Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
1answer
281 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
5
votes
4answers
669 views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
4
votes
8answers
1k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
4
votes
5answers
982 views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
4
votes
3answers
148 views

How do I recover from an email breach?

I recently reported a religious figure who gave me extended harassment lasting a period of months. Details preferably withheld for now. A few days ago, I noticed something a little bit off from my ...
4
votes
4answers
636 views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
4
votes
4answers
2k views

What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate ...
4
votes
2answers
1k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
4
votes
5answers
236 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
4
votes
3answers
5k views

Suspicious email with my information in it: what do i do?

I just received this email: Billed To: d**********@****.NET John ****** Order Number: M1V62***2711 Receipt Date: 07/12/12 Order Total: $699.99 Billed To: Credit card Item Number Description ...
4
votes
5answers
200 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
4
votes
2answers
401 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
4
votes
4answers
332 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
4
votes
3answers
760 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
4
votes
3answers
448 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
4
votes
3answers
371 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
4
votes
5answers
931 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
4
votes
2answers
188 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
4
votes
3answers
252 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
4
votes
2answers
870 views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
4
votes
1answer
223 views

How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with ...
4
votes
2answers
241 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
4
votes
5answers
2k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
4
votes
3answers
162 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
4
votes
1answer
245 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
1answer
323 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
4
votes
3answers
1k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
4
votes
5answers
240 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
4
votes
2answers
414 views

What questions should I ask a vendor that provides hosted encrypted email?

I am evaluating a service provider that performs the following functions with email: A user logs in to a web based application over an SSL connection. Email is composed in a web browser over the SSL ...
4
votes
1answer
58 views

phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
4
votes
4answers
2k views

Is there any way to set up secure email for Network Solutions domains? [closed]

I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers. I've been talking with Network Solutions' email support people, who will repeatedly state that ...
4
votes
1answer
160 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
4
votes
1answer
1k views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
4
votes
4answers
602 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
4
votes
1answer
68 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
4
votes
2answers
164 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
4
votes
2answers
217 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
4
votes
3answers
1k views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
4
votes
1answer
87 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
4
votes
2answers
291 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
3
votes
4answers
540 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
3
votes
6answers
17k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
4answers
2k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
3
votes
4answers
391 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
3
votes
6answers
237 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
3
votes
2answers
1k views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
3
votes
2answers
320 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
3
votes
3answers
1k views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
3
votes
3answers
555 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...