Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

-1
votes
2answers
779 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
-1
votes
2answers
199 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
-2
votes
1answer
223 views

Stopping spam and worms with SPF [closed]

Sender Policy Framework is a system to detect spoofed emails. From http://www.libsrs2.org/overview.html : WHAT EMAIL FORWARDING SERVICES NEED TO KNOW ABOUT SPF To combat spams, worms, and ...
9
votes
5answers
6k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
6
votes
3answers
205 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
-1
votes
0answers
259 views

Email sender and account hacked [closed]

One customer got their email account "frozen" because it sent 9000 emails and some bounced back. I suspect something got hacked, but I have no idea what to do. I cannot figure out what was hacked. ...
3
votes
1answer
278 views

What is the security purpose behind the “enable editing” of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
113
votes
9answers
14k views

How can PayPal spoof emails so easily to say it comes from someone else?

When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
6
votes
4answers
281 views

Technical security issues with proactively executing a phishing campaign targeting your own users

We've had some issues with compromised accounts due to users falling victim to phishing campaigns. The possibility of us doing a phishing campaign against our own users to proactively shame them has ...
3
votes
1answer
273 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
4
votes
3answers
177 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
5
votes
4answers
1k views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
0
votes
2answers
238 views

“You have new mail” message

I received a message from Google saying someone entered my email account. I confirmed that there were an access from an IP in another country. I have noticed "You have new mail" message when I open ...
2
votes
1answer
336 views

Securely notify users about account changes

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes: ...
6
votes
3answers
208 views

Is there any sense in using two-step authentication for personal email address?

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
-1
votes
1answer
441 views

Automated scanning of personal email [closed]

I am a current user of gmail, and have recently become interested in the privacy policies of the large webmail providers like gmail, yahoo, hotmail etc. I understand that it is commonplace for them to ...
1
vote
1answer
507 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
3
votes
1answer
2k views

The security of sending emails with SPF/DKIM, but not signed

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM. A few days ago we noticed that they allow any ...
2
votes
0answers
44 views

Is it the default in billing systems to send out the users password by email? [duplicate]

I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk. One of their employees responded with ...
-1
votes
2answers
561 views

Keyloggers and Email Accounts [duplicate]

This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker. How can these e-mails be intercepted? Let us say that I have a packet ...
3
votes
1answer
393 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...
0
votes
2answers
1k views

Keyloggers - Ports used by keyloggers

According to this article, keyloggers usually make use of the FTP ports and email ports: http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html My question is, can a ...
2
votes
1answer
2k views

How to determine source of e-mail and verify if the source is/could be legitimate?

I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
5
votes
1answer
400 views

Is it safe to abandon a free webmail account that has been in use for a significant amount of time?

I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address. I have concerns around accounts that I may have ...
-1
votes
2answers
410 views

Hiding emails from Google [closed]

From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons. If a have a group of people who want to hide their emails from Google, how ...
2
votes
0answers
296 views

User friendly PGP email [closed]

Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience? Generate new key at first startup, rather than asking the user if they have an ...
15
votes
6answers
1k views

When secure email, is not really secure

We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
0
votes
1answer
255 views

Using a separate email address for each contact

A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me ...
2
votes
4answers
395 views

Open an e-mail account from only one particular system?

Is there a way to configure e-mail so that it can only be opened from one particular system? Or from multiple systems having some sort of unique key or particular static IP?
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
12
votes
3answers
587 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
1
vote
3answers
1k views

How to Detect Zimbra Sniffing Trojan

I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO. "Everytime I send or receive an email - I get a SPAM ads a few ...
1
vote
1answer
935 views

How do I know if my email account has been hijacked?

A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and ...
1
vote
1answer
468 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
4
votes
1answer
256 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
3
votes
4answers
4k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
4
votes
3answers
661 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
9
votes
4answers
10k views

Why is it even possible to forge sender header in e-mail? [duplicate]

With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the ...
8
votes
4answers
463 views

Next steps after webmail account was compromised

John Doe told me the following story: I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
3
votes
3answers
370 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
4
votes
2answers
177 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
0
votes
3answers
164 views

Secure design for handling mail attachments

I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific ...
5
votes
1answer
446 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
-1
votes
4answers
190 views

Is there any way to know the contact email on a contact form? [closed]

When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
4
votes
2answers
1k views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
33
votes
4answers
2k views

If email is insecure, why do we use it for password resets?

I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application." But then it struck me, Why is email considered insecure? If it is so insecure, why ...
1
vote
3answers
2k views

Emails wrongly flagged as spam by filter, claiming suspicious URLs

My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the ...
-1
votes
1answer
148 views

E-mail with obfuscated code / no trace in e-mail server

I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
1
vote
1answer
231 views

Any recipient can modify an order confirmation mail, right? Does this ever matter ?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
2
votes
1answer
300 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...