Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

4
votes
2answers
312 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
4
votes
3answers
960 views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
4
votes
4answers
320 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
4
votes
3answers
717 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
4
votes
3answers
403 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
4
votes
3answers
349 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
4
votes
5answers
633 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
4
votes
2answers
177 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
4
votes
3answers
218 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
4
votes
2answers
750 views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
4
votes
1answer
177 views

How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with ...
4
votes
5answers
2k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
4
votes
3answers
158 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
4
votes
1answer
240 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
1answer
300 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
4
votes
3answers
1k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
4
votes
5answers
228 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
4
votes
2answers
398 views

What questions should I ask a vendor that provides hosted encrypted email?

I am evaluating a service provider that performs the following functions with email: A user logs in to a web based application over an SSL connection. Email is composed in a web browser over the SSL ...
4
votes
4answers
2k views

Is there any way to set up secure email for Network Solutions domains? [closed]

I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers. I've been talking with Network Solutions' email support people, who will repeatedly state that ...
4
votes
1answer
40 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
4
votes
1answer
644 views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
4
votes
4answers
472 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
4
votes
1answer
9k views

How do I create a valid email certificate for Outlook S/MIME with openssl?

I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
4
votes
2answers
214 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
4
votes
1answer
58 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
4
votes
3answers
801 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
4
votes
1answer
85 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
4
votes
2answers
255 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
4
votes
2answers
157 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
3
votes
4answers
513 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
3
votes
6answers
15k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
4answers
2k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
3
votes
6answers
229 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
3
votes
2answers
1k views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
3
votes
3answers
1k views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
3
votes
3answers
497 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
3
votes
1answer
2k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
3
votes
3answers
363 views

How to know if mail is for tracking our IP

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images. My query is that how can we get to ...
3
votes
2answers
296 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
3
votes
3answers
3k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
3
votes
3answers
338 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
3
votes
4answers
2k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
3answers
294 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
3
votes
2answers
917 views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
3
votes
3answers
1k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
3
votes
2answers
69 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
3
votes
2answers
633 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
3
votes
3answers
112 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
3
votes
1answer
291 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
3
votes
1answer
3k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...