Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
70 views

Is there any security benifit to sent email message only as attachement?

A well known company in Oil and Gas field, sends the email message as PDF attachment, with brief explanation, here is an example: Dear Mr Name, Please review the attached document acknowledging ...
2
votes
1answer
4k views

Yahoo Account hacked, changed pw, spam still going out elsewhere?

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts. I changed the password, then saw (via rejected emails sent to my Yahoo ...
42
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
3
votes
2answers
677 views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
0
votes
1answer
274 views

Email Spoofing Modified Headers

I have be reading more and more about email spoofing and was curious how some things are done. I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
2
votes
1answer
151 views

Should my company have an SSL on our email

We have a new IT guy that insists we do not need an SSL on our email. Quite a few people access their email from outside our office(network) via mobiles and home computers, often from WIFI ...
-1
votes
2answers
128 views

What are the security risks for a business that has an insecure email system [closed]

For instance if the email system uses POP3 legacy protocol and SMTP but is not encrypted, yet the business continues to use it for daily purposes both internally and externally, what could be the ...
2
votes
1answer
495 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
-9
votes
2answers
122 views
0
votes
1answer
62 views

IP Address Same on Different Devices? [closed]

The IP address appears to be the same in the e-mail header even when e-mail is sent from different devices. Shouldn't the IP address reflect the device IP? The e-mail is set up through an exchange ...
3
votes
3answers
474 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
3answers
1k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
0
votes
2answers
41 views

Is there any mail service accepting real id? [closed]

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
1
vote
3answers
57 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
1answer
83 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
2
votes
3answers
818 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
2
votes
1answer
81 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
3answers
100 views

How can get email about latest vulnerabilities [closed]

Today my friend got email for the latest vulnerablility heartbleed. But i could not find where i can subscribe so that i can also get emails about latest vulnerabilities Can anyone please help me ...
0
votes
1answer
111 views

Email hacking/masking prevention

Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it. When I look at the ...
0
votes
2answers
304 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
63
votes
12answers
21k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
6
votes
5answers
901 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
3
votes
1answer
135 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
3
votes
2answers
201 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
3
votes
1answer
244 views

3000 new contacts being added to gmail after receiving an email

Recently I realized that there are three thousand contacts with same name and email address in my Google contacts. The name belongs to an email that I have recently received and responded to, nothing ...
5
votes
5answers
580 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
0
votes
2answers
161 views

Best practice for sending IP Addresses

IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a ...
2
votes
1answer
468 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
1
vote
3answers
1k views

Email activation string with MD5'd random number and email secure?

For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address. $key = ...
0
votes
2answers
39 views

How likely would /var/mail be encrypted in a paid host? [closed]

I pay for a very basic web hosting plan, which includes a personal email address. Would the sysadmin of said host be able to read the content of my messages? How likely would my personal mail folder ...
4
votes
5answers
640 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
2
votes
1answer
272 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
6
votes
2answers
639 views

The safest way to access GMail on mobile devices

There are three ways to access your GMail account on iPhone or iPad devices: 1. Use safari browser 2. Use Apple's default mail app 3. Use Google's Gmail app What is the safest way to access gmail ...
2
votes
3answers
103 views

Is it a good practice to include a download URL of my GPG public key in my email signature?

I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature. Is this a good practice? If not, what's a good alternative?
1
vote
3answers
2k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
1
vote
1answer
112 views

How could a third-party know the contents of an email I sent to someone?

Apparently, a third party knew the contents of an email I sent to someone within an hour after I sent it. The following possibilities come into mind: The recipient forwarded the email to the third ...
3
votes
1answer
2k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
0
votes
3answers
110 views

Is it insecure to send an email from a PHP script to an email address on the same domain?

I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.
2
votes
2answers
126 views

How to find out the email host of a vanity email address?

Assuming a person gets his own domain address, say, theperson.com. He then goes on to create a vanity email address with that domain. e.g. me@theperson.com. me@theperson.com may be hosted by the ...
6
votes
1answer
126 views

Reading older mails signed with a certificate that has meanwhile expired

A few years ago I have used S/MIME certs to sign (and encrypt) my mails. The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It ...
4
votes
1answer
656 views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
8
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
2
votes
1answer
203 views

How can I prove to a third party that I'm sending the emails I'm supposed to?

Suppose one of my duties for a small organization is to send out statements to clients by email. Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
38
votes
10answers
2k views

Cryptography that looks like ordinary email

I would like to stay out of the automatic filters in place by security agencies and not be accidentally placed on a no-fly list or such. Say I'm having a political debate with a friend about democracy ...
7
votes
3answers
4k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
0
votes
2answers
124 views

Is sending authorizing links through e-mail a vulnerability?

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability? Password-reset partly ...
2
votes
2answers
325 views

E-mail already in use exploit

I have a registration portal where user inputs his details and then a valid email account. Currently I check the email is not used already and if it is I reply with the classic: "email already in ...
0
votes
1answer
126 views

Emails are forwarded to wrong addresses and possible hacking?

Multiple email addresses for my domain have been compromised. My client forwarded me an old email which he sent me few days ago but I haven't received that email. That email was sent to an email ...
4
votes
5answers
232 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...