Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
2answers
90 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
16
votes
4answers
22k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
1
vote
1answer
28 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
1
vote
1answer
44 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
10
votes
2answers
4k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from example....
11
votes
2answers
669 views

Replay attacks and PGP email encryption

From my understanding of PGP email, the following is possible: Alice sends a message to Bob. Then Bob can take that exact same message and send to Carol while making it seem to Carol like it is from ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
14
votes
3answers
6k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
4
votes
1answer
110 views

“Hacking” account when someone uses your email?

I have, on multiple occasions, received this email from Twitter: Since I have received it multiple times either this person clearly thinks the email is theirs or it's spelled similarly, something to ...
70
votes
12answers
23k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
1
vote
3answers
1k views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
8
votes
3answers
445 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
-6
votes
2answers
746 views

End of mail spoofing?

I've made the simplest e-mail program in C#. using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using System.Text;...
1
vote
1answer
71 views

How does my unused e-mail address get spoofed? [closed]

I have 2 e-mail accounts - one on GMail and other one on a popular mail provider in my country (O2). GMail has a secondary e-mail set for security - that is the O2. I started getting e-mails from ...
1
vote
1answer
39 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
1
vote
1answer
99 views

How to deal with spam that contains my personal details?

I just noticed some spam in my inbox in GMail that is from a very suspicious e-mail address (partially redacted anonymous@webXXXXXXX.ad.aruba.it) containing a link to a similarly suspect URL (http://...
1
vote
5answers
79 views

Using an e-mail service anonymously [closed]

What are the options, to use an e-mail service anonymously without exposing yourself (your private info, name etc.) ?
3
votes
1answer
75 views

How Vulnerable Is An Older Version Of Outlook As An Email Application?

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked ...
3
votes
1answer
117 views

What happens when encrypted email is in-transit?

If you're using a service that offers end-to-end encryption, what happens when you send an email to another non-encrypted email address? Let's say I write my email in ProtonMail and then send it to a ...
3
votes
1answer
181 views

Has my server been compromised? (Ransomware related)

I just received an email that corresponds to the description here, which was posted just a couple of hours ago: https://myonlinesecurity.co.uk/pdfpart2-pdf-sent-from-my-samsung-galaxy-note-4-powered-...
3
votes
1answer
106 views

How does ProtonMail manage search?

There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and sends it encrypted in some fashion (depending on what email service the recipient ...
1
vote
2answers
199 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
3
votes
2answers
149 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
3answers
4k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
3
votes
1answer
49 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
7
votes
3answers
95 views

Best practices for sending tax data to and from a tax professional

I started doing business with my tax preparers when we all lived in the same city. Recently I moved to a different state. I requested that they send my "Tax Organizer" which contains some personal ...
2
votes
4answers
155 views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
4
votes
2answers
100 views

Notifying users of a possible security breach

Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open. I undertook the usual steps to prevent the malware from spreading to ...
4
votes
1answer
168 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
2
votes
1answer
108 views

How does MailChimp authenticate emails?

Keeping it short, MailChimp states that: Authentication Should Be Simple Email authentication is useless if it's too hard to implement. Many email service providers require server setup in ...
2
votes
1answer
117 views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
3
votes
1answer
198 views

Is this encrypted information? Why is it in a URL?

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this: https://...
57
votes
3answers
7k views

Why do email programs block xml files?

A colleague sent a .xml file to me earlier today, which was blocked by Outlook. As we were discussing the workaround (put it in a .zip), we got to wondering why .xml files are blocked. My colleague ...
0
votes
1answer
165 views

Where email orginates [duplicate]

I keep getting emails from an unknown person. In the header file, I see this: authentication-results: spf=softfail (sender IP is 25.152.82.59) smtp.mailfrom=outlook.com; gmail.com; dkim=none (message ...
19
votes
5answers
4k views

Why would someone want to block images in email?

While there is the possibility that this is just to prevent people from viewing offensive images against their will, somehow I don't think that's the reason why pretty much every email client defaults ...
10
votes
3answers
535 views

Email unsubscribe handling security

There is another question with similar title: Unsubscribe safely however my question addresses completely another issue. I am trying to set up a notification system in the website, that will send ...
2
votes
3answers
2k views

Is it possible to block emails (to all email accounts) that contain certain word/phrase patterns?

A friend of mine has been cyber-stalked for 4 years now by an ex-boyfriend. He recently worked out her new job email address (via LinkedIn) and started sending her emails. She told me that the emails ...
20
votes
3answers
3k views

How does a company like CloudFlare block bot crawling and email harvesters?

I saw this on CloudFlares homepage: CloudFlare protects against a range of threats: cross site scripting, SQL injection, comment spam, excessive bot crawling, email harvesters, and more. How ...
21
votes
4answers
3k views

Would 'spam' mail really avoid eavesdropping?

spammimic.com offers a service that 'encrypts' your mail as 'spam', the rationale being that all mail services automatically filter out spam, and so if you're wanting to communicate with someone ...
25
votes
6answers
5k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
1
vote
0answers
158 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
3
votes
4answers
150 views

TLS and e-mail security

Our client has asked us to send sensitive data via TLS and to install a certificate on our mail servers so that they can verify the authenticity of our e-mails. If I understand correctly, TLS ...
3
votes
3answers
69 views

Must mail relays always indicate the use of encryption in the “Received:” header field?

When an email message is sent with transport encryption, you can tell it from the “Received:” field the receiving mail relay adds to the message header. > Received: from [...].google.com ([...]) by >...
0
votes
1answer
253 views

Correct way of dealing with spam via impersonation

I've been having a recurring problem at work: My boss's contacts keep receiving emails with links sent by a fake adress. The adress always has my boss's name + a different domain name every time. ...
2
votes
1answer
58 views

Remembering email in login form

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com. How secure is it? What factors should I ...
1
vote
1answer
72 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...
5
votes
2answers
353 views

Why don't banks sign their email using S/MIME?

If email sent by my bank included S/MIME signatures that my mail client can verify, then I would have the assurance that the mail was not tampered with or sent by some malicious third-party. Most ...
6
votes
1answer
302 views

Bank Has Emailed My Social Security Number

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first ...
0
votes
2answers
59 views

What is the purpose of this “secure mail link open in browser”

I got an email that "supposedly" was secure. It had a link which said that to get secure message follow this link. They could have verified it was me by asking my bank or my smart card to ...
0
votes
2answers
56 views

Using PGP in emails - is there to find the key?

Suppose both the receiver and sender use PGP. Suppose someone send from the sender an email and sent it to the receiver. Now he gets the content of the email at the receiver. Can he know now the keys ...