Related to email protocols, clients, servers, content, and message format.
2
votes
2answers
117 views
Are these email captchas legitimate?
The last week, I've been getting this kind of emails to addresses that I don't use:
Dear Sir, Madam,
For security reasons and as part of our ongoing fight against spam, it is our policy not ...
-3
votes
3answers
124 views
I use an online email provider - how can I test my password strength?
I want to test my password strength, is there a program out there that can crack my password relatively quickly? I am familiar with BackTrack 5, but I usually use it to test WEP password strength. I ...
1
vote
1answer
185 views
Are there any security issues with importing mail via POP/IMAP?
I'd want to design import mail functionality for an email provider. The process is: user enters email and password for another service at my site and then site accesses another email provider and ...
0
votes
0answers
202 views
What is the most secure way to recover password online? [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I have website which sends generated password to any person who ...
1
vote
3answers
217 views
Recently received a odd email
http://photomi.co.kr/httpcnbc9home-2.com.php?subpage216
Learn How to Make Money 0nline Fast
__________________
. louanne visszakuldod
Sun, 22 Jul 2012 0:33:42
Is there a way to identify what ...
1
vote
2answers
302 views
Is it possible to fake the mail server address?
Suppose that I send an E-mail to someone.
Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I ...
5
votes
4answers
1k views
Can most mail from *.ru be considered spam?
Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).
0
votes
2answers
434 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
2
votes
1answer
337 views
Advice if safe from mail header injection PHP [duplicate]
Possible Duplicate:
PHP mail() Header Injection Prevention
Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
-2
votes
2answers
204 views
End of mail spoofing?
I've made the simpliest e-mail program in C#.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using ...
0
votes
0answers
575 views
how to stop brute force attack to my email server [closed]
I have email server for my office, OS: Fedora12, MTA :sendmail, webmail: squirellmail .
I was accussed of sending spam to others recently .
I found at maillog on my email server , there are someone ...
3
votes
1answer
145 views
Facebook changed the default email address for every contact. How do I mitigate the impact and risk?
Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address.
This is an ...
2
votes
4answers
1k views
If a hacker were to compromise a GMail database
Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database?
I assume nothing, and in order for ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
0
votes
1answer
306 views
What user was this spammer trying to authenticate as?
I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay.
Is it possible to determine what username they are trying to ...
3
votes
3answers
1k views
Delivery Failure Notification spam protection?
My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
1
vote
2answers
307 views
How is mail automatically sent from my account?
Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of ...
1
vote
1answer
175 views
Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?
Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability?
Some definitions to get everyone on the same ...
0
votes
0answers
585 views
Hiding IP address when sending e-mails [closed]
Suppose you have your own domain and send e-mails from there. How and where can you configure to hide your IP address from showing up in the message headers?
Is that something you do at the site you ...
3
votes
2answers
165 views
Securely storing (email) lookup database
Looking for suggestions on implementing a server-side lookup table, where the key is an email address.
Goal: Keep these email address private, even if data on the server is stolen.
Assumptions: The ...
2
votes
1answer
230 views
Is the Netscape SMIME extension still required in a certificate?
Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image)
I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
3
votes
5answers
494 views
Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?
I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
5
votes
6answers
320 views
Spam fighting idea
I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work.
Someone sets up a reputation-based site, much like stackexchange sites, where ...
3
votes
2answers
139 views
Email & Domain ownership?
Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email:
Email address that you can be contacted at. This should be an email address that is not ...
1
vote
2answers
114 views
Which MTA don't have antivirus check for outbound emails?
I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
2answers
187 views
Does selecting different email address rather than info@domain.com help preventing spam mails?
I think when bots gather domain names or they have it since before, they create emails like info@xxx.com or support@xxx.com.
Does selecting something different help to prevent spams? Does it affect it ...
0
votes
0answers
110 views
Email draft was answered without being published [closed]
How can someone read my draft in an email link? Someone answered my draft when it was never posted. Is there software that allows someone on an email link to see drafts or forwards or blind copies?
4
votes
3answers
191 views
Why don't more services offer encryption for email notifications?
I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
2
votes
2answers
224 views
How to investigate possible illegal access by a staff member to emails?
At work we use Outlook 2010 (I think) and an exchange server.
The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
2
votes
2answers
3k views
How commonly are SSL/TLS or S/MIME used by e-mail providers?
I was reading through different posts here about email security. After reading these I still have some questions.
I understand that S/MIME can be used to transfer email securely between servers.
...
9
votes
2answers
965 views
Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use
I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
3
votes
2answers
410 views
Do fake-address generators work?
There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
8
votes
2answers
363 views
Is it bad to only sign some of a domain's emails with DKIM?
Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game?
We use Amazon's Simple-Email-Service for sending e-commerce emails.
We would like to sign these with DKIM.
This same ...
1
vote
2answers
441 views
Open Source tool to block email attachments
Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
2
votes
1answer
336 views
Implementing 2-step verification via email for web apps?
I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
2answers
283 views
If I migrate from dovecot/imaps to exchange will I be less secure?
I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
5
votes
1answer
331 views
The safest way to access GMail on mobile devices
There are three ways to access your GMail account on iPhone or iPad devices:
1. Use safari browser
2. Use Apple's default mail app
3. Use Google's Gmail app
What is the safest way to access gmail ...
1
vote
1answer
565 views
How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses
I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and ...
0
votes
2answers
219 views
Whether PGP is send over MIME?
If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security.
When I send PGP message ...
0
votes
3answers
354 views
Are Facebook, Yahoo, Google, etc. hackable?
Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain.
Since I know a little bit about computers, people automatically assume I know how to have, ...
3
votes
3answers
157 views
Resources/tools for controlling access to corporate email on smartphones
If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone.
For iOS ...
1
vote
1answer
214 views
Does signing my e-mail with DKIM imply non-repudiation for all my users?
Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
5
votes
2answers
205 views
Is it secure to have an “email no longer available” feature on your registration form?
I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
3
votes
4answers
400 views
What Gmail features should be Opted-Out to prevent PII from being indexed?
The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).
Of the free email providers, GMail does support TLS ...
5
votes
2answers
547 views
Is e-mail a direct vector for XSS
I'm curious if there is a way to execute XSS via email.
I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it.
I'm talking about sending an email from ...
3
votes
3answers
6k views
Why did secureserver.net (godaddy) access my gmail account? [closed]
Why did secureserver.net (godaddy) access my gmail account?
One day later...gmail reports suspicious activity...really?
So...Why did secureserver.net (godaddy) access my gmail account?
...
15
votes
5answers
1k views
How does preventing automatic download of pictures help to protect my privacy?
When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email:
"To help protect your privacy, Outlook prevented ...
4
votes
2answers
501 views
If I send an email over SSL, will it always be transmitted over SSL?
This is largely a question of how MTAs and different components communicate.
I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure?
...
2
votes
2answers
169 views
Is it unsafe to allow apps other than Outlook to send email via the Exchange server?
My application is a .NET Windows Forms client, one of whose functions is to allow the user to send personalised mailshot emails to opted-in recipients stored in the database.
The emails are sent ...
2
votes
1answer
256 views
Possible Hijacked Email Server [closed]
MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server.
Our email server is a Virtual FreeBSD box hosted by Verio. Their ...
