Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
216 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
0
votes
1answer
191 views

How is PKI used to encrypt an e-mail for multiple recipients?

My understanding is that when an e-mail is encrypted and sent to a recipient, the recipient's public key is used to encrypt the e-mail, and then only the recipient can decrypt it with their private ...
1
vote
1answer
222 views

Spam Mail - have someone broke in to my shared hosting account? [duplicate]

Yesterday I noticed that one of my e-mail addresses (the only one within that domain) started to receive a lot of weird messages that the mail haven't reach the target (something like "Sorry, Qmail ...
3
votes
1answer
848 views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
-4
votes
1answer
151 views

Email obfuscation/munging recent research [closed]

Does anyone know of any recent (past year or two) research into email obfuscation/munging? All I can find are tests done five to ten years ago. I'm trying to decide whether it's something still ...
1
vote
3answers
2k views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 /usr/lib/postfix/...
9
votes
5answers
26k views

Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses?

Someone has sent a sensitive email from my Gmail account. I wanted to trace the IP address by checking out the Received: by X field in the header of the sent message. However, every message that is ...
3
votes
1answer
1k views

Email clients and POODLE vulnerabilities

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client. Could ...
1
vote
2answers
454 views

E-mail tracking countermeasures

I've started using Sidekick to know when an email is opened or one of the links in it is clicked. What I ask now is how to know if an email I received is provided with a similar tracking system. With ...
13
votes
2answers
2k views

Should I change phone number and e-mail address after PayPal fraud?

I have been the victim of PayPal fraud. I hadn't used PayPal in a year and then within 9 days there were three unauthorized transactions on my account for a total of 150 Canadian dollars and 290 ...
-1
votes
3answers
2k views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...
0
votes
2answers
302 views

How can one verify that two separate emails are not coming from the same place?

I sell merchandise online. Due to suspicious activity (in my very amateur opinion), I have reason to believe that, what seems like two separate orders, are actually a single scam being perpetrated by ...
1
vote
2answers
189 views

Having a consistent “dont reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
2
votes
3answers
4k views

How to check if range of IP addresses are SPAM blacklisted?

While it's easy to check if a single IP address is blacklisted for SPAM using for example http://www.spamcop.net/bl.shtml, then is there a way to check multiple addresses at once? For example how to ...
3
votes
1answer
582 views

How to sign and encrypt mail using openssl?

I am trying to send and encrypt mail using openssl. So far, I figure I should use theese commands: cat ${content} | \ openssl smime -encrypt -inkey lib/me.crt -aes256 -subject "$titre (cs)" -to ...
1
vote
3answers
95 views

How safe is it for an app to trust a click on a link in an email?

In my question and answer application, Joe signs up, logs in and adds a question. He then shares the question via email to his trusted friends. How safe is it to provide a link within that app ...
1
vote
1answer
160 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
11
votes
4answers
6k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
3
votes
8answers
10k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
1
vote
2answers
200 views

Unexpected emails have been sent - do I need to wipe my Android?

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large. I opened my Gmail App and found 5 messages in the Sent Mail folder ...
1
vote
0answers
307 views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
2
votes
2answers
90 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
11
votes
4answers
4k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
0
votes
1answer
189 views

How to share sensitive documents with unknown/untrusted parties?

My exact use case is that I'm starting a new job, and I need to transmit sensitive personal documents to support my application. However, the same applies for applying for a loan, buying a house etc ...
1
vote
4answers
344 views

Is e-mail sent from a Gmail address to another Gmail address encrypted?

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
0
votes
1answer
31 views

Can I keep large encrypted files in my mailbox on mail provider server?

Is there any restriction or policy of large e-mail providers (such as GMail, Yahoo, Hotmail and similar) for keeping/storing large encrypted files by the users within their disk quota in 3rd party ...
2
votes
1answer
7k views

What is cleardot.gif next to the senders signature in Gmail? [closed]

I am concerned that my computer has been compromised because I sent an email out - but now I noticed that there is a link in the email I did not insert, and I am worried I have a virus or something. ...
4
votes
4answers
2k views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
2
votes
3answers
308 views

Email account 'hacked'; do I need to regenerate my server's DKIM _domainkey?

I'm just learning about DMARC (DKIM/SPF), so I apologize if my question doesn't make sense. A few days after I installed a DMARC policy on my server I noticed that the reports from yahoo.com ...
0
votes
0answers
177 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
-3
votes
2answers
159 views

Does company email can access hangouts and private emails? [duplicate]

I'am curious whether the administrator's has the privilege to access the hangouts chat and the email of employees? For example, here in our company we are using the gmail as our private email ...
2
votes
2answers
208 views

It it a good idea to whitelist inbound email using a Hash on the address? (Similar to BATV, but with DKIM)

Problem Statement I'm looking at ways to ensure that business partners, or emails from trusted senders, never get quarantined; ....in other words prevent "ham being seen as spam". Ideally this ...
3
votes
1answer
88 views

Preventing users abusing emailing feature of web application

Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus ...
-4
votes
1answer
857 views

Trace email without header or IP address [closed]

I have a gmail address only. It is a copy of the email. I do not have the original email. Is there anyway to trace it?
6
votes
3answers
315 views

Why can't PGP/GPG Web-of-Trust be automated?

We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
2
votes
2answers
90 views

Secure alerting for a monitored web application

What is a good method to receive security alerts? Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being delivered)...
-1
votes
1answer
65 views

IP address question [closed]

I traced a header on an email I received, the person claims to have sent it from Maryland, but I traced the IP and it shows shows San Jose, CA and also contains loop backs, ??? Is this possible?
0
votes
2answers
928 views

Gmail spam from contacts. How does it work?

I don't know why it seems IMPOSSIBLE to find a blog or any security expert explaining the procedure of how this 'hack' works. My wife is receiving emails from people she's emailed through Gmail ...
-1
votes
2answers
90 views

Can passwords be figured out via public wifi? [duplicate]

Few different scenarios: 1a) On public McDonalds wifi, logging in gmail account (or any account such as skype). Can a random user who is using the same wifi somewhat intercept the signal and figure ...
2
votes
1answer
364 views

Is it possible to track the email sent via BCC List using firewall or network security software?

I want to know whether is it possible to know the conversation/email sent via BCC can be identified by admin in some corporate companies? I have heard that email sent from BCC cannot be identified, ...
1
vote
1answer
50 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
0
votes
1answer
136 views

emailing a direct link to executable file blacklist risk

I hope this is in the right place, don't know where else to ask. I would like to automatically send a download link to people that directly downloads an executable. The executable is a verified and ...
1
vote
1answer
2k views

How to tell computer of origin sending email messages? [duplicate]

I’m not a security expert. I wasn't sure if I should post this question here or in "exploit". I have searched for answers before posting.... Could anyone tell me how I can determine if emails are ...
0
votes
2answers
200 views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
2
votes
2answers
376 views

Are our email credentials safe with email clients?

I've been trying out a few desktop email clients (Windows) to better manage my e-mail. As I tried Thunderbird, Inky, and Outlook, it occurred to me, what guarantee is there that my e-mail/pass won't ...
5
votes
1answer
308 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
1
vote
2answers
123 views

access to email addresses

I am taking part in an online voting photo contest. In order to vote, you have to register using your email address. Is it possible that people who run the site will be able to see my email address ...
1
vote
2answers
395 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
19
votes
4answers
4k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
20
votes
4answers
2k views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...