Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

10
votes
3answers
735 views

Can we make sure that the new Lavabit certificate is not under control of the FBI?

After the Lavabit shutdown, Ladar Levison (founder of Lavabit) announced that he’s "looking into setting up a site where users can download their data". Such a site is now online: ...
2
votes
2answers
1k views

Scan password protected email attachments for malware

We have an email policy that prevents email from going through if it has password protected archive files attached. This is to protect users from viruses and trojans because the contents of the ...
2
votes
1answer
2k views

How to secure my network, laptop, ipad and email accounts which are possibly hacked?

Background Last month I noticed lots of failed emails in my inbox and after few minutes I lost my access to my Yahoo Mail. My friends informed me that they have received spam emails from me. So I ...
5
votes
5answers
3k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
1
vote
1answer
444 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
1
vote
1answer
1k views

How can a gmail recipient open email in two different countries, at the same time?

I sent an email to person in Russia, and tracked it with Right Inbox, when the email is opened I get notified. The problem is I get 2 different IP addresses, one in Russia, and one in the US, both ...
0
votes
1answer
95 views

Would this form of more seamless e-mail confirmation be secure?

When you ned to confirm that an email address belongs to a certain visitor to your site, would it be insecure to do it as follows: When the user visits your site, you give them a session token as a ...
-1
votes
1answer
80 views

What are the security features of the proposed “secure email” from Brazil? [closed]

Brazil has announced that they will create a secure email alternative in light of NSA spy programs. The company Correios will be implementing the contract over the next year or so. What are the ...
2
votes
5answers
2k views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
1
vote
2answers
501 views

Email spam targeted at a pair of users

Two users on my domain are receiving spam emails that have both of their emails in either the To: and/or CC: fields. There are many other users on the domain, but only these two are receiving spam ...
-2
votes
2answers
393 views

gmail account hacking [closed]

I keep getting messages that my sign in to my gmail account has failed. I am not trying to get into my account. I did go in and change my password this morning because of that. What do I do now? I ...
2
votes
1answer
4k views

What is cleardot.gif next to the senders signature in Gmail? [closed]

I am concerned that my computer has been compromised because I sent an email out - but now I noticed that there is a link in the email I did not insert, and I am worried I have a virus or something. ...
4
votes
1answer
91 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
1
vote
1answer
356 views

While copying data from any email client to a USB device what residue information is left on the PC?

I often end up using netcafe's for browsing web (Windows 7). I recently wanted to download some secure data from my gmail account on to the USB pen drive. So, I went ahead and opened the attachment ...
5
votes
5answers
17k views

Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses?

Someone has sent a sensitive email from my Gmail account. I wanted to trace the IP address by checking out the Received: by X field in the header of the sent message. However, every message that is ...
5
votes
1answer
371 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
-1
votes
1answer
515 views

Secure Portable Mail Client [closed]

I want to store all my email on a portable client on a USB drive if possible. My aim is to protect the stick with an encryption if possible so that if I remove the USB stick all traces should be gone. ...
3
votes
1answer
761 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
0
votes
2answers
1k views

Safe to email images with personal information? or use encryption for images?

It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit? Regarding plain ...
1
vote
1answer
91 views

Bootstrapping dual SMIME certificates for signing and encryption?

To maintain the non-repudiation property of signing while still having escrow for the encryption key, it's recommended to have a separate certificates (and pub-priv keys) for signing (say CertSign) ...
2
votes
2answers
169 views

It it a good idea to whitelist inbound email using a Hash on the address? (Similar to BATV, but with DKIM)

Problem Statement I'm looking at ways to ensure that business partners, or emails from trusted senders, never get quarantined; ....in other words prevent "ham being seen as spam". Ideally this ...
0
votes
1answer
196 views

email on hosting company's site hacked?

I have a friend who's has a site hosted by a company in the states. They think that someone has gotten access to their email account because any requests for support submitted via their website ...
4
votes
4answers
2k views

What is the easiest way for a newbie to RSA to create & use a key pair on Windows?

So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me. Am wondering what is the simplest way for me as a newbie to generate ...
9
votes
1answer
1k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
1
vote
1answer
607 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
26
votes
3answers
2k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
12
votes
3answers
1k views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
5
votes
7answers
2k views

Is PGP combined with a regular web-based email service secure?

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
15
votes
3answers
395 views

What expectation of privacy is there with US-based vendors with the LavaBit and SilentCircle shutdown?

Lavabit hosts a secure messaging service that was recently shut down. Likewise SilentCircle has preemptively done the same thing with their email-based service. It seems that the justification for ...
2
votes
3answers
3k views

How to check if range of IP addresses are SPAM blacklisted?

While it's easy to check if a single IP address is blacklisted for SPAM using for example http://www.spamcop.net/bl.shtml, then is there a way to check multiple addresses at once? For example how to ...
0
votes
2answers
288 views

Danger in opening spam emails on Ubuntu operating system [closed]

Some emails are suspected to be viruses; Because of that, the email service store categorizes them as spam. Or some pages are suspected to be viruses, and new browsers classify them as harmful pages. ...
1
vote
2answers
471 views

Alternative Email Provider [closed]

As a continuation to Why would someone trust DuckDuckGo or other providers with a similar privacy policy? it seems like we already have a secure way to make a search without writing history and etc. ...
4
votes
5answers
238 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
-2
votes
2answers
145 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
6
votes
1answer
184 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
3
votes
3answers
398 views

How to know if mail is for tracking our IP

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images. My query is that how can we get to ...
5
votes
2answers
316 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
1
vote
1answer
4k views

Which IP address in email headers is the sender's? [closed]

I have the headers from some emails I've received. There are several IP addresses in these headers. Which one belongs to the sender? Is the address in the headers reliable? Example 1: Delivered-To: ...
10
votes
5answers
854 views

Is there any security benefit of not using email services recently associated with PRISM?

After the recent disclosure of several major email providers cooperating with NSA, is there any real security benefit of not using these email services and choose some alternative instead? Such as ...
3
votes
3answers
99 views

Security of remailers

A layman's question: If I don't err, with remailers or analogous systems one sends a message to a node of a chain of nodes, which collectively perform the entire transmission. However, the message to ...
2
votes
1answer
334 views

Why should I pay for an email S/MIME certificate?

There are quite a few SSL certificate companies out there that offer free email S/MIME certificates. There are also paid versions as well. I need about 6 email certificates for some company email ...
2
votes
1answer
223 views

Using X-actual-recipient to divert email

Has anyone noticed exploits involving the use of "X-Actual-Recipient" to covertly divert e-mail from an intended recipient to someone else? I have been told that only someone with root access on the ...
3
votes
3answers
817 views

Where to get/buy a CSR generated S/MIME certificate

I'm not sure if the question is eligable for this board as I ask for concrete service providers which can be kind of advertisement, but there is also technical issue involved, so I give it a try. My ...
7
votes
2answers
448 views

Is personal email hosting really secure?

One of my friends has his own personal email hosting. Let's assume for the sake of argument that it is "secure", meaning that no third party can read the emails in his server either through hacking or ...
3
votes
2answers
867 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
-5
votes
1answer
235 views

Spam mail from my yahoo mail [closed]

Couple of days back spam mail(screenshot link) was sent to all my contacts from my yahoo account, and in my account activity page there is a yahoo partner logged in, from Peru (screenshot link) during ...
5
votes
1answer
1k views

is it possible to sniff email content inside network?

I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the ...
5
votes
4answers
470 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
2
votes
3answers
1k views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...