Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
2answers
346 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
3
votes
3answers
107 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
1answer
163 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
3
votes
2answers
527 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
3
votes
1answer
2k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
3
votes
2answers
260 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
3
votes
2answers
116 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
3
votes
2answers
289 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
3
votes
3answers
334 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
3
votes
2answers
1k views

Send credit card info by email from HTTPS and SMTP on SSL

A client asked me to receive credit card info of his costumers by email. I know that is a very very not secure way ... But if the page with the input form is on HTTPS, and then i use a smtp (like ...
3
votes
1answer
174 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
3
votes
3answers
13k views

Why did secureserver.net (godaddy) access my gmail account? [closed]

Why did secureserver.net (godaddy) access my gmail account? One day later...gmail reports suspicious activity...really? So...Why did secureserver.net (godaddy) access my gmail account? ...
3
votes
3answers
94 views

Security of remailers

A layman's question: If I don't err, with remailers or analogous systems one sends a message to a node of a chain of nodes, which collectively perform the entire transmission. However, the message to ...
3
votes
1answer
658 views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
3
votes
1answer
165 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
3
votes
2answers
162 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
3
votes
4answers
2k views

Is there any way to set up secure email for Network Solutions domains? [closed]

I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers. I've been talking with Network Solutions' email support people, who will repeatedly state that ...
3
votes
1answer
95 views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
3
votes
1answer
103 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
3
votes
1answer
81 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
3
votes
3answers
305 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
3
votes
1answer
389 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
3
votes
1answer
145 views

What is the security purpose behind the “enable editing” of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
3
votes
4answers
279 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
3
votes
2answers
4k views

is it possible to use smime in the webclient of gmail?

I could not find any options in the webinterface of Gmail. all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
3
votes
2answers
581 views

Do fake-address generators work?

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
3
votes
1answer
353 views

quizrace.com - Malware or just a game?

This quizrace.com quiz game is spreading like a virus all over internet forums and sites like 4cahn, minecraft etc (just google for it) - because it requires you to invite 3 friends to continue beyond ...
3
votes
2answers
79 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
3
votes
1answer
332 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...
3
votes
2answers
276 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
3
votes
1answer
162 views

Facebook changed the default email address for every contact. How do I mitigate the impact and risk?

Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address. This is an ...
3
votes
2answers
267 views

Securely storing (email) lookup database

Looking for suggestions on implementing a server-side lookup table, where the key is an email address. Goal: Keep these email address private, even if data on the server is stolen. Assumptions: The ...
3
votes
1answer
372 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
3
votes
3answers
171 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
3
votes
1answer
58 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
3
votes
1answer
231 views

3000 new contacts being added to gmail after receiving an email

Recently I realized that there are three thousand contacts with same name and email address in my Google contacts. The name belongs to an email that I have recently received and responded to, nothing ...
3
votes
2answers
187 views

What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?

But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
3
votes
0answers
73 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
3
votes
1answer
162 views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
3
votes
3answers
269 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
2
votes
3answers
495 views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
2
votes
5answers
518 views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
2
votes
1answer
2k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
2
votes
2answers
448 views

Is it a security issue that Thunderbird only logically deletes emails?

I have several e-mail accounts configured in Thunderbird. I just wanted to move an e-mail from one of my e-mail accounts [A] Trash folder to another accounts [B] Inbox folder. Because the moved e-mail ...
2
votes
3answers
6k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
2
votes
3answers
426 views

Security issues with email accounts

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email, There is a ...
2
votes
2answers
181 views

E-mail already in use exploit

I have a registration portal where user inputs his details and then a valid email account. Currently I check the email is not used already and if it is I reply with the classic: "email already in ...