Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
82 views

Is winmail.dat a malware propagation vector?

Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
0
votes
1answer
76 views

Can malware be activated by previewing email in Outlook's Preview pane?

It is common advice to not open suspicious email in order to avoid being infected by malware contained in the email. What constitutes opening an email in Outlook? Specifically, is viewing an email in ...
2
votes
1answer
77 views

Where do I report a friend's email account that has been hacked?

I just received an email from a friend's email account that conforms with the standard hoax where the person says they are traveling, have been robbed, and need money to pay for the hotel bill to get ...
1
vote
2answers
102 views

Are file attachments “unsafe”?

The management at work are asking, "How can we send files easily and safely to each other?", arguing that: Putting attachments in email is not safe. They want to send links instead They want to ...
24
votes
4answers
13k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
15
votes
4answers
3k views

How can I protect against email tracking services?

Recently a free service came out for email tracking, bananatag. It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
0
votes
1answer
37 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
3
votes
1answer
131 views

Flood of email messages from @attacker.com

I've been getting the weirdest email messages for the last 2 days on my personal gmail inbox. On May 28th, exactly at 4:33 pm BRST I got about 2,000 emails that look exactly the same, here's the ...
1
vote
0answers
14 views

Email, Certificates and DANE

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
0
votes
1answer
38 views

What is the mechanism for this user impersonation?

I'm trying to understand how this user impersonation might have taken place. Here's the scenario: Our controller got a call from our bank this morning about a suspicious wire transfer request. After ...
1
vote
2answers
761 views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
0
votes
1answer
36 views

Email and Black Hole List Submission?

I'm having trouble with a spammer and would like to begin submitting their messages to a few black hole lists. Unfortunately, I'm having trouble finding a list. For example mail-abuse.org now ...
7
votes
6answers
770 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
4
votes
3answers
607 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
3
votes
6answers
11k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
1
vote
2answers
88 views

Does having a separate e-mail account only for security, increase security?

In this article about increasing the security of LastPass the author suggests: For additional security, you can have LastPass send security-related emails to a special security email address ...
10
votes
7answers
5k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
2answers
554 views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
6
votes
2answers
5k views

Malicious users trying to create yahoo accounts with random emails at my domain?

Recently, I have been getting a string of emails from yahoo with people trying to create accounts or add email addresses @mydomain.tld to their account. I was wondering if anyone else has seen this ...
1
vote
2answers
191 views

Does gmail's TOS allow Google to steal your emailed ideas?

Is it unwise to use gmail to discuss business ideas that Google could snoop on and use to their business advantage? I know that email is not secure and anyone could read it along its path of ...
1
vote
2answers
70 views

Are our email credentials safe with email clients?

I've been trying out a few desktop email clients (Windows) to better manage my e-mail. As I tried Thunderbird, Inky, and Outlook, it occurred to me, what guarantee is there that my e-mail/pass won't ...
4
votes
3answers
146 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
1
vote
1answer
110 views

My server was used for sending spam. Will our server ever be trusted again?

A while back I enabled SMTP on my IIS server with the intention of using it for internal email notifications. It seems that somehow hackers were able to use it for sending out thousands of spam ...
1
vote
1answer
68 views

Postfix periodic relay access denied

I administer an Ubuntu Server 14.04 which acts as a mail server running Postfix and was configured following most parts of this tutorial: ...
2
votes
1answer
90 views

Analyzing a suspicious email

Today I received a very suspicious email on my gmail account. When I analyzed the content of the message, this is what essentially made up the message. <center> <a alt="" ...
6
votes
4answers
1k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
1
vote
1answer
63 views

Is there any security benifit to sent email message only as attachement?

A well known company in Oil and Gas field, sends the email message as PDF attachment, with brief explanation, here is an example: Dear Mr Name, Please review the attached document acknowledging ...
2
votes
1answer
2k views

Yahoo Account hacked, changed pw, spam still going out elsewhere?

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts. I changed the password, then saw (via rejected emails sent to my Yahoo ...
41
votes
3answers
7k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
3
votes
3answers
1k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
3
votes
2answers
428 views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
0
votes
1answer
66 views

Email Spoofing Modified Headers

I have be reading more and more about email spoofing and was curious how some things are done. I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, ...
5
votes
6answers
3k views

How did the spam email sender get my name?

Some time ago I bought something online from a reputable website. I paid through my credit card and everything worked fine. The thing which is important to note is that the name used on the credit ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
2
votes
1answer
125 views

Should my company have an SSL on our email

We have a new IT guy that insists we do not need an SSL on our email. Quite a few people access their email from outside our office(network) via mobiles and home computers, often from WIFI ...
-1
votes
2answers
94 views

What are the security risks for a business that has an insecure email system [closed]

For instance if the email system uses POP3 legacy protocol and SMTP but is not encrypted, yet the business continues to use it for daily purposes both internally and externally, what could be the ...
2
votes
1answer
180 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
-8
votes
2answers
99 views

Why does a business need to secure its email system? [closed]

Why is important for a business to secure its email system?
0
votes
1answer
53 views

IP Address Same on Different Devices? [closed]

The IP address appears to be the same in the e-mail header even when e-mail is sent from different devices. Shouldn't the IP address reflect the device IP? The e-mail is set up through an exchange ...
3
votes
3answers
405 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
2
votes
3answers
1k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
9
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
0
votes
2answers
36 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
3answers
47 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
1answer
56 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
3answers
737 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
2
votes
1answer
56 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
3answers
85 views

How can get email about latest vulnerabilities [closed]

Today my friend got email for the latest vulnerablility heartbleed. But i could not find where i can subscribe so that i can also get emails about latest vulnerabilities Can anyone please help me ...
0
votes
1answer
63 views

Email hacking/masking prevention

Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it. When I look at the ...
0
votes
2answers
301 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...