Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

13
votes
5answers
3k views

When registering for most websites, why do you need to confirm your email address?

I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
13
votes
1answer
2k views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
13
votes
2answers
6k views

Paypal Account created using my gmail account

Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her. I noticed that, removed the forward and changed the password. Now, I ...
12
votes
3answers
5k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
12
votes
7answers
26k views

Can my email account be accessed without the password? How secure is it?

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it? And how come Yahoo Mail asks me to tell them my friends and folders names to ...
12
votes
6answers
2k views

Identity-Based Encryption - how secure is it?

I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm. I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
12
votes
2answers
1k views

Should I change phone number and e-mail address after PayPal fraud?

I have been the victim of PayPal fraud. I hadn't used PayPal in a year and then within 9 days there were three unauthorized transactions on my account for a total of 150 Canadian dollars and 290 ...
12
votes
3answers
17k views

Is a password protected PDF file safe for bank statement attachments?

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
12
votes
3answers
2k views

Is it bad to only sign some of a domain's emails with DKIM?

Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game? We use Amazon's Simple-Email-Service for sending e-commerce emails. We would like to sign these with DKIM. This same ...
12
votes
3answers
7k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
12
votes
3answers
1k views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
12
votes
3answers
1k views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
12
votes
3answers
509 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
11
votes
3answers
12k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
11
votes
5answers
919 views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
11
votes
3answers
10k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
11
votes
3answers
778 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
11
votes
1answer
2k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
11
votes
3answers
356 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
10
votes
5answers
870 views

Is there any security benefit of not using email services recently associated with PRISM?

After the recent disclosure of several major email providers cooperating with NSA, is there any real security benefit of not using these email services and choose some alternative instead? Such as ...
10
votes
3answers
736 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: ...
10
votes
5answers
14k views

Can the recipient of my emails know my IP address?

When I send out emails using gmail, is my IP address being recorded? can the recipient of my gmail message knows my IP address and thus infer where I am located?
10
votes
4answers
4k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
10
votes
2answers
467 views

Is email more secure when not letting any zipped content through?

Ah. This is a bit of a soft question, but I though there might be some here that can share some insight. I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
10
votes
2answers
3k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
10
votes
2answers
10k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
9
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
9
votes
4answers
5k views

Why is it even possible to forge sender header in e-mail? [duplicate]

With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the ...
9
votes
3answers
415 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
9
votes
3answers
2k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
9
votes
5answers
2k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
9
votes
4answers
681 views

How to ensure account security when accessing emails when overseas?

First of all, I hope this is the right stackexchange to ask this. Seems to be most relevant here. Now, if one is planning to go overseas and he/she has a lot of data on the email account (say, gmail) ...
9
votes
4answers
3k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
8
votes
6answers
4k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
8
votes
2answers
4k views

How to prove my Gmail has been hacked?

I believed that someone had hacked my Gmail because they were using information contained within my emails in an attempt to try to convince me that they were psychic. I told them that I didn't believe ...
8
votes
3answers
576 views

Does OpenPGP encryption mean that not even I can see my data?

Say I have an email and I want to send it to someone else. I encrypt it with his public key. This ensures that only he can read my message. Does this also means that I won't be able to read it? If so, ...
8
votes
1answer
5k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
8
votes
6answers
672 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
8
votes
5answers
758 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
8
votes
2answers
286 views

How to safely display html emails like gmail does it?

I'm building a webmail, which must be able to display html emails. But how to prevent xss and similiar attacks, while not loosing html formatting? In gmail, when I receive some emails from, lets say, ...
8
votes
6answers
1k views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
8
votes
2answers
587 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
8
votes
2answers
1k views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
8
votes
1answer
475 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
8
votes
4answers
5k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
8
votes
3answers
2k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
8
votes
1answer
1k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
7
votes
5answers
4k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
7
votes
3answers
522 views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
7
votes
6answers
6k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system ...