Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

6
votes
4answers
2k views

Reporting a GMail hacker attack

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on ...
1
vote
1answer
212 views

Any recipient can modify an order confirmation mail, right? Does this ever matter ?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
2
votes
1answer
256 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
8
votes
1answer
699 views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
4
votes
3answers
975 views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
8
votes
5answers
426 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
1
vote
3answers
925 views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
6
votes
5answers
564 views

How do spammers verify the validity of a huge amount of email addresses?

I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server. But for this method, the MX server may abort connection after ...
3
votes
3answers
107 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
4
votes
4answers
205 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
-1
votes
1answer
2k views

how to trace the IP address of gmail account sender via browser [duplicate]

Possible Duplicate: How to trace email? i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below Analysis: Received: from ...
2
votes
3answers
224 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
3
votes
6answers
9k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
1answer
660 views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
2
votes
1answer
138 views

Encoding HTML email content

Say I have a form on my website. The input elements of the form are: email address, name and some feedback textarea. The server-side application that this form is submitted to will send an HTML ...
1
vote
2answers
91 views

access to email adresses

I am taking part in an online voting photo contest. In order to vote, you have to register using your email address. Is it possible that people who run the site will be able to see my email address ...
5
votes
5answers
480 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
4
votes
4answers
277 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
8
votes
6answers
506 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
-1
votes
2answers
123 views

Can 2FA help handle mixed personal and business accounts after leaving a company?

I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
3
votes
1answer
163 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
3
votes
2answers
527 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
8
votes
1answer
489 views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
1
vote
1answer
248 views

Fake email sent through newsletter service: how to know who sent them?

Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
8
votes
6answers
3k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
-1
votes
2answers
259 views

sanesecurity - clamav - getting a false positive - should I bother?

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
4
votes
5answers
459 views

Is snail mail or HTTPS webmail safer for sensitive information?

I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
3
votes
3answers
312 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
0
votes
3answers
273 views

Petraeus scandal - what would have been a better way to communicate electronically [closed]

Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
17
votes
5answers
1k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
3
votes
2answers
250 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
4
votes
3answers
274 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
6
votes
2answers
183 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
3
votes
2answers
187 views

What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?

But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
2
votes
3answers
690 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
1
vote
2answers
127 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
3
votes
3answers
280 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
3
votes
2answers
276 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
1
vote
2answers
155 views

IP attack by reading/writing data?

If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection). Are there any further/more dangerous ...
2
votes
1answer
586 views

Hosted Email Hacked, SQL injection maybe?

I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised. Basically, someone is using my ...
0
votes
5answers
528 views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
2
votes
3answers
2k views

Email security and Home Mail Servers

Suppose you're truly paranoid (I assume the majority here identify with this?) and you don't want Google or other email service providers reading your email (to serve ads, etc). You don't want your ...
-2
votes
2answers
394 views

Learn IP address of sender of a self-destructing email

How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
4
votes
2answers
191 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
7
votes
5answers
661 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
10
votes
5answers
488 views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
1
vote
2answers
1k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
3
votes
2answers
875 views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
3
votes
1answer
165 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
1
vote
3answers
479 views

Instant access to application using token in url

Is it good idea to give access to the site using token in url, this token can be send via email, some sites have reset password done in this way, but I want give access to the whole site (I think I ...