Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

1
vote
1answer
131 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
10
votes
4answers
5k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
4
votes
8answers
6k views

Is it possible to prove a certain email has been sent using a certain computer?

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about ...
1
vote
2answers
167 views

Unexpected emails have been sent - do I need to wipe my Android?

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large. I opened my Gmail App and found 5 messages in the Sent Mail folder ...
1
vote
0answers
180 views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
3
votes
2answers
85 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
10
votes
4answers
4k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
1
vote
1answer
161 views

How to share sensitive documents with unknown/untrusted parties?

My exact use case is that I'm starting a new job, and I need to transmit sensitive personal documents to support my application. However, the same applies for applying for a loan, buying a house etc ...
2
votes
4answers
335 views

Is e-mail sent from a Gmail address to another Gmail address encrypted?

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
1
vote
1answer
30 views

Can I keep large encrypted files in my mailbox on mail provider server?

Is there any restriction or policy of large e-mail providers (such as GMail, Yahoo, Hotmail and similar) for keeping/storing large encrypted files by the users within their disk quota in 3rd party ...
2
votes
1answer
6k views

What is cleardot.gif next to the senders signature in Gmail? [closed]

I am concerned that my computer has been compromised because I sent an email out - but now I noticed that there is a link in the email I did not insert, and I am worried I have a virus or something. ...
3
votes
4answers
1k views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
2
votes
3answers
244 views

Email account 'hacked'; do I need to regenerate my server's DKIM _domainkey?

I'm just learning about DMARC (DKIM/SPF), so I apologize if my question doesn't make sense. A few days after I installed a DMARC policy on my server I noticed that the reports from yahoo.com ...
3
votes
6answers
24k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
0
votes
0answers
156 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
-3
votes
2answers
121 views

Does company email can access hangouts and private emails? [duplicate]

I'am curious whether the administrator's has the privilege to access the hangouts chat and the email of employees? For example, here in our company we are using the gmail as our private email ...
2
votes
2answers
201 views

It it a good idea to whitelist inbound email using a Hash on the address? (Similar to BATV, but with DKIM)

Problem Statement I'm looking at ways to ensure that business partners, or emails from trusted senders, never get quarantined; ....in other words prevent "ham being seen as spam". Ideally this ...
2
votes
1answer
85 views

Preventing users abusing emailing feature of web application

Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus ...
-4
votes
1answer
669 views

Trace email without header or IP address [closed]

I have a gmail address only. It is a copy of the email. I do not have the original email. Is there anyway to trace it?
4
votes
2answers
3k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
6
votes
3answers
267 views

Why can't PGP/GPG Web-of-Trust be automated?

We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
2
votes
2answers
78 views

Secure alerting for a monitored web application

What is a good method to receive security alerts? Email is the first thing that springs to mind, although it is susceptible to MITM attacks (e.g. an attacker preventing the email from being ...
-1
votes
1answer
64 views

IP address question [closed]

I traced a header on an email I received, the person claims to have sent it from Maryland, but I traced the IP and it shows shows San Jose, CA and also contains loop backs, ??? Is this possible?
0
votes
2answers
779 views

Gmail spam from contacts. How does it work?

I don't know why it seems IMPOSSIBLE to find a blog or any security expert explaining the procedure of how this 'hack' works. My wife is receiving emails from people she's emailed through Gmail ...
-1
votes
2answers
86 views

Can passwords be figured out via public wifi? [duplicate]

Few different scenarios: 1a) On public McDonalds wifi, logging in gmail account (or any account such as skype). Can a random user who is using the same wifi somewhat intercept the signal and figure ...
2
votes
1answer
234 views

Is it possible to track the email sent via BCC List using firewall or network security software?

I want to know whether is it possible to know the conversation/email sent via BCC can be identified by admin in some corporate companies? I have heard that email sent from BCC cannot be identified, ...
1
vote
1answer
43 views

Location Obfusication and Email/remote login

Would it be possible for a user of a 3rd party VNC software package and email client to obfusicate/spoof their location, so that an employer would be unable to determine the location from which the ...
0
votes
1answer
116 views

emailing a direct link to executable file blacklist risk

I hope this is in the right place, don't know where else to ask. I would like to automatically send a download link to people that directly downloads an executable. The executable is a verified and ...
1
vote
1answer
2k views

How to tell computer of origin sending email messages? [duplicate]

I’m not a security expert. I wasn't sure if I should post this question here or in "exploit". I have searched for answers before posting.... Could anyone tell me how I can determine if emails are ...
0
votes
2answers
182 views

Is it bad if one uses the same email address on different sites/forums?

Is it bad practice if one uses the same email address on different sites and forums?
2
votes
2answers
278 views

Are our email credentials safe with email clients?

I've been trying out a few desktop email clients (Windows) to better manage my e-mail. As I tried Thunderbird, Inky, and Outlook, it occurred to me, what guarantee is there that my e-mail/pass won't ...
-1
votes
1answer
504 views

How do I force kill an OWA, Activesync, or Outlook session?

A user with a BYOD is still able to access the email system, even after the user account has been disabled and password changed. Since it's clear that a re-authentication event doesn't continually ...
5
votes
1answer
301 views

spam: several secret inboxes targeted at once. risk or coincidence?

I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
1
vote
2answers
121 views

access to email addresses

I am taking part in an online voting photo contest. In order to vote, you have to register using your email address. Is it possible that people who run the site will be able to see my email address ...
1
vote
2answers
390 views

Are newly-generated recovery passwords sent to me via email hashed? [duplicate]

If a company sends me a new password via SMS/email because I clicked "forgot my password." Does that mean the company is not actually hashing my passwords?
19
votes
4answers
4k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
20
votes
4answers
1k views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
3
votes
2answers
130 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
73
votes
4answers
19k views

What are the security reasons for disallowing the plus sign in email addresses?

My question is based on this tweet after I commented about forbidding + symbols in email addresses. The tweet says, "This is a measure we've taken for security reasons." This can be frustrating and ...
0
votes
2answers
82 views

What are the disadvantages to the site owner to have third parties e-mails displayed publicly?

I frequently have to remind my members not to post their e-mails due to spam bots. One of them told me he doesn't care about that since his spam filter is good enough. If I allow him to do that, are ...
-2
votes
1answer
78 views

Track mail sender from Mesh network [closed]

Mesh network have one router connected to WAN or Internet so IP address is allocated to that router will be exiting point for all the nodes.. and other routers will have Internet connection from that ...
1
vote
1answer
125 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
0
votes
1answer
467 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
-5
votes
1answer
246 views

How i can stop already sent email? [closed]

I have a Gmail account. Unfortunately I have sent an email from my Gmail account. How I can stop or back this email ?
1
vote
3answers
116 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
9
votes
5answers
3k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
0
votes
2answers
77 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
1
vote
2answers
118 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
2
votes
3answers
3k views

VPS Privacy: OpenVZ vs KVM vs Xen

Considering OpenVZ, KVM and Xen: Which VM technology is the most difficult for the host's administrators to access given an encrypted root partition? Can I have a reasonable expectation that rogue ...
4
votes
5answers
271 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...