Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

7
votes
2answers
367 views

Is a mail secure if it's PGP-encrypted, but unsigned when sent with DKIM?

I run my own mail server and would like to use different addresses on the same domain. If I were to sign mails from those addresses, I'd have to generate new PGP keys for each and every one of them. ...
3
votes
1answer
130 views

mailto email headers trace IP

So I'm working on a defamation case. So I will make a little overview of what is going on. The person we are trying to trace is using a site like kijiji. Tomorrow I am heading to the so said kijiji ...
1
vote
1answer
160 views

how to track IP address from which mail has been sent?

I am from India. I have get few mails from some random Gmail ID. How to get the information from which IP address it has been sent ?
6
votes
1answer
803 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
3
votes
2answers
193 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
0
votes
1answer
45 views

What information should be scrubbed before posting email headers in public?

To figure out a problem, I need to post mail headers on a public forum, I read What information can be gained from an Email Header? but I'm not sure what information can identify me personally from ...
5
votes
2answers
255 views

Is it possible to infect an e-mail by accident?

Sometimes, my friends send me e-mails. I know that they don't care that much about computer security (while I care). I know that they don't know how to create an infected e-mail (no reason for doing ...
2
votes
1answer
49 views

Can spambots access pages available to only registered, authenticated users?

I have a web application where users register and are activated via an email sent to the email address they supplied. Then there are pages that are only visible to registered users (non-user access ...
2
votes
2answers
121 views

TLS capable SMTP store-and-forward server — does it have to store private keys?

I know that email is inherently insecure anyway, but considering that pretty much everyone that I send email to is using a large, somewhat-trusted cloud provider, (hint, starts with G) I would expect ...
-1
votes
1answer
74 views

Server is Sending Spam

I have determined that my server is compromised because it is sending spam (from one of my legitimate addresses). How can I determine what's compromised? Does the attacker know my SSH password? ...
1
vote
1answer
55 views

What is a viable time-frame for links that expire? [closed]

Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable time-...
0
votes
1answer
238 views

Correct way of dealing with spam via impersonation

I've been having a recurring problem at work: My boss's contacts keep receiving emails with links sent by a fake adress. The adress always has my boss's name + a different domain name every time. ...
0
votes
1answer
50 views

User account password encyption by web based emails service providers?

Do web based email providers like Gmail, hotmail encrypt user account passwords when saving them to their database? If they do, why does account information get leaked after a hack?
1
vote
2answers
105 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
1
vote
2answers
211 views

A secure alternative for e-mail

I am looking for an alternative for my current e-mail provider (gmail). I would like to gain back a little bit more "privacy" on the internet. I would like the following things: The e-mails I send ...
-4
votes
1answer
181 views

What is the purpose of viagra spam? [closed]

We all have gotten them: The reflection of your size will stay forever in her eyes. Bigger pen!s gives you a bunch of benefits! I have girls that ring me for sex now, its amazing! Judging by ...
5
votes
5answers
3k views

Security of faxes vs emails

Background The other day a friend who works in healthcare asked me which method of communication was more secure, faxing or email. He qualified his question by saying that his office faxes patient ...
0
votes
1answer
69 views

Is it possible to forge email info in header?

I recently received an email from a guy making me a job offer for a big government company and stating that he works there. However instead of using the domain of the company, he is using GMail. ...
5
votes
1answer
3k views

Gmail may be hacked - bulk spam emails being sent FROM Google apps account

I have a Google Apps email (Gmail with my own domain) - let's call it John@example.com. 3 days ago many people in my address book were sent a spam email FROM my John@example.com account. When I ...
0
votes
1answer
48 views

Changing senders, same spam messages

We have a situation at work regarding to our mail filtering appliance and I was hoping that you could give us some insight on how to approach this issue. We've been receiving spam emails with the ...
3
votes
2answers
857 views

PayPal “Confirm your email address” spam emails? I got 3 different mails within 10 hours

I got 2 emails within 12 hours containing the following: Confirm your email address Hello [Name] [Name], Confirm your email address now to let us know it really belongs to you. Once ...
4
votes
1answer
64 views

Implemented DMARC, getting reports of canonical.com sending spam - has Ubuntuone been hacked?

I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender: >record> >row> >source_ip>91.189.90.7>/source_ip> >count>...
-1
votes
3answers
111 views

Are 21 characters enough to restore a PGP key?

The german e-mail hoster web.de offers PGP encryption with Mailvelope now. To transfer your private key to another browser, you can use a 21 characters long recover key. How does this affect the ...
0
votes
1answer
65 views

Does a 'mailto:' hyperlink spoil any preceding email obfuscation efforts in PDF?

Assume there is a PDF file which contains the example@example.com email address as an image (the classic obfuscation method). However, what if this image is made clickable with a hyperlink which ...
-1
votes
1answer
511 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| http:/...
0
votes
1answer
64 views

How much information, at maximum, can a phisher/scammer obtain?

My iPhone was recently stolen and since then I've been receiving messages and emails saying that 'a sound was played on your iPhone' or 'your iPhone was found. Visit here to confirm your location'. ...
3
votes
2answers
143 views

activate user account through email

I see a lot of people say to hash for the token on email verification when dealing with member registration. I am wondering, if the email token is only to activate the account and nothing else, ...
1
vote
2answers
102 views

How to prevent phishing mails from being successful? [duplicate]

I'd like to know what the best methods are to prevent success of phising mails. This question contains the following subquestions: What are the best ways to determine incoming phising mails (on a ...
6
votes
1answer
2k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
-3
votes
1answer
110 views

How to sell a new idea – “100% secure communication”, feedback wanted [closed]

I have thought of an idea (new product) to have 100% secure communication between 2 parties and would like your feedback/ideas on how to sell it. Oh, before you start that there is no such thing as ...
5
votes
2answers
125 views

Should I be worried if somebody uses my email to sign up for accounts?

I recently received e-mails from two services: Paytm and Uber. They both seem like legitimate services. However I have no idea why I received these e-mails or why somebody would want to create an ...
2
votes
2answers
284 views

Using email as individual validation

My company often sends orders to brokers and banks to execute certain actions (like buying x stock or y fund). In order to reduce bureaucracy we are considering send a list of emails that are allowed ...
2
votes
1answer
169 views

E-Mail made in Germany. Better than traditional ones like Google or Yahoo? [closed]

A friend of my mine who lives in Germany called my attention to a so called "E-Mail made in Germany" (EMiG). Since the country is well known for exporting high quality products, I decided to take a ...
2
votes
3answers
80 views

Dedicated domain for email registration

With the recent surge in compromised user information on web services, I have the following solution in place for myself: Registered a domain with an obscure domain name. (actually a bunch) One ...
58
votes
6answers
14k views

Is gmail-to-gmail still insecure? Why?

I have always heard that email is an insecure method of communication; I assume this has something to do with the email protocol itself. But when sending an email from one gmail account to another, ...
-2
votes
1answer
106 views

Self-Destructing Emails [duplicate]

So I just recently started reading into Self-Destructing emails trying to learn how they work but I am unable to find much relevant, technical information. I'd like to know exactly how this works ...
2
votes
1answer
292 views

Reasons why there are no web based unified email clients (with OAuth2)?

There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
3
votes
2answers
93 views

Email security on a Windows phone

Let's say I set up a Microsoft account on a Windows phone and use the associated built in email client. If I send an email, would it be send in plaintext. On wifi, if someone is sniffing the traffic, ...
1
vote
0answers
253 views

USA PATRIOT Act and Office 365

I have a local Exchange server, which has several spam and email reception issues (Due to an expired subscription to a spam filtering system). I was looking at the Office 365 Exchange Online ...
3
votes
1answer
83 views

Is it a bad idea to forward a suspicious email with an attachment - even to a secure address for analysis?

The more servers the message passes through the more potential of the attack to execute successfully? (0-day etc). Or is this paranoia? Instead: Delete, disconnect from network, and phone security ...
3
votes
2answers
203 views

Is it appropriate to block a sender's email address

This morning I received a mail from Apple suspension UK <do_not_reply@apple.co.uk> with the subject Apple "Unauthorised transaction alert". The mail was sent to one of my company's distribution ...
4
votes
3answers
225 views

Would trolling the people behind scams help decrease scamming? [closed]

It is easy for smart people to identify scams. This isn't an accident, phishers want stupid people. Sending the emails is the easy part, getting their money is what takes effort. My question is, ...
13
votes
3answers
948 views

Why is encryption (or signing) of long lines in E-Mails with PGP problematic?

I am using Thunderbird with Enigmail and OpenPGP to encrypt and/or sign E-Mails. On many occasions Enigmail complains that I have too long lines in the mail and asks how it should wrap them. However ...
4
votes
1answer
130 views

Passive fingerprinting of email client, based on email headers

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? I'm familiar with passive ...
64
votes
2answers
10k views

What is the purpose of these weird non-spam emails?

A mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ... =EA=85=9F =EA=8F=...
7
votes
2answers
7k views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
0
votes
2answers
108 views

LAMP MailServer without SSL… so what's the problem?

I want to set up a MailServer on Ubuntu for my website, and access the email from my POP3 client without enabling SSL encryption (I suppose the SSL is used to encrypt the password?). My questions are:...
27
votes
3answers
4k views

How can people send me spam emails from the future?

Is this an exploit of the email system of some sort? I receive a great deal of spam every day, and my accounts in Yahoo and Gmail sometimes show me spam emails from the future. Yes, the future. ...
2
votes
0answers
39 views

How should end users respond to Earthlink's “Allowed Sender” feature when blocked by policy?

Some of our users are requested to click on an Earthlink antispam URL below https://webmail.pas.earthlink.net/wam/addme?a=USERNAME@earthlink.net&id=<SOME GUID> However our firewall ...
-2
votes
2answers
69 views

Is there any way to formally ensure privacy to my clients by technical means?

Imagine you are a software solutions company. One of the solutions you provide are domains, email and forwarding mail to their Gmail accounts. After we have created a domain and several email ...