Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

4
votes
2answers
471 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
119 views

What stopping someone from offering distributed and encrypted email? Just like Bitcoins

Basically Email service that is ran over a network, so it's not owned by any one entity. Everyone can use it and send email to someone else. All messages travel through a web of interconnected ...
4
votes
1answer
42 views

How accurate the recent activities location provided by Microsoft emails

One of my emails is on hotmail.com provided by Microsoft. Recently, after few suspicious incidents where my computer was hacked and many other accounts, I changed all my passwords including this ...
32
votes
2answers
3k views

Is email less secure than voicemail, snail mail, or internet portals for transferring sensitive information?

Where I am in the US, health care providers refuse to send anything through email (e.g. even something as trivial as an appointment reminder). Often they claim that email is not secure. Instead they ...
4
votes
3answers
217 views

How do I recover from an email breach?

A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails ...
-1
votes
1answer
40 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
5
votes
1answer
249 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
8
votes
2answers
4k views

How to prove my Gmail has been hacked?

I believed that someone had hacked my Gmail because they were using information contained within my emails in an attempt to try to convince me that they were psychic. I told them that I didn't believe ...
0
votes
1answer
23 views

Under what circumstance might your email not make to your intended recipient? [closed]

I'm asking because it's one thing to eavesdrop on someone's email, but it's another thing to prevent your email from getting to your recipient. For example, I sent an email to a colleague and he and I ...
3
votes
3answers
113 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
11
votes
3answers
12k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
3
votes
3answers
108 views

Email injection in simple terms?

Can someone explain why spammers use email injection? I am a victim and was wondering if there was any other malicious point besides annoying me and filling up my e-mail?
22
votes
4answers
22k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
0
votes
0answers
116 views

Why is my website getting spammed?

Does anyone recognize this type of spam? NAME: Bagas EMAIL: dq95zxm7l@gmail.com PHONE: JCBUIR6ulwtO COMMENTS: I must express apaotcipeirn to the writer for bailing me out of this particular ...
3
votes
2answers
73 views

DMZ and mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
48
votes
6answers
8k views

Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?

Why would anyone like Edward Snowden rely on 3rd party services like Lavabit or Hushmail to host his email? I mean it's very easy to set up a self-hosted email server. What you need: Rent VPS (even ...
10
votes
5answers
14k views

Can the recipient of my emails know my IP address?

When I send out emails using gmail, is my IP address being recorded? can the recipient of my gmail message knows my IP address and thus infer where I am located?
3
votes
1answer
122 views

How was my email intercepted? [closed]

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
4
votes
2answers
114 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
3
votes
1answer
58 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...
-6
votes
2answers
81 views

Is it possible that the person I write to will see the email before I write to him?

Is it possible that the person I write to will see the email's content before I reply to him? If I got an email and I answering that email, is there any feature that can cause my reply to be seen by ...
1
vote
4answers
114 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
75 views

Is thread's auto-login from email implementation secure/good user experience?

As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL. e.g https://www.thread.com/1234logmeintomyaccount-forexample This is a really ...
2
votes
4answers
86 views

What are some ways to spot email spoof attacks?

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are ...
2
votes
3answers
160 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
-3
votes
2answers
52 views

What IP address is a new email account associated with? [closed]

If records are subpoenaed from google will they reveal internal IP or external IP addresses of a email account? For example if an email address is made and an email is sent using and iPad and home ...
5
votes
2answers
202 views

Potential employer wants me to email my SSN with an application form, is this a major security risk?

I'm job hunting at the moment and I've come across several potential employers that have PDF's that you would download, fill in, and then email to them. I feel EXTREMELY uncomfortable sending my ...
4
votes
2answers
3k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
3
votes
3answers
622 views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
2
votes
1answer
86 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
8
votes
2answers
1k views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
2
votes
1answer
106 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
3
votes
3answers
890 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
4
votes
5answers
932 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
0
votes
2answers
190 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
2answers
27 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
6
votes
2answers
1k views

Can someone know my IP address through Thunderbird email attachments?

Can someone know my IP address through Thunderbird email attachments? Can a cunning attacker manage to find my IP address through attachment 'images' in emails that I unsuspectingly open?
8
votes
4answers
5k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
1
vote
2answers
50 views

Is there a online filter to check email attachments?

I've just received an email from an old employer. There is very little information in the message sent just: See attached file for your review. Kind regards, Mick with an attachment. I ...
-2
votes
2answers
54 views

Are these statements correct [closed]

Are the following three statements more or less correct: -To send someone an encrypted email basically entails having access to their public key (either smime or pgp). Thus for all practical ...
2
votes
2answers
116 views

Hijacked Aol Email Account - Lack of security?

First, I'm very sorry if this is not the place I should ask this, but it seems to be the best choice. My Aol email account was hijacked during the night two days ago : the password has been changed ...
0
votes
2answers
102 views

Is this a case of simple email spoofing or has my email account been compromised?

I just arrived home and when got to my computer I checked my mail box and it was with a message coming from my own email address that was sent almost at the same time I got home. I promptly ...
3
votes
4answers
454 views

How to detect self destructing emails? How to prevent from self destruction?

Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine Now my ...
2
votes
1answer
66 views

mis-use of email address to obtain services from Groupon [closed]

I recently bought a new domain name "familyname.net" and I redirect emails to this domain to my normal email address. Recently I received various emails, one of which came from Groupon to confirm the ...
-1
votes
4answers
132 views

What mail applications use crypto?

I just read that everyone in the world can ready my mails (if intercepted in traffic by eavesdropping?). Also, it reads that current versions (book's from 2004 so I assume that new versions adopt ...
0
votes
4answers
352 views

Is end to end email encryption possible without unique domain/subdomain for each user?

Lets say Alice@gmail.com wants to send message to Bob@secureMail.com Alice <--> gmail.com <--> secureMail.com <--> Bob We know gmail.com can read the unencrypted message. Is it possible for ...
6
votes
3answers
580 views

Is there any security reason that mail services like gmail or yahoomail limit the size of file attachment?

Despite the fact that Email standards such as MIME don't specify any file size limits, but in practice email users will find that they can't send very large files(more than 20 or 25 MB). Some experts ...
4
votes
2answers
131 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
2
votes
4answers
143 views

How can I stop an IP from trying to use my mail server?

I have recently set up my first email server, and I look at the logs in /var/logs/mail.log to see what is happening, I notice this one IP does this multiple times every day for the last so many weeks ...
5
votes
5answers
4k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?