Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
7answers
2k views

Is PGP combined with a regular web-based email service secure?

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard ...
5
votes
4answers
499 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
5
votes
6answers
21k views

Is update@em.facebookmail.com legitimate?

I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
5
votes
3answers
417 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
5
votes
1answer
234 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
5
votes
2answers
202 views

Potential employer wants me to email my SSN with an application form, is this a major security risk?

I'm job hunting at the moment and I've come across several potential employers that have PDF's that you would download, fill in, and then email to them. I feel EXTREMELY uncomfortable sending my ...
5
votes
1answer
362 views

Is it safe to abandon a free webmail account that has been in use for a significant amount of time?

I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address. I have concerns around accounts that I may have ...
5
votes
1answer
943 views

Thunderbird - what happens if Gmail SSL cert gets spoofed?

I use a good MUA: Thunderbird [to read/reply to my emails on Gmail]. So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails? Questions: ...
5
votes
3answers
6k views

TLS library problem when connecting to Dovecot

I have a Comodo PositiveSSL certificate issued for mail.btcontract.com and I've set up Postfix and Dovecot to work with it in the following way: Postfix main.cf: smtpd_tls_cert_file = ...
5
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
5
votes
5answers
4k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
5
votes
1answer
394 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
5
votes
1answer
133 views

How long can I store personal information on unconfirmed subscriptions?

I have a monthly newsletter. In my subscribe form I use a double opt-in method: The visitor subscribes. I send him a confirmation email. If I receive a reply, I add him/her to my system. In the ...
5
votes
2answers
473 views

Yahoo mail hacked - how to recover, how did it happen and how to prevent?

I was yesterday informed by some friends that they received spam mails with my name as sender. The sender addresses look like firstnamelastname@spacepc.pt and firstnamelastname@revistaplot.com with ...
5
votes
1answer
249 views

Is my ISP trying to impersonate google?

Everything has been well for years and today I wake up with this: A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate ...
5
votes
2answers
687 views

How is ZixCorp able to provide email encryption without a password?

I am trying to understand how/if an email I received is being encrypted. A financial institution sent me a verifiable email (i.e. not phising) asking me to fill out a pdf form to complete a ...
5
votes
1answer
261 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
5
votes
4answers
863 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
5
votes
1answer
12k views

How do I create a valid email certificate for Outlook S/MIME with openssl?

I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
5
votes
1answer
305 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
5
votes
2answers
329 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
5
votes
1answer
152 views
+50

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
5
votes
4answers
1k views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
4
votes
8answers
4k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
4
votes
2answers
3k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
4
votes
5answers
936 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
4
votes
5answers
1k views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
4
votes
3answers
217 views

How do I recover from an email breach?

A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails ...
4
votes
4answers
3k views

What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate ...
4
votes
2answers
1k views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
4
votes
2answers
2k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
4
votes
5answers
245 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
4
votes
5answers
264 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
4
votes
2answers
150 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
4
votes
4answers
232 views

Safe way to communicate IBAN connection

How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
4
votes
5answers
1k views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
4
votes
2answers
607 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
4
votes
4answers
348 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
4
votes
3answers
829 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
4
votes
3answers
531 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
4
votes
3answers
412 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
4
votes
1answer
4k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
4
votes
2answers
222 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
4
votes
3answers
287 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
4
votes
1answer
366 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
4
votes
1answer
43 views

Passive fingerprinting of email client, based on email headers

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? I'm familiar with passive ...
4
votes
2answers
114 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
4
votes
1answer
280 views

How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with ...
4
votes
2answers
279 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...