't sure if I should post this question here or in "exploit". I have searched for answers before posting.... Could anyone tell me how I can determine if emails are ...
0
votes
2answers
81 views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
1
vote
2answers
82 views

Are our email credentials safe with email clients?

I've been trying out a few desktop email clients (Windows) to better manage my e-mail. As I tried Thunderbird, Inky, and Outlook, it occurred to me, what guarantee is there that my e-mail/pass won't ...
-1
votes
1answer
36 views

How do I force kill an OWA, Activesync, or Outlook session?

A user with a BYOD is still able to access the email system, even after the user account has been disabled and password changed. Since it's clear that a re-authentication event doesn't continually ...
1
vote
2answers
100 views

Getting Loads of Emails 'linking' my account to Gmail accounts I know nothing about

I have just come out of hospital and have in the region of 30 e-mails from gmail over the past few days 'linking' a gmail account to my (hotmail) email address. I have not done this once never mind ...
5
votes
1answer
157 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
1
vote
2answers
105 views

access to email addresses

I am taking part in an online voting photo contest. In order to vote, you have to register using your email address. Is it possible that people who run the site will be able to see my email address ...
1
vote
2answers
104 views

Using + for email addresses to find out who is selling your data: is it naive or is it effective?

It's pretty common among security-minded folks to fill in addresses using e.g. foo+company@gmail.com when disclosing their email address to company so that they can tell if company has sold their ...
1
vote
1answer
94 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
1
vote
2answers
335 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
2
votes
3answers
1k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
17
votes
4answers
843 views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
3
votes
2answers
81 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
61
votes
4answers
7k views

What are the security reasons for disallowing the plus sign in email addresses?

My question is based on this tweet after I commented about forbidding + symbols in email addresses. The tweet says, "This is a measure we've taken for security reasons." This can be frustrating and ...
2
votes
4answers
6k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
0
votes
2answers
51 views

What are the disadvantages to the site owner to have third parties e-mails displayed publicly?

I frequently have to remind my members not to post their e-mails due to spam bots. One of them told me he doesn't care about that since his spam filter is good enough. If I allow him to do that, are ...
-2
votes
1answer
24 views

Track mail sender from Mesh network [closed]

Mesh network have one router connected to WAN or Internet so IP address is allocated to that router will be exiting point for all the nodes.. and other routers will have Internet connection from that ...
0
votes
1answer
33 views

is this secure: email account that can only be accessed by sending and receiving emails within gmail

i am creating a game of sorts where you use and earn credits to accomplish tasks. I am curious if you can effectively use gmail's security features to secure these submissions if the emails are all in ...
1
vote
1answer
48 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
2
votes
6answers
2k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...
0
votes
1answer
51 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
4
votes
1answer
154 views

How is ZixCorp able to provide email encryption without a password?

I am trying to understand how/if an email I received is being encrypted. A financial institution sent me a verifiable email (i.e. not phising) asking me to fill out a pdf form to complete a ...
-4
votes
1answer
76 views

How i can stop already sent email? [closed]

I have a Gmail account. Unfortunately I have sent an email from my Gmail account. How I can stop or back this email ?
1
vote
3answers
53 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
8
votes
5answers
759 views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
2k views

What is cleardot.gif next to the senders signature in Gmail? [closed]

I am seeing an invisible image called cleardot.gif appearing next to the sender's name at the bottom of their email. (immediately to the right after "Sincerely, [their name"]). It only happens with ...
0
votes
2answers
37 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
1
vote
2answers
57 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
0
votes
3answers
113 views

VPS Privacy: OpenVZ vs KVM vs Xen

Considering OpenVZ, KVM and Xen: Which VM technology is the most difficult for the host's administrators to access given an encrypted root partition? Can I have a reasonable expectation that rogue ...
4
votes
5answers
221 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
6
votes
4answers
164 views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
15
votes
4answers
2k views

Is this “Domain Registration Service” email a scam?

I received an email to the email address listed on our website (it's a generic info@ourcompany.com to help "weed out" spam, whereas each employee has something like andreas@ourcompany.com to which I ...
9
votes
3answers
1k views

Is it bad to only sign some of a domain's emails with DKIM?

Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game? We use Amazon's Simple-Email-Service for sending e-commerce emails. We would like to sign these with DKIM. This same ...
3
votes
2answers
139 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
3
votes
3answers
334 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
5
votes
1answer
168 views

Fake email messages via List-Unsubscribe header

List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list: List-Unsubscribe: <mailto:list@host.com?subject=unsubscribe&body=qwe> Free ...
3
votes
1answer
146 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
1
vote
3answers
186 views

Girlfriend just sent Personal info over email

My GF just hit me up and told me she just sent some of her personal info over an email. She was trying to send her folks some documents.I guess the documents had some sensitive info on them Like her ...
2
votes
1answer
647 views

How could someone create a Facebook account with my email address without stealing it?

Someone with the same name as my sister seems to have inadvertently created a Facebook account with her email address. The funny thing is that this person doesn't seem to have ever accessed my ...
0
votes
0answers
53 views

How to secure Outlook [Resolved]

I was curious on some best practices for securing Outlook against hackers. The data transmitted between the email server and client are almost always encrypted these days but I haven't seen a great ...
0
votes
1answer
216 views

How do I determine S/MIME encryption used?

From what I understand it seems that S/MIME uses PKCS #7 which can handle various different types of encryption. How is the choice of encryption method made by the e-mail client and how do I know what ...
13
votes
2answers
4k views

Paypal Account created using my gmail account

Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her. I noticed that, removed the forward and changed the password. Now, I ...
2
votes
2answers
106 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
3
votes
1answer
109 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...