Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

4
votes
2answers
173 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
4
votes
3answers
187 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
4
votes
2answers
731 views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
4
votes
5answers
2k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
4
votes
3answers
157 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
4
votes
1answer
238 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
1answer
288 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
4
votes
3answers
1k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
4
votes
5answers
228 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
4
votes
2answers
390 views

What questions should I ask a vendor that provides hosted encrypted email?

I am evaluating a service provider that performs the following functions with email: A user logs in to a web based application over an SSL connection. Email is composed in a web browser over the SSL ...
4
votes
4answers
2k views

Is there any way to set up secure email for Network Solutions domains? [closed]

I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers. I've been talking with Network Solutions' email support people, who will repeatedly state that ...
4
votes
1answer
479 views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
4
votes
4answers
449 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
4
votes
2answers
6k views

is it possible to use smime in the webclient of gmail?

I could not find any options in the webinterface of Gmail. all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
4
votes
1answer
9k views

How do I create a valid email certificate for Outlook S/MIME with openssl?

I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
4
votes
2answers
211 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
4
votes
3answers
753 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
4
votes
1answer
82 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
4
votes
2answers
251 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
4
votes
2answers
155 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
3
votes
4answers
512 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
3
votes
6answers
14k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
4answers
2k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
3
votes
6answers
226 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
3
votes
2answers
1k views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
3
votes
3answers
1k views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
3
votes
3answers
473 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
3
votes
1answer
2k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
3
votes
3answers
355 views

How to know if mail is for tracking our IP

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images. My query is that how can we get to ...
3
votes
2answers
292 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
3
votes
5answers
921 views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
3
votes
3answers
3k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
3
votes
3answers
335 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
3
votes
4answers
2k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
3answers
293 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
3
votes
2answers
892 views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
3
votes
3answers
1k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
3
votes
2answers
68 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
3
votes
2answers
615 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
3
votes
3answers
112 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
1answer
276 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
3
votes
1answer
3k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
3
votes
2answers
275 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
3
votes
1answer
148 views

Why shouldn't I sign my email newsletter using an s/mime email certificate?

I currently offer email subscriptions on my blog, something I coded myself in PHP. People sign up on the blog using their email address. I send them an email with a link to verify their email address ...
3
votes
2answers
455 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
3
votes
3answers
457 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
1answer
954 views

The security of sending emails with SPF/DKIM, but not signed

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM. A few days ago we noticed that they allow any ...
3
votes
2answers
2k views

Send credit card info by email from HTTPS and SMTP on SSL

A client asked me to receive credit card info of his costumers by email. I know that is a very very not secure way ... But if the page with the input form is on HTTPS, and then i use a smtp (like ...
3
votes
1answer
194 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
3
votes
3answers
21k views

Why did secureserver.net (godaddy) access my gmail account? [closed]

Why did secureserver.net (godaddy) access my gmail account? One day later...gmail reports suspicious activity...really? So...Why did secureserver.net (godaddy) access my gmail account? ...