Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

2
votes
0answers
45 views

Is it the default in billing systems to send out the users password by email? [duplicate]

I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk. One of their employees responded with ...
-1
votes
2answers
567 views

Keyloggers and Email Accounts [duplicate]

This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker. How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
2k views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
10
votes
5answers
5k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
3
votes
1answer
394 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...
0
votes
2answers
1k views

Keyloggers - Ports used by keyloggers

According to this article, keyloggers usually make use of the FTP ports and email ports: http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html My question is, can a ...
2
votes
1answer
2k views

How to determine source of e-mail and verify if the source is/could be legitimate?

I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
26
votes
6answers
15k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
5
votes
1answer
402 views

Is it safe to abandon a free webmail account that has been in use for a significant amount of time?

I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address. I have concerns around accounts that I may have ...
-1
votes
2answers
411 views

Hiding emails from Google [closed]

From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons. If a have a group of people who want to hide their emails from Google, how ...
2
votes
0answers
297 views

User friendly PGP email [closed]

Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience? Generate new key at first startup, rather than asking the user if they have an ...
15
votes
6answers
1k views

When secure email, is not really secure

We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
1
vote
1answer
256 views

Using a separate email address for each contact

A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me ...
5
votes
6answers
24k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
2
votes
4answers
399 views

Open an e-mail account from only one particular system?

Is there a way to configure e-mail so that it can only be opened from one particular system? Or from multiple systems having some sort of unique key or particular static IP?
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
2
votes
3answers
2k views

Is it possible to block emails (to all email accounts) that contain certain word/phrase patterns?

A friend of mine has been cyber-stalked for 4 years now by an ex-boyfriend. He recently worked out her new job email address (via LinkedIn) and started sending her emails. She told me that the emails ...
12
votes
3answers
591 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
1
vote
3answers
1k views

How to Detect Zimbra Sniffing Trojan

I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO. "Everytime I send or receive an email - I get a SPAM ads a few ...
3
votes
4answers
4k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
1
vote
1answer
951 views

How do I know if my email account has been hijacked?

A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and ...
1
vote
1answer
476 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
4
votes
1answer
256 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
3
votes
4answers
4k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
21
votes
4answers
11k views

How can I protect against email tracking services?

Recently a free service came out for email tracking, bananatag. It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
14
votes
2answers
16k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
9
votes
4answers
10k views

Why is it even possible to forge sender header in e-mail? [duplicate]

With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the ...
4
votes
3answers
4k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
4
votes
2answers
177 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
0
votes
3answers
164 views

Secure design for handling mail attachments

I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific ...
5
votes
1answer
460 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
-1
votes
4answers
191 views

Is there any way to know the contact email on a contact form? [closed]

When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
4
votes
2answers
1k views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
10
votes
4answers
4k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
1
vote
3answers
2k views

Emails wrongly flagged as spam by filter, claiming suspicious URLs

My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the ...
33
votes
4answers
2k views

If email is insecure, why do we use it for password resets?

I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application." But then it struck me, Why is email considered insecure? If it is so insecure, why ...
-1
votes
1answer
148 views

E-mail with obfuscated code / no trace in e-mail server

I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
3
votes
3answers
821 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
2
votes
2answers
1k views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
4
votes
3answers
2k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
6
votes
4answers
4k views

How should I react to finding GMail outbox e-mails that I didn't send?

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on ...
1
vote
1answer
231 views

Any recipient can modify an order confirmation mail, right? Does this ever matter ?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
2
votes
1answer
301 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
14
votes
1answer
2k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
4
votes
3answers
2k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
8
votes
5answers
922 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
4
votes
3answers
4k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
6
votes
5answers
975 views

How do spammers verify the validity of a huge amount of email addresses?

I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server. But for this method, the MX server may abort connection after ...
3
votes
3answers
124 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
4
votes
5answers
279 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...