Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
2answers
622 views

Do fake-address generators work?

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
7
votes
3answers
1k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
1
vote
2answers
803 views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
9
votes
2answers
1k views

Is it bad to only sign some of a domain's emails with DKIM?

Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game? We use Amazon's Simple-Email-Service for sending e-commerce emails. We would like to sign these with DKIM. This same ...
1
vote
2answers
497 views

If I migrate from dovecot/imaps to exchange will I be less secure?

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
2
votes
1answer
585 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
2
votes
2answers
389 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
6
votes
2answers
564 views

The safest way to access GMail on mobile devices

There are three ways to access your GMail account on iPhone or iPad devices: 1. Use safari browser 2. Use Apple's default mail app 3. Use Google's Gmail app What is the safest way to access gmail ...
10
votes
2answers
3k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
1
vote
1answer
870 views

How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses

I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and ...
0
votes
3answers
580 views

Are Facebook, Yahoo, Google, etc. hackable?

Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain. Since I know a little bit about computers, people automatically assume I know how to have, ...
5
votes
6answers
3k views

How did the spam email sender get my name?

Some time ago I bought something online from a reputable website. I paid through my credit card and everything worked fine. The thing which is important to note is that the name used on the credit ...
2
votes
3answers
6k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
0
votes
2answers
425 views

Whether PGP is send over MIME?

If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security. When I send PGP message ...
10
votes
7answers
4k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
1answer
296 views

Does signing my e-mail with DKIM imply non-repudiation for all my users?

Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
6
votes
2answers
274 views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
3
votes
3answers
17k views

Why did secureserver.net (godaddy) access my gmail account? [closed]

Why did secureserver.net (godaddy) access my gmail account? One day later...gmail reports suspicious activity...really? So...Why did secureserver.net (godaddy) access my gmail account? ...
6
votes
2answers
1k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
16
votes
5answers
2k views

How does preventing automatic download of pictures help to protect my privacy?

When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email: "To help protect your privacy, Outlook prevented ...
5
votes
1answer
116 views

How long can I store personal information on unconfirmed subscriptions?

I have a monthly newsletter. In my subscribe form I use a double opt-in method: The visitor subscribes. I send him a confirmation email. If I receive a reply, I add him/her to my system. In the ...
10
votes
3answers
4k views

Why would someone register a Facebook account with a stolen email address?

I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
2
votes
2answers
252 views

Is it unsafe to allow apps other than Outlook to send email via the Exchange server?

My application is a .NET Windows Forms client, one of whose functions is to allow the user to send personalised mailshot emails to opted-in recipients stored in the database. The emails are sent ...
4
votes
2answers
1k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
9
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
6
votes
2answers
5k views

Malicious users trying to create yahoo accounts with random emails at my domain?

Recently, I have been getting a string of emails from yahoo with people trying to create accounts or add email addresses @mydomain.tld to their account. I was wondering if anyone else has seen this ...
1
vote
1answer
111 views

Should the email server/application be protected by 2 factor authentication? What applications should be protected?

When should email be protected by 2 factor authentication? Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
2
votes
1answer
1k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
1
vote
3answers
777 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
1
vote
3answers
237 views

Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?

Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works. I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
0
votes
3answers
204 views

What is the most reliable way to transfer emails without specific recipient support?

Many suggestions on transfering emails securely can be found in this answer. But many of them (e.g. PGP) need support from recipient. I want to provide SMTP email server that will route emails of it's ...
5
votes
2answers
461 views

How might an email do damage merely by being opened?

E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml Assuming that the user clicks no links and opens no ...
1
vote
1answer
95 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
8
votes
1answer
345 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
2
votes
1answer
2k views

What algorithm/encryption type does Gmail use for security?

In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
2
votes
3answers
443 views

Security issues with email accounts

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email, There is a ...
2
votes
1answer
308 views

Possible Hijacked Email Server [closed]

MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server. Our email server is a Virtual FreeBSD box hosted by Verio. Their ...
11
votes
3answers
9k views

Is a password protected PDF file safe for bank statement attachments?

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
0
votes
1answer
790 views

Email not received when sent by our app, received when sent by outlook [closed]

We have an application that sends mail in bulk, via a mail provider (Mailjet). Our clients are professional organizations, and they send important mails about meetings and stuff like that, to about 10 ...
3
votes
3answers
425 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
3
votes
1answer
2k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
91
votes
9answers
10k views

How can PayPal spoof emails so easily to say it comes from someone else?

When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
3
votes
3answers
173 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
7
votes
2answers
846 views

Best practices for email security

I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login). I'm interested to hear from anyone who has written an application with ...
15
votes
4answers
14k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
8
votes
5answers
2k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
3
votes
4answers
490 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
12
votes
3answers
622 views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
14
votes
9answers
5k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...