Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
4answers
337 views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
1
vote
4answers
176 views

Hashing Email Address and Contacting User

I am thinking about a log-in web service that would store a users username, password, and (optional) email address. If they forget their username or password, they can have their username and a ...
0
votes
0answers
18 views

Should an SMIME signing and encryption key have different expiration dates?

Assuming the client supports different keys, what is some rationale that should be considered for signing and encryption keys? For example, since the encryption key needs to be present on each device ...
0
votes
2answers
49 views

Is it secure to use email to add content to a website?

I have a website running a social network Buddypress. Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without ...
2
votes
4answers
144 views

safe way to communicate IBAN connection

how do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
0
votes
2answers
93 views

OWA + AD Lockout Policy: Quite the Mixture

Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would ...
1
vote
1answer
101 views

Is winmail.dat a malware propagation vector?

Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
0
votes
1answer
134 views

Can malware be activated by previewing email in Outlook's Preview pane?

It is common advice to not open suspicious email in order to avoid being infected by malware contained in the email. What constitutes opening an email in Outlook? Specifically, is viewing an email in ...
2
votes
1answer
146 views

Where do I report a friend's email account that has been hacked?

I just received an email from a friend's email account that conforms with the standard hoax where the person says they are traveling, have been robbed, and need money to pay for the hotel bill to get ...
1
vote
2answers
145 views

Are file attachments “unsafe”?

The management at work are asking, "How can we send files easily and safely to each other?", arguing that: Putting attachments in email is not safe. They want to send links instead They want to ...
16
votes
4answers
4k views

How can I protect against email tracking services?

Recently a free service came out for email tracking, bananatag. It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
0
votes
1answer
51 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
3
votes
1answer
207 views

Flood of email messages from @attacker.com

I've been getting the weirdest email messages for the last 2 days on my personal gmail inbox. On May 28th, exactly at 4:33 pm BRST I got about 2,000 emails that look exactly the same, here's the ...
2
votes
0answers
19 views

Email, Certificates and DANE

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
1
vote
1answer
72 views

What is the mechanism for this user impersonation?

I'm trying to understand how this user impersonation might have taken place. Here's the scenario: Our controller got a call from our bank this morning about a suspicious wire transfer request. After ...
1
vote
2answers
2k views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
0
votes
1answer
45 views

Email and Black Hole List Submission?

I'm having trouble with a spammer and would like to begin submitting their messages to a few black hole lists. Unfortunately, I'm having trouble finding a list. For example mail-abuse.org now ...
7
votes
6answers
913 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
4
votes
3answers
704 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
2
votes
2answers
118 views

Does having a separate e-mail account only for security, increase security?

In this article about increasing the security of LastPass the author suggests: For additional security, you can have LastPass send security-related emails to a special security email address ...
10
votes
7answers
5k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
2answers
686 views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
7
votes
2answers
6k views

Malicious users trying to create yahoo accounts with random emails at my domain?

Recently, I have been getting a string of emails from yahoo with people trying to create accounts or add email addresses @mydomain.tld to their account. I was wondering if anyone else has seen this ...
1
vote
2answers
386 views

Does gmail's TOS allow Google to steal your emailed ideas?

Is it unwise to use gmail to discuss business ideas that Google could snoop on and use to their business advantage? I know that email is not secure and anyone could read it along its path of ...
4
votes
3answers
187 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
1
vote
1answer
140 views

My server was used for sending spam. Will our server ever be trusted again?

A while back I enabled SMTP on my IIS server with the intention of using it for internal email notifications. It seems that somehow hackers were able to use it for sending out thousands of spam ...
1
vote
1answer
167 views

Postfix periodic relay access denied

I administer an Ubuntu Server 14.04 which acts as a mail server running Postfix and was configured following most parts of this tutorial: ...
2
votes
1answer
107 views

Analyzing a suspicious email

Today I received a very suspicious email on my gmail account. When I analyzed the content of the message, this is what essentially made up the message. <center> <a alt="" ...
1
vote
1answer
69 views

Is there any security benifit to sent email message only as attachement?

A well known company in Oil and Gas field, sends the email message as PDF attachment, with brief explanation, here is an example: Dear Mr Name, Please review the attached document acknowledging ...
2
votes
1answer
4k views

Yahoo Account hacked, changed pw, spam still going out elsewhere?

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts. I changed the password, then saw (via rejected emails sent to my Yahoo ...
42
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
3
votes
2answers
623 views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
0
votes
1answer
213 views

Email Spoofing Modified Headers

I have be reading more and more about email spoofing and was curious how some things are done. I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
2
votes
1answer
140 views

Should my company have an SSL on our email

We have a new IT guy that insists we do not need an SSL on our email. Quite a few people access their email from outside our office(network) via mobiles and home computers, often from WIFI ...
-1
votes
2answers
123 views

What are the security risks for a business that has an insecure email system [closed]

For instance if the email system uses POP3 legacy protocol and SMTP but is not encrypted, yet the business continues to use it for daily purposes both internally and externally, what could be the ...
2
votes
1answer
444 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
-9
votes
2answers
122 views
0
votes
1answer
58 views

IP Address Same on Different Devices? [closed]

The IP address appears to be the same in the e-mail header even when e-mail is sent from different devices. Shouldn't the IP address reflect the device IP? The e-mail is set up through an exchange ...
3
votes
3answers
457 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
3answers
1k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
0
votes
2answers
40 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
3answers
55 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
1answer
80 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
3answers
801 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
2
votes
1answer
77 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
3answers
100 views

How can get email about latest vulnerabilities [closed]

Today my friend got email for the latest vulnerablility heartbleed. But i could not find where i can subscribe so that i can also get emails about latest vulnerabilities Can anyone please help me ...
0
votes
1answer
104 views

Email hacking/masking prevention

Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it. When I look at the ...
0
votes
2answers
304 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
63
votes
12answers
21k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...