Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

9
votes
3answers
826 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
-1
votes
2answers
192 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
6
votes
2answers
3k views
1
vote
0answers
48 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
2answers
1k views

What information can be gained from an Email Header?

What information is present in an Email Header that can be used to track a sent mail? For example, are some of these present? Web Browser used? Operating system Type of Network (broadband/dial up)? ...
1
vote
1answer
2k views

Email Spoofing by SMTP Message-ID?

Many of my users today got email from docs#@mydomain.com (where docs# was between docs0 and docs8 or so, and mydomain.com is obviously changed from my real domain name), with the sender name of ...
0
votes
2answers
568 views

How do fake emailers work?

Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
1
vote
1answer
497 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
4
votes
3answers
2k views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
3
votes
3answers
2k views

Email security and Home Mail Servers

Suppose you're truly paranoid (I assume the majority here identify with this?) and you don't want Google or other email service providers reading your email (to serve ads, etc). You don't want your ...
2
votes
5answers
606 views

Is it possible for an attacker to change my sent emails content before arrival?

I have a web application that sends "change password link" to user that wants to changhe his password. The link is something like this: http:// ...
7
votes
4answers
13k views

Can most mail from *.ru be considered spam?

Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).
-1
votes
2answers
203 views

Hotmail security

Recently I've been receiving in my SPAM folder, SPAM mails sent "by me". With "By me" I mean, that I am not sure if those are really sent from me. It has been happening since December, at around one ...
1
vote
0answers
64 views

Needed: Reference data on the rate of adoption of secure email protocols [closed]

I am working on a security presentation in which I need to show that the incidence of unencrypted email protocols (e.g. POP, IMAP without STARTTLS) over the past 10 years has decreased and the amount ...
4
votes
2answers
255 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
1
vote
3answers
129 views

Question: How to plan email policy for start-ups?

I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
29
votes
5answers
98k views

How to find out the IP address of email sender in Gmail

Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender. Since Gmail ...
4
votes
2answers
747 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
3
votes
1answer
143 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
1
vote
3answers
267 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
0
votes
1answer
82 views

How to pass an email address securely to a web application X embedded inside a web application Y

The scenario I'm trying to address is this: There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain). When X is ...
0
votes
1answer
84 views

Can one be infected just by reading an e-mail [duplicate]

I have heard several people say that you shouldn't even open e-mails that look suspicious, as you might be infected by a virus of some kind. Is there any validity to this? I suppose that some e-mails ...
3
votes
2answers
597 views
3
votes
2answers
767 views

How to ensure an email address is not free webmail or ISP address?

I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs: ...
0
votes
2answers
932 views

Security Certificate not from a valid authority

I have no real knowledge about this stuff so I figured I'd ask here for some answers. So I started to get this "Security Certificate not issued by a valid authority" error when using my email client ...
11
votes
3answers
813 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
3
votes
6answers
262 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
3
votes
3answers
503 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
5
votes
6answers
23k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
-1
votes
2answers
155 views

My Email Security is Low

I use Gmail to exchange confidential and important documents with my customers. The documents are read by an unauthorized person (during sending the email) that I don't know him/her. How can I solve ...
2
votes
1answer
115 views

Layered email encryption with multiple private keys on separate media

I'd like to encrypt e-mail messages so that multiple physically separated keys are needed to decrypt them. For example, I'd like to have three private keys stored on different media, as in: key A ...
1
vote
2answers
92 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
1answer
98 views

Getting more users to use PGP [closed]

Does anyone know of browser Plugins that make Composing, sending, and reading email basically effortless? Mailvelope doesn't seem to be working with the floating compose boxes in Gmail currently. ...
0
votes
1answer
82 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
1
vote
1answer
3k views

What are the realistic chances of email being intercepted via SMTP/TCP-IP? [closed]

Dear SMTP and TCP/IP network security gurus: I'm curious about what is the realistic risk of sensitive information (such as a email pdf attachment) being intercepted/read by a hostile party from a ...
-1
votes
2answers
79 views

encrypted emails and keyservers

I read that encrypted emails are secure, cause only who has your public key can decrypt it. I also read that it's a common thing to upload your public key on a keyserver. But if my encrypted email ...
7
votes
2answers
2k views

secure webmail provider

Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account ...
0
votes
5answers
1k views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
-3
votes
1answer
68 views

Do corrupted pdfs become a virus?

Can someone let me know if a corrupted pdf if the binary for a virus still exists but the pdf structure is corrupted does it still become a virus when downloaded form email?
1
vote
1answer
84 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission ...
0
votes
1answer
202 views

Email hacker, what to do now?

Throughout the past 2 years; I have received email messages (about 6 or 7 cumulative) in which I responded to about 3. Which were personalized messages from a series of 3 email addresses. Nothing ...
0
votes
4answers
7k views

How to trace email?

Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
2
votes
2answers
979 views

GPG good signature but Warning: untrusted signature

I'm having an issue with some of my clients being unable to open email attachments when I sign the messages. The error they get is something like (free translation): Error: cannot open. The ...
0
votes
2answers
216 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
1
vote
1answer
2k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
12
votes
3answers
1k views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
1
vote
2answers
804 views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...
4
votes
1answer
95 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
1
vote
2answers
1k views

Is spam more likely to be sent to info@example.com? Would I be better off using a different address?

I think that when bots gather domain names or process a list of domain names, they create email addresses like info@example.com or support@example.com. Does selecting something different help to ...