Related to email protocols, clients, servers, content, and message format.
25
votes
4answers
1k views
If email is insecure, why do we use it for password resets?
I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application."
But then it struck me, Why is email considered insecure? If it is so insecure, why ...
-1
votes
1answer
99 views
E-mail with obfuscated code / no trace in e-mail server
I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
2
votes
3answers
147 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
1
vote
2answers
186 views
Can you crack a Mailinator “Alternate Inbox Name?”
From their FAQ:
What are "Alternate Inbox Names" ?
There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
1
vote
3answers
313 views
Will SHA1 of Email Addresses Always be Unique?
We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address.
Storing a SHA1 of their ...
5
votes
4answers
806 views
Reporting a GMail hacker attack
This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on ...
1
vote
1answer
179 views
Any recipient can modify an order confirmation mail, right? Does this ever matter ?
I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground.
Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
2
votes
1answer
211 views
Email Compromised due to Yahoo Mail Exploit
On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
7
votes
1answer
122 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
3
votes
3answers
250 views
Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?
I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
8
votes
5answers
319 views
E-mail can be made to appear like it came from a big organization?
I know almost nothing about security. So, please bear with me if the questions sound silly.
Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
1
vote
2answers
251 views
How can hotels securely receive your credit card details (for a custom, one-off payment)?
A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email.
I have negotiated a deal for accommodation with ...
6
votes
5answers
375 views
How do spammers verify the validity of a huge amount of email addresses?
I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server.
But for this method, the MX server may abort connection after ...
3
votes
3answers
90 views
Are mail-servers removed from security concerns in contrast with cloud storage?
I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
4
votes
4answers
157 views
Secure file sharing, instead of attaching files to emails?
Allow me to give a background, so you may understand my situation better.
We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only ...
-1
votes
1answer
739 views
how to trace the IP address of gmail account sender via browser [duplicate]
Possible Duplicate:
How to trace email?
i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below
Analysis:
Received: from ...
2
votes
3answers
146 views
PCI Compliance Problem
My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
1
vote
6answers
2k views
Possible ways to track down anonymous mail senders?
In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things
...
3
votes
1answer
336 views
Is using Gmail's browser-based client, more secure than using IMAP?
I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string)
...
2
votes
1answer
88 views
Encoding HTML email content
Say I have a form on my website.
The input elements of the form are: email address, name and some feedback textarea.
The server-side application that this form is submitted to will send an HTML ...
1
vote
2answers
81 views
access to email adresses
I am taking part in an online voting photo contest. In order to vote, you have to register using your email address.
Is it possible that people who run the site will be able to see my email address ...
5
votes
4answers
201 views
HOWTO : Email encryption in a browser
I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing.
In my quest for learning how to use gmail/hotmail to send and ...
5
votes
4answers
164 views
Securely publishing GPG keys
This is probably a stupid question/vaguely defined, but I need to ask it anyway.
I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
9
votes
6answers
369 views
Security of email [duplicate]
Possible Duplicate:
How commonly are SSL/TLS or S/MIME used by e-mail providers?
Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob.
Alice goes to gmail ...
-1
votes
2answers
101 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
3
votes
1answer
97 views
If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?
Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
1
vote
2answers
307 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
8
votes
1answer
192 views
PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?
I'm quite new to OpenPGP and am just starting to use it with Thunderbird.
When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
1
vote
1answer
205 views
Fake email sent through newsletter service: how to know who sent them?
Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
6
votes
6answers
828 views
How can I send emails anonymously?
How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
-1
votes
2answers
166 views
sanesecurity - clamav - getting a false positive - should I bother?
A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
0
votes
1answer
167 views
TinyDNS and SPF: how to do the '99' records? [closed]
How to do it, the text records are trivial, but how to encode a "99" field in tinydns?
4
votes
5answers
252 views
Is snail mail or HTTPS webmail safer for sensitive information?
I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
0
votes
3answers
244 views
Petraeus scandal - what would have been a better way to communicate electronically [closed]
Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
17
votes
5answers
847 views
What are the supposed security benefits of a “dead-drop” email strategy?
This was in the news recently. Here's what they were said to have been doing:
Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
0
votes
0answers
61 views
Email/Secure email sparsing [closed]
I am not an IT professional so please excuse the explanation of my problem:
We are using a CRM software on our server that allows us to email (contact info, notes, etc) directly from the software to ...
3
votes
2answers
167 views
Is my email client violating my privacy?
There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
4
votes
3answers
135 views
Allow a PA to see a director's emails, but keep some emails private
We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows:
Director A wants to send an email to Director B, both director A and ...
4
votes
2answers
91 views
Is DKIM needed for emails encrypted with OpenPGP?
DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.
...
3
votes
2answers
123 views
What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?
But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
2
votes
2answers
468 views
Google Mail alert message. Hacker from China
I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China:
IP Address: 117.70.121.33
Location: Xuancheng, Anhui, China
and ...
1
vote
2answers
88 views
Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?
Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination.
If we disable the account prior to wiping the device (or the device receiving the wipe ...
-2
votes
1answer
738 views
Why Gmail logs you out automatically? [closed]
Last few days I have been auto logged out of Gmail. I have not been using any other google related websites on same browser, so there is no chance that I may have logged out from different service.
...
0
votes
0answers
23 views
Spoof email, spam and link bait? [duplicate]
Possible Duplicate:
What malicious things can happen when clicking on links in email?
Recently, I have been receiving a couple of SPAM emails seemingly from one of my friends. The email ...
0
votes
0answers
129 views
Roundcube login only looks at first 8 characters of password entered? [closed]
I have two hosting accounts with WebFaction, and I am using RoundCube webmail interface to access my mail that is associated with those accounts. I have multiple mailboxes on both accounts. It seems ...
3
votes
3answers
246 views
I stupidly responded to an email from a hacker posing as a friend
I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
3
votes
2answers
144 views
Shared hosting mail server, Thunderbird and encryption
In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
1
vote
2answers
123 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
2
votes
1answer
465 views
Hosted Email Hacked, SQL injection maybe?
I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.
Basically, someone is using my ...
