Related to email protocols, clients, servers, content, and message format.
57
votes
9answers
7k views
How can PayPal spoof emails so easily to say it comes from someone else?
When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
3
votes
3answers
158 views
Resources/tools for controlling access to corporate email on smartphones
If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone.
For iOS ...
6
votes
2answers
528 views
Best practices for email security
I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login).
I'm interested to hear from anyone who has written an application with ...
7
votes
4answers
4k views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
4
votes
4answers
2k views
How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
3
votes
4answers
400 views
What Gmail features should be Opted-Out to prevent PII from being indexed?
The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).
Of the free email providers, GMail does support TLS ...
11
votes
3answers
302 views
Can I expect my e-mail to be routed securely?
If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
4
votes
4answers
822 views
Email header IP address
Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
19
votes
5answers
9k views
Is it still unsafe to email credit card number nowadays?
We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.
I'm wondering if the risk is so low I don't have to call to cancel my card.
The email is sent from a ...
16
votes
4answers
4k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
1
vote
2answers
321 views
How secure is Goodlink for mobile phones when compared to Activesync?
Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink.
One argument is the ...
3
votes
2answers
1k views
Some questions about penetration testing distribution Backtrack 5
I know just the basics of backtrack and I want to ask some questions about it:
Can you attack an ftp server using backtrack? an email server?
I have a Centos virtual private server and backtrack is ...
4
votes
1answer
732 views
Email SSL security?
I use IMAP and I only access my email through SSL.
However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the ...
4
votes
2answers
273 views
What questions should I ask a vendor that provides hosted encrypted email?
I am evaluating a service provider that performs the following functions with email:
A user logs in to a web based application over an SSL connection.
Email is composed in a web browser over the SSL ...
10
votes
2answers
374 views
Is email more secure when not letting any zipped content through?
Ah. This is a bit of a soft question, but I though there might be some here that can share some insight.
I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
10
votes
4answers
680 views
Why would someone want to block images in email?
While there is the possibility that this is just to prevent people from viewing offensive images against their will, somehow I don't think that's the reason why pretty much every email client defaults ...
3
votes
3answers
718 views
Is there any way to set up secure email for Network Solutions domains?
I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers.
I've been talking with Network Solutions' email support people, who will repeatedly state that ...
2
votes
2answers
217 views
Company sending Master passwords in unencrypted emails
If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
7
votes
3answers
328 views
How Reliably do mail systems transmit Encrypted PDFs
We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.
We have tested the pdf's through the usual cast of internet mail ...
1
vote
2answers
502 views
What are some secure methods of sending email from your server?
This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have ...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
6
votes
3answers
256 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
9
votes
1answer
2k views
Paypal Account created using my gmail account
Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.
I noticed that, removed the forward and changed the password. Now, I ...
11
votes
5answers
20k views
How to find out the IP address of email sender in Gmail
Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender.
Since Gmail ...
6
votes
3answers
258 views
How do I securely exchange server logins with remote developers?
I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.
Very often I need to exchange SSH login information with developers working on projects for us. How ...
10
votes
6answers
859 views
Identity-Based Encryption - how secure is it?
I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm.
I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
10
votes
2answers
367 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
2
votes
1answer
1k views
Email Spoofed. Explain?
So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
5
votes
6answers
320 views
Spam fighting idea
I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work.
Someone sets up a reputation-based site, much like stackexchange sites, where ...
1
vote
2answers
400 views
Is it a security issue that Thunderbird only logically deletes emails?
I have several e-mail accounts configured in Thunderbird. I just wanted to move an e-mail from one of my e-mail accounts [A] Trash folder to another accounts [B] Inbox folder. Because the moved e-mail ...
9
votes
2answers
549 views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
27
votes
7answers
2k views
Is it illegal to read an e-mail that was accidentally sent to you?
I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)
This e-mail and ...
5
votes
7answers
2k views
Can I reclaim ex employee gmail account?
This is the best place in SE I can find to post this.
We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com
He left the company and ...
8
votes
4answers
289 views
Next steps after webmail account was compromised
John Doe told me the following story:
I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
25
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
2
votes
1answer
202 views
Is the Gmail activity log still missing activesync?
Is the Gmail activity log still missing activesync as described in this blog post?
As it is "someone with my credentials could be reading and sending [email] messages with my account" without that ...
3
votes
1answer
343 views
quizrace.com - Malware or just a game?
This quizrace.com quiz game is spreading like a virus all over internet forums and sites like 4cahn, minecraft etc (just google for it) - because it requires you to invite 3 friends to continue beyond ...
3
votes
2answers
241 views
Legal process for suing joejobber?
I'm currently being joejobbed, and want to sue the joejobber. Details:
I have real damages: the joejob causes me to receive fake bounces, which:
stop/delay my receipt of legitimate mail, since ...
5
votes
2answers
845 views
With reference to using Gpg4win, which is better: OpenPGP or S/MIME?
Which is better -- OpenPGP or S/MIME for higher security?
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
5
votes
1answer
630 views
Thunderbird - what happens if Gmail SSL cert gets spoofed?
I use a good MUA: Thunderbird [to read/reply to my emails on Gmail].
So: what happens, if i go to a place, where is public wifi, and someone tryes to sniff my password/username/emails?
Questions:
...
8
votes
4answers
377 views
How to ensure account security when accessing emails when overseas?
First of all, I hope this is the right stackexchange to ask this. Seems to be most relevant here.
Now, if one is planning to go overseas and he/she has a lot of data on the email account (say, gmail) ...
5
votes
2answers
766 views
spam with my own domain
At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spams mail with our own domain. This is obviously very prejudicial for us, because many ...
5
votes
4answers
233 views
Circumventing a “freemail” account form filter
I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
6
votes
3answers
856 views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
12
votes
11answers
864 views
For users that does not use PGP, what would be the other channel to securely send them a document?
I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email.
The real question is how to do that?
...
13
votes
4answers
644 views
What type of content better not to transfer by email?
Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?
I have always wondered how sensible it is ...
