Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

2
votes
2answers
388 views

How to ensure an email address is not free webmail or ISP address?

I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs: ...
10
votes
3answers
616 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
-1
votes
2answers
115 views

My Email Security is Low

I use Gmail to exchange confidential and important documents with my customers. The documents are read by an unauthorized person (during sending the email) that I don't know him/her. How can I solve ...
0
votes
1answer
202 views

Metadata-free Email: How can SENDER directly, anonymously, and securely ask RECIPIENT’s mail provider to deliver a metadata-free email?

If I want to send emails to friends who use Google, Yahoo, AOL, etc., how can I currently use my local email client to send a metadata-free* email to them? E.g., is it possible to bypass my own mail ...
1
vote
2answers
64 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
1answer
83 views

Getting more users to use PGP [closed]

Does anyone know of browser Plugins that make Composing, sending, and reading email basically effortless? Mailvelope doesn't seem to be working with the floating compose boxes in Gmail currently. ...
0
votes
1answer
64 views

Certificate for Email Encryption and signing

I don't understand the flow of Digital Certificate with Email Encryption and Signing. For Example, There is 2 users, Sender A and Receiver B. Is Certificate required to encryption to A or just ...
2
votes
1answer
657 views

How could someone create a Facebook account with my email address without stealing it?

Someone with the same name as my sister seems to have inadvertently created a Facebook account with her email address. The funny thing is that this person doesn't seem to have ever accessed my ...
0
votes
1answer
745 views

What are the realistic chances of email being intercepted via SMTP/TCP-IP? [closed]

Dear SMTP and TCP/IP network security gurus: I'm curious about what is the realistic risk of sensitive information (such as a email pdf attachment) being intercepted/read by a hostile party from a ...
3
votes
3answers
370 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
2
votes
1answer
87 views

Layered email encryption with multiple private keys on separate media

I'd like to encrypt e-mail messages so that multiple physically separated keys are needed to decrypt them. For example, I'd like to have three private keys stored on different media, as in: key A ...
3
votes
2answers
406 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
0
votes
1answer
476 views

Does Thunderbird send IP address?

I send my gmail emails from thunderbird (on Ubuntu machine). I am wondering whether thunderbird sends out the IP? If so, how can I hide my IP from the outgoing emails?
-3
votes
1answer
62 views

Do corrupted pdfs become a virus?

Can someone let me know if a corrupted pdf if the binary for a virus still exists but the pdf structure is corrupted does it still become a virus when downloaded form email?
1
vote
3answers
176 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
1
vote
1answer
70 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission ...
2
votes
0answers
60 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
0
votes
1answer
150 views

Email hacker, what to do now?

Throughout the past 2 years; I have received email messages (about 6 or 7 cumulative) in which I responded to about 3. Which were personalized messages from a series of 3 email addresses. Nothing ...
2
votes
2answers
332 views

GPG good signature but Warning: untrusted signature

I'm having an issue with some of my clients being unable to open email attachments when I sign the messages. The error they get is something like (free translation): Error: cannot open. The ...
-1
votes
2answers
76 views

encrypted emails and keyservers

I read that encrypted emails are secure, cause only who has your public key can decrypt it. I also read that it's a common thing to upload your public key on a keyserver. But if my encrypted email ...
-2
votes
2answers
178 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
3
votes
1answer
242 views

3000 new contacts being added to gmail after receiving an email

Recently I realized that there are three thousand contacts with same name and email address in my Google contacts. The name belongs to an email that I have recently received and responded to, nothing ...
38
votes
10answers
2k views

Cryptography that looks like ordinary email

I would like to stay out of the automatic filters in place by security agencies and not be accidentally placed on a no-fly list or such. Say I'm having a political debate with a friend about democracy ...
51
votes
4answers
3k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
0
votes
1answer
193 views

Invalid Certificate when adding Gmail account to Apple Mail

Trouble seemed to start after upgrading to OS X 10.9. I stopped receiving email in an account I'd set up over a year ago. I removed the account and when I attempted to add it again, I was served a ...
22
votes
3answers
3k views

What does the email header-line “message opened by mailclient” mean?

Today a Belgian MP claimed (backed up by a security expert) that her email headers show that her email was read during routing (text in Dutch). The published screenshot of the headers highlights the ...
0
votes
1answer
218 views

How do I determine S/MIME encryption used?

From what I understand it seems that S/MIME uses PKCS #7 which can handle various different types of encryption. How is the choice of encryption method made by the e-mail client and how do I know what ...
10
votes
3answers
722 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: ...
1
vote
2answers
645 views

Scan password protected email attachments for malware

We have an email policy that prevents email from going through if it has password protected archive files attached. This is to protect users from viruses and trojans because the contents of the ...
0
votes
1answer
1k views

How to secure my network, laptop, ipad and email accounts which are possibly hacked?

Background Last month I noticed lots of failed emails in my inbox and after few minutes I lost my access to my Yahoo Mail. My friends informed me that they have received spam emails from me. So I ...
4
votes
5answers
1k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
1
vote
1answer
316 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
1
vote
1answer
788 views

How can a gmail recipient open email in two different countries, at the same time?

I sent an email to person in Russia, and tracked it with Right Inbox, when the email is opened I get notified. The problem is I get 2 different IP addresses, one in Russia, and one in the US, both ...
0
votes
1answer
84 views

Would this form of more seamless e-mail confirmation be secure?

When you ned to confirm that an email address belongs to a certain visitor to your site, would it be insecure to do it as follows: When the user visits your site, you give them a session token as a ...
-1
votes
1answer
69 views

What are the security features of the proposed “secure email” from Brazil? [closed]

Brazil has announced that they will create a secure email alternative in light of NSA spy programs. The company Correios will be implementing the contract over the next year or so. What are the ...
2
votes
5answers
1k views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
1
vote
2answers
285 views

Email spam targeted at a pair of users

Two users on my domain are receiving spam emails that have both of their emails in either the To: and/or CC: fields. There are many other users on the domain, but only these two are receiving spam ...
-2
votes
2answers
324 views

gmail account hacking [closed]

I keep getting messages that my sign in to my gmail account has failed. I am not trying to get into my account. I did go in and change my password this morning because of that. What do I do now? I ...
2
votes
1answer
2k views

What is cleardot.gif next to the senders signature in Gmail? [closed]

I am seeing an invisible image called cleardot.gif appearing next to the sender's name at the bottom of their email. (immediately to the right after "Sincerely, [their name"]). It only happens with ...
4
votes
1answer
78 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
1
vote
1answer
241 views

While copying data from any email client to a USB device what residue information is left on the PC?

I often end up using netcafe's for browsing web (Windows 7). I recently wanted to download some secure data from my gmail account on to the USB pen drive. So, I went ahead and opened the attachment ...
5
votes
4answers
8k views

Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses?

Someone has sent a sensitive email from my Gmail account. I wanted to trace the IP address by checking out the Received: by X field in the header of the sent message. However, every message that is ...
5
votes
1answer
251 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
-1
votes
1answer
345 views

Secure Portable Mail Client [closed]

I want to store all my email on a portable client on a USB drive if possible. My aim is to protect the stick with an encryption if possible so that if I remove the USB stick all traces should be gone. ...
3
votes
1answer
508 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
0
votes
2answers
696 views

Safe to email images with personal information? or use encryption for images?

It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit? Regarding plain ...
1
vote
1answer
72 views

Bootstrapping dual SMIME certificates for signing and encryption?

To maintain the non-repudiation property of signing while still having escrow for the encryption key, it's recommended to have a separate certificates (and pub-priv keys) for signing (say CertSign) ...
2
votes
1answer
106 views

It it a good idea to whitelist inbound email using a Hash on the address? (Similar to BATV, but with DKIM)

Problem Statement I'm looking at ways to ensure that business partners, or emails from trusted senders, never get quarantined; ....in other words prevent "ham being seen as spam". Ideally this ...
0
votes
1answer
173 views

email on hosting company's site hacked?

I have a friend who's has a site hosted by a company in the states. They think that someone has gotten access to their email account because any requests for support submitted via their website ...
4
votes
4answers
1k views

What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate ...