Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

70
votes
8answers
8k views

Unsubscribe safely

I have heard that is better to never click to any link in an email. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails?
25
votes
3answers
4k views

How can people send me spam emails from the future?

Is this an exploit of the email system of some sort? I receive a great deal of spam every day, and my accounts in Yahoo and Gmail sometimes show me spam emails from the future. Yes, the future. ...
4
votes
4answers
317 views

Safe way to communicate IBAN connection

How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
12
votes
2answers
13k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
2
votes
0answers
37 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
4
votes
3answers
540 views

Using + for email addresses to find out who is selling your data: is it naive or is it effective?

It's pretty common among security-minded folks to fill in addresses using e.g. foo+company@gmail.com when disclosing their email address to company so that they can tell if company has sold their ...
-2
votes
2answers
67 views

Is there any way to formally ensure privacy to my clients by technical means?

Imagine you are a software solutions company. One of the solutions you provide are domains, email and forwarding mail to their Gmail accounts. After we have created a domain and several email ...
2
votes
1answer
54 views

Multiple OpenPGP encryption keys signed by a single certificatation key?

Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
1
vote
1answer
54 views

Resellers and web admins and email privacy

Maybe I'm missing something, but this is "my problem". If you ask some company to create some domain for you and several e-mail account with that domain and forward that information to your gmail ...
5
votes
1answer
375 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
0
votes
1answer
310 views

How dangerous is checking email on open Wi-Fi network

How risky is it to check my email on my smartphone on an open Wi-Fi network (i.e. Starbucks or Old Navy)? Is this only risky if someone is snooping? Do they have to be there, or can they leave a ...
3
votes
1answer
50 views

Question about email app in Python and security

I've managed to get my tiny little app to send an email with a click of a button using this code (this is just the email part): http://pastebin.com/nR5g28ct But to avoid some error, I had to allow ...
2
votes
1answer
52 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
0
votes
0answers
115 views

How can secure email be used while avoiding government attention?

Presumably all unencrypted email is available to federal agencies including IP addresses, header information, and email content (eg, through SMTP with or without SSL and TLS -- thunderbird has an ...
2
votes
3answers
1k views

Tracing an email's MAC address

Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried ...
-6
votes
1answer
136 views

Is Google intercepting my emails? [closed]

I was recently checking my Recent Activity under the "Details" tab inside my Gmail inbox, and I noticed this IP Address, it's not my IP: I proceeded to look up the IP and it's located in Mountain ...
5
votes
2answers
623 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
4
votes
1answer
72 views

How accurate the recent activities location provided by Microsoft emails

One of my emails is on hotmail.com provided by Microsoft. Recently, after few suspicious incidents where my computer was hacked and many other accounts, I changed all my passwords including this ...
32
votes
2answers
3k views

Is email less secure than voicemail, snail mail, or internet portals for transferring sensitive information?

Where I am in the US, health care providers refuse to send anything through email (e.g. even something as trivial as an appointment reminder). Often they claim that email is not secure. Instead they ...
4
votes
3answers
237 views

How do I recover from an email breach?

A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails ...
-1
votes
1answer
63 views

indicators of compromise via email servers

Malicious files are commonly infiltrated on to the network via email attachments. Besides awareness and education to my staff to refrain from clicking on suspicious attachments, I would also like to ...
5
votes
1answer
258 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
8
votes
2answers
5k views

How to prove my Gmail has been hacked?

I believed that someone had hacked my Gmail because they were using information contained within my emails in an attempt to try to convince me that they were psychic. I told them that I didn't believe ...
0
votes
1answer
33 views

Under what circumstance might your email not make to your intended recipient? [closed]

I'm asking because it's one thing to eavesdrop on someone's email, but it's another thing to prevent your email from getting to your recipient. For example, I sent an email to a colleague and he and I ...
3
votes
3answers
181 views

Any Security Risks for using mailto:?

I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format mailto:example@test.com?subject=SEARCHED_QUERY_HERE The ...
13
votes
3answers
18k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
3
votes
3answers
129 views

Email injection in simple terms?

Can someone explain why spammers use email injection? I am a victim and was wondering if there was any other malicious point besides annoying me and filling up my e-mail?
23
votes
4answers
24k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
1
vote
0answers
149 views

Why is my website getting spammed?

Does anyone recognize this type of spam? NAME: Bagas EMAIL: dq95zxm7l@gmail.com PHONE: JCBUIR6ulwtO COMMENTS: I must express apaotcipeirn to the writer for bailing me out of this particular ...
3
votes
2answers
351 views

DMZ and mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
3
votes
1answer
167 views

How was my email intercepted? [closed]

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
4
votes
2answers
191 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
3
votes
1answer
125 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...
-6
votes
2answers
85 views

Is it possible that the person I write to will see the email before I write to him?

Is it possible that the person I write to will see the email's content before I reply to him? If I got an email and I answering that email, is there any feature that can cause my reply to be seen by ...
1
vote
4answers
291 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
123 views

Is thread's auto-login from email implementation secure/good user experience?

As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL. e.g https://www.thread.com/1234logmeintomyaccount-forexample This is a really ...
2
votes
4answers
212 views

What are some ways to spot email spoof attacks?

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are ...
2
votes
3answers
209 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
-3
votes
2answers
78 views

What IP address is a new email account associated with? [closed]

If records are subpoenaed from google will they reveal internal IP or external IP addresses of a email account? For example if an email address is made and an email is sent using and iPad and home ...
5
votes
2answers
386 views

Potential employer wants me to email my SSN with an application form, is this a major security risk?

I'm job hunting at the moment and I've come across several potential employers that have PDF's that you would download, fill in, and then email to them. I feel EXTREMELY uncomfortable sending my ...
4
votes
1answer
3k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
6
votes
3answers
1k views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
3
votes
1answer
289 views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, ...
8
votes
2answers
1k views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
2
votes
1answer
186 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
4
votes
3answers
2k views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
5
votes
5answers
1k views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
0
votes
2answers
456 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
0
votes
2answers
56 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
6
votes
2answers
1k views

Can someone know my IP address through Thunderbird email attachments?

Can someone know my IP address through Thunderbird email attachments? Can a cunning attacker manage to find my IP address through attachment 'images' in emails that I unsuspectingly open?