Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

2
votes
3answers
188 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
3
votes
3answers
543 views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
3
votes
1answer
104 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
1
vote
1answer
127 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
2
votes
3answers
203 views

Fake “FROM” email to allocate to account

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the ...
-1
votes
1answer
103 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
2
votes
2answers
87 views

Email “privacy” when sending within same domain

Scenario: email is hosted third party (think Outlook, Gmail etc.) I am sending email to another person with an email account on the same domain (think from user1@example.com to user2@example.com) ...
1
vote
0answers
177 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
4
votes
1answer
164 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
2
votes
3answers
293 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
0
votes
1answer
71 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
0
votes
0answers
49 views

How can I secure a reply-via-email system?

I am working on setting up a reply-via-email system (similar in functionality to what Basecamp uses) in which a user can reply to an email generated by the system in order to add a message to a ...
1
vote
1answer
26 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
6
votes
3answers
116 views

Is e-mailing personal information significantly riskier than transmitting the same information another way?

I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address ...
0
votes
2answers
69 views

Disposable mail for anonymity

Initially asked in bitcoin, I wanted to know how is it supposed to be used for anonymity. I mean that I need to register wallets and buy bitcoins. For anonimity, guitedlines recommend to use ...
23
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
18
votes
4answers
3k views

Would 'spam' mail really avoid eavesdropping?

spammimic.com offers a service that 'encrypts' your mail as 'spam', the rationale being that all mail services automatically filter out spam, and so if you're wanting to communicate with someone ...
2
votes
3answers
195 views

Could embedding website links in an email lead to more hack attempts?

My organization currently sends out emails directing our customers to login and view information on a customer portal site we have developed. The content of these emails is usually pretty generic ...
-1
votes
4answers
249 views

Creating a secure and encrypted e-mail service

Model People living in countries with totalitarian, oppressive and other threatening regimes should be able to use this system and have some degree of privacy when communicating. Objectives ...
12
votes
3answers
4k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
4
votes
1answer
225 views

How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with ...
0
votes
1answer
188 views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
1
vote
1answer
84 views

Test if an email address is spammer's

How can I test if an email address is a spammer's? I received a reply to my Craigslist post, with a gmail address in the email body. Craigslist uses some way to hide my email addresses, if I choose ...
0
votes
1answer
47 views

Is thread's auto-login from email implementation secure/good user experience?

As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL. e.g https://www.thread.com/1234logmeintomyaccount-forexample This is a really ...
0
votes
1answer
125 views

Clicked link on fake email which appeared to be from friend [duplicate]

I receieved an e-mail which at first glance appeared to be from a friend, I clicked on the link provided without thinking as we would often exchance links to sites. The link went nowhere i.e page not ...
2
votes
3answers
84 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
0
votes
4answers
244 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
5
votes
3answers
1k views

How to Stop Email Spoofing [closed]

Apart from SPF, what else can be done to stop hackers from spoofing your company's email addresses?
1
vote
0answers
43 views

Webistes listing email address lists for spammers [closed]

Which websites would you usually check if you suspect that your company's address book has been leaked and is being used by spammers? I have identified https://pwnedlist.com/ for this purpose but was ...
0
votes
1answer
37 views

Endpoint for checking if user exists in system

I have question regarding users point of view of this endpoint /api/user which requires POST data: email=user@domain.com and returns {"user@domain.com": "exists"} I am concerned if users might think ...
19
votes
3answers
3k views

How does Bayesian poisoning work?

This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it. The first case, where a spammer sends a spam with a payload (link, malicious ...
1
vote
1answer
80 views

Tracking sender of Email via email address ONLY

Is there a way to track the sender and the location via the email address only. The problem is somebody has created a similar sounding email id to send content to my official circle with a view to ...
1
vote
3answers
132 views

Potential risks when sending plain text E-Mails with encrypted attachments?

To ensure privacy in communication I encrypt and sign E-Mails using gpg4win. However, sometimes the communication does not work as expeceted (GPGTools and Outlook/gpg4win seem to be incompatible). In ...
3
votes
3answers
2k views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
1
vote
2answers
105 views

Viruses From Email Attachments

My company just got a worm. The specific one is beside the point, but I linked a couple pages that I think describe the worm / virus below. We're getting lots of emails to Outlook asking us to open ...
-6
votes
1answer
536 views

Is this email from Liliane Bettencourt a scam? [closed]

I received the following email from someone claiming to be the second-richest woman in the world, Liliane Bettencourt. I, Liliane authenticate this email, you can read about me on: ...
1
vote
2answers
123 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
6
votes
2answers
232 views

Have both my email address and IP been spoofed, or has someone gotten my password, or…?

Just examined a spam email sent to me. The header's "originator" has both my email address and my web site's IP address, (my SMTP). My first thought is that someone has obtained my email password ...
6
votes
1answer
1k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
1
vote
1answer
113 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
-1
votes
1answer
89 views

How is PKI used to encrypt an e-mail for multiple recipients?

My understanding is that when an e-mail is encrypted and sent to a recipient, the recipient's public key is used to encrypt the e-mail, and then only the recipient can decrypt it with their private ...
1
vote
1answer
94 views

Spam Mail - have someone broke in to my shared hosting account? [duplicate]

Yesterday I noticed that one of my e-mail addresses (the only one within that domain) started to receive a lot of weird messages that the mail haven't reach the target (something like "Sorry, Qmail ...
2
votes
2answers
610 views

How to prove someone sent an email to you?

There are similar question about how to prove YOU sent an email, but I want to know if it is possible to prove a 3rd party sent an email to me. An individual sent some very threatening emails to my ...
3
votes
1answer
353 views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
-6
votes
1answer
79 views

Email obfuscation/munging recent research [closed]

Does anyone know of any recent (past year or two) research into email obfuscation/munging? All I can find are tests done five to ten years ago. I'm trying to decide whether it's something still ...
0
votes
1answer
151 views

Security implications for email address and url changes?

recently, we are seeing some From:, To:, Cc: addresses being rewritten from user1@companyA.com to: ...
2
votes
3answers
292 views

Postfix master running as root

Does running /usr/lib/postfix/master as a root could cause a security threat ? A fresh installation, gives this : root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 ...
2
votes
1answer
324 views

Email clients and POODLE vulnerabilities

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client. Could ...
12
votes
2answers
1k views

Should I change phone number and e-mail address after PayPal fraud?

I have been the victim of PayPal fraud. I hadn't used PayPal in a year and then within 9 days there were three unauthorized transactions on my account for a total of 150 Canadian dollars and 290 ...
-1
votes
3answers
713 views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...