Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
1answer
353 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
4
votes
8answers
6k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
4
votes
1answer
3k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
4
votes
5answers
9k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
4
votes
3answers
748 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
4
votes
2answers
188 views

What do I do about a forgotten, ancient PGP key?

So I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key ...
4
votes
5answers
1k views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
4
votes
3answers
237 views

How do I recover from an email breach?

A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails ...
4
votes
2answers
3k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
4
votes
2answers
1k views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
4
votes
3answers
2k views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
4
votes
5answers
332 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
4
votes
5answers
250 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
4
votes
4answers
315 views

Safe way to communicate IBAN connection

How do I securely communicate my bank connection details (IBAN + full name) to an otherwise trusted person with email being the only connection? Obviously I wouldn't use (plaintext) e-mail since any ...
4
votes
5answers
2k views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
4
votes
2answers
742 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
4
votes
4answers
358 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
4
votes
3answers
613 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
4
votes
3answers
445 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
4
votes
2answers
255 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
4
votes
2answers
70 views

Should I email contents of a https form submission

I am building an online registration form for a voluntary organisation in the UK and am considering data security measures. The form will be served up over https and there may be an optional payment ...
4
votes
3answers
330 views

How can I convince my communication partner to use encryption in everyday life?

The latest developments made it very clear, how easily basically all communication channels can be wiretapped. However, I think most people still ignore this fact. Especially in business most ...
4
votes
1answer
52 views

Implemented DMARC, getting reports of canonical.com sending spam - has Ubuntuone been hacked?

I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender: >record> >row> >source_ip>91.189.90.7>/source_ip> ...
4
votes
1answer
90 views

Passive fingerprinting of email client, based on email headers

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? I'm familiar with passive ...
4
votes
2answers
189 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
4
votes
1answer
529 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
4
votes
1answer
351 views

How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with ...
4
votes
2answers
347 views

Can viewing an email message in Outlook 2013 install malware on my computer?

I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
4
votes
3answers
173 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
4
votes
1answer
252 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
3answers
1k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
4
votes
5answers
271 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
4
votes
1answer
1k views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
4
votes
2answers
498 views

What questions should I ask a vendor that provides hosted encrypted email?

I am evaluating a service provider that performs the following functions with email: A user logs in to a web based application over an SSL connection. Email is composed in a web browser over the SSL ...
4
votes
3answers
42 views

How can you prevent email addresses from being harvested from a registration form?

When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages: Your email is wrong Your password is wrong Your email or password is ...
4
votes
3answers
673 views

How to check that an e-mail service provides encryption between the mail servers?

How can I technically verify* that the e-mail I'm sending from Gmail to Yahoo is encrypted all the way from Gmail's servers to Yahoo's servers? I know that it's advised to have encryption between the ...
4
votes
1answer
914 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
4
votes
2answers
190 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
4
votes
3answers
213 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
4
votes
4answers
3k views

Is there any way to set up secure email for Network Solutions domains? [closed]

I'm trying to set up any mail client to have a secure connection to Network Solutions' email servers. I've been talking with Network Solutions' email support people, who will repeatedly state that ...
4
votes
1answer
90 views

Asking for Password After Email Validation?

I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
4
votes
3answers
299 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
4
votes
1answer
69 views

mailto email headers trace IP

So I'm working on a defamation case. So I will make a little overview of what is going on. The person we are trying to trace is using a site like kijiji. Tomorrow I am heading to the so said kijiji ...
4
votes
1answer
71 views

How accurate the recent activities location provided by Microsoft emails

One of my emails is on hotmail.com provided by Microsoft. Recently, after few suspicious incidents where my computer was hacked and many other accounts, I changed all my passwords including this ...
4
votes
1answer
679 views

What are the security differences between SMIME email and PGP email? [closed]

Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP? Example comparisons Security ...
4
votes
2answers
1k views

How can an email from a Yahoo address be sent through Yahoo without authentication?

I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
4
votes
1answer
2k views

Keep receiving delivery failures for emails im not sending

I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
4
votes
1answer
354 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
4
votes
1answer
87 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...