Related to email protocols, clients, servers, content, and message format.
3
votes
1answer
97 views
If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?
Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
1
vote
2answers
310 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
8
votes
1answer
193 views
PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?
I'm quite new to OpenPGP and am just starting to use it with Thunderbird.
When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
6
votes
3answers
2k views
Is it possible for a phishing link to install a major virus on a Mac?
My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account ...
-1
votes
2answers
169 views
sanesecurity - clamav - getting a false positive - should I bother?
A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
4
votes
4answers
2k views
How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
0
votes
1answer
171 views
TinyDNS and SPF: how to do the '99' records? [closed]
How to do it, the text records are trivial, but how to encode a "99" field in tinydns?
4
votes
5answers
254 views
Is snail mail or HTTPS webmail safer for sensitive information?
I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
17
votes
5answers
852 views
What are the supposed security benefits of a “dead-drop” email strategy?
This was in the news recently. Here's what they were said to have been doing:
Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
2
votes
3answers
268 views
I found a malicious website embedded in Malware spam. What should I do?
An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code.
Who should I report these malicious URLs to? (Microsoft ...
0
votes
3answers
244 views
Petraeus scandal - what would have been a better way to communicate electronically [closed]
Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
2
votes
4answers
640 views
CAPTCHA or email confirmation?
I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
0
votes
0answers
61 views
Email/Secure email sparsing [closed]
I am not an IT professional so please excuse the explanation of my problem:
We are using a CRM software on our server that allows us to email (contact info, notes, etc) directly from the software to ...
3
votes
2answers
167 views
Is my email client violating my privacy?
There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
5
votes
3answers
426 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
4
votes
2answers
92 views
Is DKIM needed for emails encrypted with OpenPGP?
DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.
...
3
votes
2answers
145 views
Shared hosting mail server, Thunderbird and encryption
In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
4
votes
2answers
162 views
How to refuse delivering emails that are not signed by trusted PGP keys?
I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
2
votes
2answers
469 views
Google Mail alert message. Hacker from China
I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China:
IP Address: 117.70.121.33
Location: Xuancheng, Anhui, China
and ...
3
votes
2answers
124 views
What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?
But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
-2
votes
1answer
785 views
Why Gmail logs you out automatically? [closed]
Last few days I have been auto logged out of Gmail. I have not been using any other google related websites on same browser, so there is no chance that I may have logged out from different service.
...
4
votes
3answers
3k views
Suspicious email with my information in it: what do i do?
I just received this email:
Billed To:
d**********@****.NET
John ******
Order Number: M1V62***2711
Receipt Date: 07/12/12
Order Total: $699.99
Billed To: Credit card
Item Number Description ...
0
votes
0answers
23 views
Spoof email, spam and link bait? [duplicate]
Possible Duplicate:
What malicious things can happen when clicking on links in email?
Recently, I have been receiving a couple of SPAM emails seemingly from one of my friends. The email ...
0
votes
0answers
131 views
Roundcube login only looks at first 8 characters of password entered? [closed]
I have two hosting accounts with WebFaction, and I am using RoundCube webmail interface to access my mail that is associated with those accounts. I have multiple mailboxes on both accounts. It seems ...
1
vote
2answers
161 views
AV inserting email header logic
I want to write a small PHP emailing class to be able to send HTML emails. My problem is that in the receiving email an antivirus will insert a header which sometimes simply breaks the entire email.
...
1
vote
2answers
125 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
2
votes
1answer
468 views
Hosted Email Hacked, SQL injection maybe?
I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.
Basically, someone is using my ...
6
votes
3answers
378 views
Is TLS flawless enough to prevent eavesdropping carried out by an ISP?
I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.
Will that prevent ISP and ...
1
vote
3answers
484 views
Email security and Home Mail Servers
Suppose you're truly paranoid (I assume the majority here identify with this?) and you don't want Google or other email service providers reading your email (to serve ads, etc). You don't want your ...
-2
votes
2answers
293 views
Learn IP address of sender of a self-destructing email
How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
3
votes
3answers
723 views
Is there any way to set up secure email for Network Solutions domains?
I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers.
I've been talking with Network Solutions' email support people, who will repeatedly state that ...
4
votes
2answers
231 views
what are some instances of compromises due to email sniffing?
Since emails are usually sent in plain text and bounced through a bunch of SMTP relays it is potentially possible for a well placed attacker to sniff for these and read emails without being able ...
5
votes
1answer
95 views
How long can I store personal information on unconfirmed subscriptions?
I have a monthly newsletter. In my subscribe form I use a double opt-in method:
The visitor subscribes.
I send him a confirmation email.
If I receive a reply, I add him/her to my system.
In the ...
6
votes
5answers
260 views
POP3/IMAP Stronger Authentication
We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access)
Most of the users who have ...
10
votes
5answers
384 views
what would be a good way for a doctor to send xrays encrypted to another doctor?
As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted?
Our organization currently requires that all ...
1
vote
2answers
1k views
Avast says I don't need to use encrypted connections for my e-mail accounts
I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
3
votes
2answers
652 views
I'm currently receiving a targeted attack
Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites:
http ...
3
votes
1answer
124 views
Amavisd-New and Google safe browsing
I am studying the Google Safe Browsing.
How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing?
Do ...
1
vote
3answers
222 views
Instant access to application using token in url
Is it good idea to give access to the site using token in url, this token can be send via email, some sites have reset password done in this way, but I want give access to the whole site (I think I ...
2
votes
2answers
136 views
E-mail Server Security
In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
0
votes
2answers
250 views
Can a man engaged in phishing be prosecuted if I know his IP?
My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
8
votes
4answers
561 views
When registering for most websites, why do you need to confirm your email address?
I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
6
votes
2answers
1k views
secure webmail provider
Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account ...
3
votes
3answers
296 views
How “enforcable” are email disclaimers
Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following:
This email and any ...
3
votes
2answers
728 views
Send credit card info by email from HTTPS and SMTP on SSL
A client asked me to receive credit card info of his costumers by email.
I know that is a very very not secure way ...
But if the page with the input form is on HTTPS, and then i use a smtp (like ...
4
votes
3answers
239 views
Are there any regulations against financial companies storing passwords in plaintext?
A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.
I know this because when you click "Forgot your password?" (or similar) link, it ...
-1
votes
2answers
148 views
What are the security advantage of new redirecting method used by Gmail and Facebook?
When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways.
What are the security advantage of new redirecting method used by gmail and Facebook?
2
votes
4answers
135 views
The email system is compromised - what can you do?
I have a friend at a 7 person company which has an issue with email confidentiality.
Each time they send out an email with quotes to customer, the competitor get the message in 30 minutes and send ...
-3
votes
3answers
2k views
How to trace email?
Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
0
votes
1answer
317 views
Issues with using a mail server that doesn't support authentication to send mail?
I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through.
I understand you easily spoof sender address' in emails, but I'm ...
