Related to email protocols, clients, servers, content, and message format.
2
votes
1answer
85 views
How to determine source of e-mail and verify if the source is/could be legitimate?
I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
2
votes
1answer
339 views
Advice if safe from mail header injection PHP [duplicate]
Possible Duplicate:
PHP mail() Header Injection Prevention
Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
2
votes
1answer
794 views
My S/MIME certificate (created with OpenSSL) does not match my email address
I created a certificate with OpenSSL and following commands:
openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem
...
2
votes
1answer
202 views
Is the Gmail activity log still missing activesync?
Is the Gmail activity log still missing activesync as described in this blog post?
As it is "someone with my credentials could be reading and sending [email] messages with my account" without that ...
2
votes
4answers
212 views
Should links to images contained in emails be secure?
We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc...
What are the security pitfalls if these links in the emails ...
2
votes
1answer
232 views
Is the Netscape SMIME extension still required in a certificate?
Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image)
I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
2
votes
2answers
172 views
Is it unsafe to allow apps other than Outlook to send email via the Exchange server?
My application is a .NET Windows Forms client, one of whose functions is to allow the user to send personalised mailshot emails to opted-in recipients stored in the database.
The emails are sent ...
2
votes
1answer
244 views
Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?
Our company policy is requires the local encryption of data for all email (in case the device is stolen)
Does the Windows Surface (either version) support local encryption?
Is the local device ...
2
votes
4answers
145 views
Open an e-mail account from only one particular system?
Is there a way to configure e-mail so that it can only be opened from one particular system? Or from multiple systems having some sort of unique key or particular static IP?
2
votes
1answer
90 views
Encoding HTML email content
Say I have a form on my website.
The input elements of the form are: email address, name and some feedback textarea.
The server-side application that this form is submitted to will send an HTML ...
2
votes
1answer
468 views
Hosted Email Hacked, SQL injection maybe?
I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.
Basically, someone is using my ...
2
votes
1answer
2k views
How do I create a valid email certificate for Outlook S/MIME with openssl?
I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
2
votes
1answer
347 views
Implementing 2-step verification via email for web apps?
I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
2
votes
2answers
225 views
How to investigate possible illegal access by a staff member to emails?
At work we use Outlook 2010 (I think) and an exchange server.
The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
2
votes
0answers
38 views
Is it the default in billing systems to send out the users password by email? [duplicate]
I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk.
One of their employees responded with ...
2
votes
0answers
109 views
User friendly PGP email [closed]
Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience?
Generate new key at first startup, rather than asking the user if they have an ...
1
vote
6answers
2k views
Possible ways to track down anonymous mail senders?
In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things
...
1
vote
2answers
400 views
Is it a security issue that Thunderbird only logically deletes emails?
I have several e-mail accounts configured in Thunderbird. I just wanted to move an e-mail from one of my e-mail accounts [A] Trash folder to another accounts [B] Inbox folder. Because the moved e-mail ...
1
vote
5answers
219 views
How can I prevent forwarding a manipulated email?
How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
1
vote
2answers
192 views
Does selecting different email address rather than info@domain.com help preventing spam mails?
I think when bots gather domain names or they have it since before, they create emails like info@xxx.com or support@xxx.com.
Does selecting something different help to prevent spams? Does it affect it ...
1
vote
2answers
506 views
What are some secure methods of sending email from your server?
This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have ...
1
vote
3answers
217 views
Recently received a odd email
http://photomi.co.kr/httpcnbc9home-2.com.php?subpage216
Learn How to Make Money 0nline Fast
__________________
. louanne visszakuldod
Sun, 22 Jul 2012 0:33:42
Is there a way to identify what ...
1
vote
1answer
180 views
Any recipient can modify an order confirmation mail, right? Does this ever matter ?
I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground.
Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
1
vote
2answers
117 views
Which MTA don't have antivirus check for outbound emails?
I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
3answers
322 views
Will SHA1 of Email Addresses Always be Unique?
We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address.
Storing a SHA1 of their ...
1
vote
2answers
270 views
How can hotels securely receive your credit card details (for a custom, one-off payment)?
A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email.
I have negotiated a deal for accommodation with ...
1
vote
3answers
484 views
Email security and Home Mail Servers
Suppose you're truly paranoid (I assume the majority here identify with this?) and you don't want Google or other email service providers reading your email (to serve ads, etc). You don't want your ...
1
vote
3answers
183 views
Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?
Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works.
I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
1
vote
1answer
1k views
What algorithm/encryption type does Gmail use for security?
In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
1
vote
3answers
222 views
Instant access to application using token in url
Is it good idea to give access to the site using token in url, this token can be send via email, some sites have reset password done in this way, but I want give access to the whole site (I think I ...
1
vote
2answers
306 views
Is it possible to fake the mail server address?
Suppose that I send an E-mail to someone.
Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I ...
1
vote
3answers
276 views
Emails wrongly flagged as spam by filter, claiming suspicious URLs
My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the ...
1
vote
2answers
310 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
1
vote
2answers
445 views
Open Source tool to block email attachments
Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
1
vote
2answers
284 views
If I migrate from dovecot/imaps to exchange will I be less secure?
I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
1
vote
2answers
81 views
access to email adresses
I am taking part in an online voting photo contest. In order to vote, you have to register using your email address.
Is it possible that people who run the site will be able to see my email address ...
1
vote
1answer
215 views
Does signing my e-mail with DKIM imply non-repudiation for all my users?
Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
1
vote
3answers
518 views
OWA Keep-Alive in http, even though it should be forced https
Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
1
vote
3answers
127 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
1
vote
2answers
195 views
Can you crack a Mailinator “Alternate Inbox Name?”
From their FAQ:
What are "Alternate Inbox Names" ?
There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
1
vote
2answers
125 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
1
vote
2answers
1k views
Avast says I don't need to use encrypted connections for my e-mail accounts
I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
1
vote
2answers
161 views
AV inserting email header logic
I want to write a small PHP emailing class to be able to send HTML emails. My problem is that in the receiving email an antivirus will insert a header which sometimes simply breaks the entire email.
...
1
vote
1answer
74 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
1
vote
1answer
367 views
is it possible to use smime in the webclient of gmail?
I could not find any options in the webinterface of Gmail.
all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
1
vote
1answer
205 views
Fake email sent through newsletter service: how to know who sent them?
Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
1
vote
2answers
88 views
Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?
Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination.
If we disable the account prior to wiping the device (or the device receiving the wipe ...
1
vote
1answer
187 views
Are there any security issues with importing mail via POP/IMAP?
I'd want to design import mail functionality for an email provider. The process is: user enters email and password for another service at my site and then site accesses another email provider and ...
1
vote
2answers
321 views
How is mail automatically sent from my account?
Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of ...
1
vote
1answer
177 views
Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?
Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability?
Some definitions to get everyone on the same ...
