Tagged Questions

Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
5answers
568 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
4
votes
4answers
318 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
8
votes
6answers
570 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
-1
votes
2answers
126 views

Can 2FA help handle mixed personal and business accounts after leaving a company?

I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
3
votes
1answer
270 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
4
votes
3answers
695 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
9
votes
1answer
907 views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
1
vote
1answer
276 views

Fake email sent through newsletter service: how to know who sent them?

Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
8
votes
6answers
3k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
-1
votes
2answers
306 views

sanesecurity - clamav - getting a false positive - should I bother?

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
5
votes
5answers
697 views

Is snail mail or HTTPS webmail safer for sensitive information?

I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
3
votes
3answers
333 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
0
votes
3answers
305 views

Petraeus scandal - what would have been a better way to communicate electronically [closed]

Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
18
votes
5answers
2k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
3
votes
2answers
288 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
4
votes
3answers
387 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
6
votes
2answers
234 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
3
votes
2answers
245 views

What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?

But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
2
votes
3answers
789 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
1
vote
2answers
150 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
3
votes
3answers
291 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...
3
votes
3answers
380 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
1
vote
2answers
177 views

IP attack by reading/writing data?

If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection). Are there any further/more dangerous ...
2
votes
1answer
741 views

Hosted Email Hacked, SQL injection maybe?

I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised. Basically, someone is using my ...
0
votes
5answers
744 views

How can I prevent forwarding a manipulated email?

How can I prevent someone from modifying the contents of an email they received and then forwarding it to others? Some employees cheat managers by changing the content of emails and forwarding the ...
2
votes
3answers
2k views

Email security and Home Mail Servers

Suppose you're truly paranoid (I assume the majority here identify with this?) and you don't want Google or other email service providers reading your email (to serve ads, etc). You don't want your ...
-2
votes
2answers
432 views

Learn IP address of sender of a self-destructing email

How can I know the IP address of the sender who sent me a self-destructing email? If not the IP address... what all information can be extracted?
4
votes
2answers
211 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
7
votes
6answers
899 views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
11
votes
5answers
644 views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
1
vote
2answers
2k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
3
votes
2answers
1k views

I'm currently receiving a targeted attack

Since yesterday, I receive forged mails which are targeted at me. They use personal information, seem to come from one of my friends and only contain links to these web sites: http ...
3
votes
1answer
180 views

Amavisd-New and Google safe browsing

I am studying the Google Safe Browsing. How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing? Do ...
1
vote
3answers
721 views

Instant access to application using token in url

Is it good idea to give access to the site using token in url, this token can be send via email, some sites have reset password done in this way, but I want give access to the whole site (I think I ...
6
votes
3answers
6k views

Is it possible for a phishing link to install a major virus on a Mac?

My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account ...
2
votes
2answers
172 views

E-mail Server Security

In recent news, Bitcoinica was compromised by an e-mail server infiltration. The hacker then applied social engineering, using one of the administrative e-mail accounts to reset the root credentials ...
9
votes
5answers
2k views

When registering for most websites, why do you need to confirm your email address?

I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
3
votes
4answers
2k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
3
votes
3answers
1k views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
3
votes
2answers
2k views

Send credit card info by email from HTTPS and SMTP on SSL

A client asked me to receive credit card info of his costumers by email. I know that is a very very not secure way ... But if the page with the input form is on HTTPS, and then i use a smtp (like ...
5
votes
2answers
507 views

what are some instances of compromises due to email sniffing?

Since emails are usually sent in plain text and bounced through a bunch of SMTP relays it is potentially possible for a well placed attacker to sniff for these and read emails without being able ...
7
votes
2answers
2k views

secure webmail provider

Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account ...
-1
votes
2answers
195 views

What are the security advantage of new redirecting method used by Gmail and Facebook?

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?
2
votes
4answers
157 views

The email system is compromised - what can you do?

I have a friend at a 7 person company which has an issue with email confidentiality. Each time they send out an email with quotes to customer, the competitor get the message in 30 minutes and send ...
5
votes
3answers
377 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
54
votes
5answers
15k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
2answers
536 views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...
2
votes
2answers
150 views

Are these email captchas legitimate?

The last week, I've been getting this kind of emails to addresses that I don't use: Dear Sir, Madam, For security reasons and as part of our ongoing fight against spam, it is our policy not ...
0
votes
2answers
368 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
-3
votes
3answers
161 views

I use an online email provider - how can I test my password strength?

I want to test my password strength, is there a program out there that can crack my password relatively quickly? I am familiar with BackTrack 5, but I usually use it to test WEP password strength. I ...