Tagged Questions

Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
2answers
351 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
3
votes
2answers
89 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
62
votes
4answers
8k views

What are the security reasons for disallowing the plus sign in email addresses?

My question is based on this tweet after I commented about forbidding + symbols in email addresses. The tweet says, "This is a measure we've taken for security reasons." This can be frustrating and ...
0
votes
2answers
64 views

What are the disadvantages to the site owner to have third parties e-mails displayed publicly?

I frequently have to remind my members not to post their e-mails due to spam bots. One of them told me he doesn't care about that since his spam filter is good enough. If I allow him to do that, are ...
-2
votes
1answer
36 views

Track mail sender from Mesh network [closed]

Mesh network have one router connected to WAN or Internet so IP address is allocated to that router will be exiting point for all the nodes.. and other routers will have Internet connection from that ...
1
vote
2answers
68 views

is this secure: email account that can only be accessed by sending and receiving emails within gmail

i am creating a game of sorts where you use and earn credits to accomplish tasks. I am curious if you can effectively use gmail's security features to secure these submissions if the emails are all in ...
1
vote
1answer
79 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
0
votes
1answer
109 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
-4
votes
1answer
92 views

How i can stop already sent email? [closed]

I have a Gmail account. Unfortunately I have sent an email from my Gmail account. How I can stop or back this email ?
0
votes
2answers
45 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
4
votes
1answer
194 views

How is ZixCorp able to provide email encryption without a password?

I am trying to understand how/if an email I received is being encrypted. A financial institution sent me a verifiable email (i.e. not phising) asking me to fill out a pdf form to complete a ...
1
vote
2answers
69 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
0
votes
3answers
697 views

VPS Privacy: OpenVZ vs KVM vs Xen

Considering OpenVZ, KVM and Xen: Which VM technology is the most difficult for the host's administrators to access given an encrypted root partition? Can I have a reasonable expectation that rogue ...
1
vote
3answers
201 views

Girlfriend just sent Personal info over email

My GF just hit me up and told me she just sent some of her personal info over an email. She was trying to send her folks some documents.I guess the documents had some sensitive info on them Like her ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
0
votes
0answers
56 views

How to secure Outlook [Resolved]

I was curious on some best practices for securing Outlook against hackers. The data transmitted between the email server and client are almost always encrypted these days but I haven't seen a great ...
3
votes
2answers
181 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
4
votes
4answers
300 views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
3
votes
1answer
138 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
1
vote
2answers
692 views

My certificate seems fine but my TLS fails (Cert not validated)

I set up my certificate for my mail server at https://mail.travelstreamer.com/ I exported my certificate as described in my mail servers documentation and pointed to it in the server settings. The ...
0
votes
1answer
178 views

How do botnets deliver spam? [closed]

I can't seem to find the answer to this question. I read that botnet bots are used as email relays (they have smtp servers installed). Wikipedia on Open mail relay: "(...)Internet initiatives to ...
1
vote
3answers
65 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
2
votes
2answers
143 views

Is my PC safe? need help

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam. It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from ...
0
votes
3answers
82 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
2
votes
2answers
321 views

How to sniff email with https on Windows? [closed]

I am working now on Windows 7 and I want to see if I can sniff an email content on it with Wireshark. So all right with http but with https I can't at this moment and I don't understand how. You ...
0
votes
2answers
241 views

PayPal phishing attempt?

[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.] I have an email address, me@gmail.com that is not associated with ...
0
votes
2answers
77 views

What kind of information can be found from email?

When an average person sees an email, he can see only part of an information enclosed in the mail. To see full information one can look at the source of an email, which shows more. Example of an email ...
5
votes
2answers
1k views

Can someone know my IP address through Thunderbird email attachments?

Can someone know my IP address through Thunderbird email attachments? Can a cunning attacker manage to find my IP address through attachment 'images' in emails that I unsuspectingly open?
2
votes
4answers
291 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
1
vote
2answers
49 views

What is the proper terminology for the various SMTP tunnel encryption solutions?

I'm writing up documentation and want to ensure that I'm using proper terminology. 1) What is the proper technical term for the SMTP tunnel encryption standard that typically starts on TCP/25, ...
2
votes
2answers
125 views

Does SMIME differ from TLS, PGP, DMARC signature, or a Portal Encrypted email message in terms of legal non-repudiation?

I'm interested in protecting email messages from NSA-style snooping, but don't want to incur additional legal risk in doing so. In other words, does SMIME encryption and/or signing cause a given ...
3
votes
3answers
176 views

How to check that an e-mail service provides encryption between the mail servers?

How can I technically verify* that the e-mail I'm sending from Gmail to Yahoo is encrypted all the way from Gmail's servers to Yahoo's servers? I know that it's advised to have encryption between the ...
1
vote
2answers
71 views

Public e-mail Encryption Certificate

I'm quite new to this, so don't be too hard on me. I'm currently using the CipherMail MTA to generate e-mail encryption certificates. I created an own CA and public and private keys for our contact ...
0
votes
1answer
75 views

Security of starbucks gift card redemption feature

Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists. Clicking the redemption ...
0
votes
1answer
68 views

Gmail Voicemail Encryption

I want to listen to my voicemails in a secure but convenient fashion. I plan do this by having my PBX encrypt the voicemail using openssl aes 256 cbc with salt and a single static password. The ...
0
votes
0answers
16 views

Should an SMIME signing and encryption key have different expiration dates?

Assuming the client supports different keys, what is some rationale that should be considered for signing and encryption keys? For example, since the encryption key needs to be present on each device ...
1
vote
4answers
169 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
5
votes
4answers
272 views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
0
votes
2answers
47 views

Is it secure to use email to add content to a website?

I have a website running a social network Buddypress. Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without ...
2
votes
4answers
139 views

safe way to communicate IBAN connection

how do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
0
votes
2answers
91 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
0
votes
1answer
113 views

Can malware be activated by previewing email in Outlook's Preview pane?

It is common advice to not open suspicious email in order to avoid being infected by malware contained in the email. What constitutes opening an email in Outlook? Specifically, is viewing an email in ...
2
votes
1answer
128 views

Where do I report a friend's email account that has been hacked?

I just received an email from a friend's email account that conforms with the standard hoax where the person says they are traveling, have been robbed, and need money to pay for the hotel bill to get ...
1
vote
2answers
136 views

Are file attachments “unsafe”?

The management at work are asking, "How can we send files easily and safely to each other?", arguing that: Putting attachments in email is not safe. They want to send links instead They want to ...
0
votes
1answer
48 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
3
votes
1answer
183 views

Flood of email messages from @attacker.com

I've been getting the weirdest email messages for the last 2 days on my personal gmail inbox. On May 28th, exactly at 4:33 pm BRST I got about 2,000 emails that look exactly the same, here's the ...
1
vote
0answers
18 views

Email, Certificates and DANE

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
1
vote
1answer
64 views

What is the mechanism for this user impersonation?

I'm trying to understand how this user impersonation might have taken place. Here's the scenario: Our controller got a call from our bank this morning about a suspicious wire transfer request. After ...
0
votes
1answer
44 views

Email and Black Hole List Submission?

I'm having trouble with a spammer and would like to begin submitting their messages to a few black hole lists. Unfortunately, I'm having trouble finding a list. For example mail-abuse.org now ...