Related to email protocols, clients, servers, content, and message format.
2
votes
1answer
256 views
Possible Hijacked Email Server [closed]
MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server.
Our email server is a Virtual FreeBSD box hosted by Verio. Their ...
1
vote
3answers
518 views
OWA Keep-Alive in http, even though it should be forced https
Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
7
votes
2answers
766 views
How do I encrypt the source and destination IP address, along with various parts of an email?
If the subject makes no sense to you, that's fine, it makes no sense to me.
I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
1
vote
1answer
92 views
Should the email server/application be protected by 2 factor authentication? What applications should be protected?
When should email be protected by 2 factor authentication?
Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
2
votes
1answer
797 views
My S/MIME certificate (created with OpenSSL) does not match my email address
I created a certificate with OpenSSL and following commands:
openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem
...
-1
votes
3answers
160 views
What is the most reliable way to transfer emails without specific recipient support?
Many suggestions on transfering emails securely can be found in this answer. But many of them (e.g. PGP) need support from recipient. I want to provide SMTP email server that will route emails of it's ...
1
vote
3answers
183 views
Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?
Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works.
I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
6
votes
2answers
374 views
How might an email do damage merely by being opened?
E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml
Assuming that the user clicks no links and opens no ...
1
vote
1answer
74 views
Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)
FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack.
What ...
5
votes
7answers
2k views
Can I reclaim ex employee gmail account?
This is the best place in SE I can find to post this.
We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com
He left the company and ...
7
votes
1answer
222 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
1
vote
1answer
1k views
What algorithm/encryption type does Gmail use for security?
In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
2
votes
3answers
310 views
Security issues with email accounts
I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email,
There is a ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
0
votes
1answer
471 views
Email not received when sent by our app, received when sent by outlook [closed]
We have an application that sends mail in bulk, via a mail provider (Mailjet). Our clients are professional organizations, and they send important mails about meetings and stuff like that, to about 10 ...
3
votes
3answers
255 views
Encrypting an email server's local drives or filesystems
Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
2
votes
1answer
1k views
Spoofing email From address
Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
1
vote
2answers
323 views
How secure is Goodlink for mobile phones when compared to Activesync?
Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink.
One argument is the ...
6
votes
2answers
529 views
Best practices for email security
I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login).
I'm interested to hear from anyone who has written an application with ...
8
votes
4answers
5k views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
11
votes
3answers
303 views
Can I expect my e-mail to be routed securely?
If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
12
votes
11answers
870 views
For users that does not use PGP, what would be the other channel to securely send them a document?
I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email.
The real question is how to do that?
...
4
votes
4answers
823 views
Email header IP address
Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
3
votes
2answers
1k views
Some questions about penetration testing distribution Backtrack 5
I know just the basics of backtrack and I want to ask some questions about it:
Can you attack an ftp server using backtrack? an email server?
I have a Centos virtual private server and backtrack is ...
4
votes
1answer
744 views
Email SSL security?
I use IMAP and I only access my email through SSL.
However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the ...
5
votes
1answer
630 views
Thunderbird - what happens if Gmail SSL cert gets spoofed?
I use a good MUA: Thunderbird [to read/reply to my emails on Gmail].
So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails?
Questions:
...
27
votes
7answers
2k views
Is it illegal to read an e-mail that was accidentally sent to you?
I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)
This e-mail and ...
4
votes
2answers
274 views
What questions should I ask a vendor that provides hosted encrypted email?
I am evaluating a service provider that performs the following functions with email:
A user logs in to a web based application over an SSL connection.
Email is composed in a web browser over the SSL ...
10
votes
2answers
375 views
Is email more secure when not letting any zipped content through?
Ah. This is a bit of a soft question, but I though there might be some here that can share some insight.
I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
10
votes
4answers
690 views
Why would someone want to block images in email?
While there is the possibility that this is just to prevent people from viewing offensive images against their will, somehow I don't think that's the reason why pretty much every email client defaults ...
2
votes
2answers
217 views
Company sending Master passwords in unencrypted emails
If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
6
votes
3answers
256 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
7
votes
3answers
331 views
How Reliably do mail systems transmit Encrypted PDFs
We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.
We have tested the pdf's through the usual cast of internet mail ...
1
vote
2answers
506 views
What are some secure methods of sending email from your server?
This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have ...
25
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
10
votes
6answers
869 views
Identity-Based Encryption - how secure is it?
I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm.
I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
6
votes
3answers
258 views
How do I securely exchange server logins with remote developers?
I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.
Very often I need to exchange SSH login information with developers working on projects for us. How ...
3
votes
2answers
241 views
Legal process for suing joejobber?
I'm currently being joejobbed, and want to sue the joejobber. Details:
I have real damages: the joejob causes me to receive fake bounces, which:
stop/delay my receipt of legitimate mail, since ...
10
votes
2answers
368 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
2
votes
1answer
1k views
Email Spoofed. Explain?
So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
3
votes
1answer
343 views
quizrace.com - Malware or just a game?
This quizrace.com quiz game is spreading like a virus all over internet forums and sites like 4cahn, minecraft etc (just google for it) - because it requires you to invite 3 friends to continue beyond ...
1
vote
2answers
400 views
Is it a security issue that Thunderbird only logically deletes emails?
I have several e-mail accounts configured in Thunderbird. I just wanted to move an e-mail from one of my e-mail accounts [A] Trash folder to another accounts [B] Inbox folder. Because the moved e-mail ...
9
votes
2answers
553 views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
2
votes
1answer
202 views
Is the Gmail activity log still missing activesync?
Is the Gmail activity log still missing activesync as described in this blog post?
As it is "someone with my credentials could be reading and sending [email] messages with my account" without that ...
5
votes
2answers
851 views
With reference to using Gpg4win, which is better: OpenPGP or S/MIME?
Which is better -- OpenPGP or S/MIME for higher security?
8
votes
4answers
378 views
How to ensure account security when accessing emails when overseas?
First of all, I hope this is the right stackexchange to ask this. Seems to be most relevant here.
Now, if one is planning to go overseas and he/she has a lot of data on the email account (say, gmail) ...
5
votes
2answers
771 views
spam with my own domain
At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spams mail with our own domain. This is obviously very prejudicial for us, because many ...
5
votes
4answers
235 views
Circumventing a “freemail” account form filter
I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
6
votes
3answers
863 views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
