Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
496 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
20
votes
4answers
1k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
10
votes
3answers
708 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
5
votes
7answers
1k views

Is PGP combined with a regular web-based email service secure?

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
15
votes
3answers
368 views

What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?

Lavabit hosts a secure messaging service that was recently shut down. Likewise SilentCircle has preemptively done the same thing with their email-based service. It seems that the justification for ...
2
votes
3answers
1k views

How to check if range of IP addresses are SPAM blacklisted?

While it's easy to check if a single IP address is blacklisted for SPAM using for example http://www.spamcop.net/bl.shtml, then is there a way to check multiple addresses at once? For example how to ...
0
votes
2answers
212 views

Danger in opening spam emails on Ubuntu operating system [closed]

Some emails are suspected to be viruses; Because of that, the email service store categorizes them as spam. Or some pages are suspected to be viruses, and new browsers classify them as harmful pages. ...
0
votes
2answers
409 views

Alternative Email Provider [closed]

As a continuation to Why would someone trust DuckDuckGo or other providers with a similar privacy policy? it seems like we already have a secure way to make a search without writing history and etc. ...
4
votes
5answers
226 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
-2
votes
2answers
114 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
6
votes
1answer
172 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
3
votes
3answers
344 views

How to know if mail is for tracking our IP

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images. My query is that how can we get to ...
4
votes
2answers
237 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
1
vote
1answer
2k views

Which IP address in email headers is the sender's? [closed]

I have the headers from some emails I've received. There are several IP addresses in these headers. Which one belongs to the sender? Is the address in the headers reliable? Example 1: Delivered-To: ...
10
votes
5answers
757 views

Is there any security benefit of not using email services recently associated with PRISM?

After the recent disclosure of several major email providers cooperating with NSA, is there any real security benefit of not using these email services and choose some alternative instead? Such as ...
3
votes
3answers
96 views

Security of remailers

A layman's question: If I don't err, with remailers or analogous systems one sends a message to a node of a chain of nodes, which collectively perform the entire transmission. However, the message to ...
2
votes
1answer
265 views

Why should I pay for an email S/MIME certificate?

There are quite a few SSL certificate companies out there that offer free email S/MIME certificates. There are also paid versions as well. I need about 6 email certificates for some company email ...
2
votes
1answer
156 views

Using X-actual-recipient to divert email

Has anyone noticed exploits involving the use of "X-Actual-Recipient" to covertly divert e-mail from an intended recipient to someone else? I have been told that only someone with root access on the ...
3
votes
3answers
591 views

Where to get/buy a CSR generated S/MIME certificate

I'm not sure if the question is eligable for this board as I ask for concrete service providers which can be kind of advertisement, but there is also technical issue involved, so I give it a try. My ...
7
votes
2answers
372 views

Is personal email hosting really secure?

One of my friends has his own personal email hosting. Let's assume for the sake of argument that it is "secure", meaning that no third party can read the emails in his server either through hacking or ...
3
votes
2answers
528 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
-6
votes
1answer
171 views

Spam mail from my yahoo mail [closed]

Couple of days back spam mail(screenshot link) was sent to all my contacts from my yahoo account, and in my account activity page there is a yahoo partner logged in, from Peru (screenshot link) during ...
5
votes
1answer
814 views

is it possible to sniff email content inside network?

I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the ...
5
votes
4answers
357 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
2
votes
3answers
729 views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
-2
votes
2answers
450 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
-3
votes
2answers
163 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
-1
votes
1answer
143 views

Stopping spam and worms with SPF [closed]

Sender Policy Framework is a system to detect spoofed emails. From http://www.libsrs2.org/overview.html : WHAT EMAIL FORWARDING SERVICES NEED TO KNOW ABOUT SPF To combat spams, worms, and ...
6
votes
3answers
148 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
3
votes
1answer
183 views

What is the security purpose behind the “enable editing” of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
-1
votes
0answers
201 views

Email sender and account hacked [closed]

One customer got their email account "frozen" because it sent 9000 emails and some bounced back. I suspect something got hacked, but I have no idea what to do. I cannot figure out what was hacked. ...
5
votes
5answers
2k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
6
votes
4answers
252 views

Technical security issues with proactively executing a phishing campaign targeting your own users

We've had some issues with compromised accounts due to users falling victim to phishing campaigns. The possibility of us doing a phishing campaign against our own users to proactively shame them has ...
4
votes
2answers
620 views

Can a firewall tamper with email attachments?

I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
1
vote
1answer
212 views

If a hacker gets into my PC can he get to my saved windows live mail passwords?

If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
4
votes
3answers
154 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
-7
votes
2answers
121 views

Why my Email are received in the spam folder? [closed]

I am using Mass email marketing or shoot out email campaign but my subscriber received my mail in spam folder what are the reason of this and how can I prevent them. Question reference: Email ...
4
votes
4answers
374 views

Safe to reply to a suspicious email?

Can something happen to me (or my computer) if I respond to a suspicious plain text email? I received an email from an unknown address, and I am not sure if this is a "real" person. I would have ...
0
votes
2answers
229 views

“You have new mail” message

I received a message from Google saying someone entered my email account. I confirmed that there were an access from an IP in another country. I have noticed "You have new mail" message when I open ...
2
votes
1answer
212 views

Securely notify users about account changes

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes: ...
6
votes
3answers
187 views

Is there any sense in using two-step authentication for personal email address?

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
2
votes
2answers
12k views

Spam that comes from names in my address book, but not their email addresses

I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be. Specifically, the names -- but not the email ...
-3
votes
1answer
315 views

Automated scanning of personal email [closed]

I am a current user of gmail, and have recently become interested in the privacy policies of the large webmail providers like gmail, yahoo, hotmail etc. I understand that it is commonplace for them to ...
1
vote
1answer
266 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
2
votes
1answer
824 views

The security of sending emails with SPF/DKIM, but not signed

We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM. A few days ago we noticed that they allow any ...
2
votes
0answers
43 views

Is it the default in billing systems to send out the users password by email? [duplicate]

I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk. One of their employees responded with ...
-1
votes
2answers
436 views

Keyloggers and Email Accounts [duplicate]

This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker. How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
817 views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
8
votes
5answers
773 views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...