Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

7
votes
5answers
2k views

Privacy issues with email providers [closed]

I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
1
vote
1answer
484 views

What user was this spammer trying to authenticate as?

I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay. Is it possible to determine what username they are trying to ...
4
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
1
vote
2answers
938 views

How is mail automatically sent from my account?

Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of ...
2
votes
1answer
321 views

Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?

Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability? Some definitions to get everyone on the same ...
3
votes
2answers
314 views

Securely storing (email) lookup database

Looking for suggestions on implementing a server-side lookup table, where the key is an email address. Goal: Keep these email address private, even if data on the server is stolen. Assumptions: The ...
3
votes
1answer
411 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
3
votes
5answers
785 views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
5
votes
6answers
343 views

Spam fighting idea

I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work. Someone sets up a reputation-based site, much like stackexchange sites, where ...
3
votes
2answers
170 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
1
vote
2answers
168 views

Which MTA don't have antivirus check for outbound emails?

I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
4
votes
3answers
324 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
2
votes
2answers
405 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
10
votes
2answers
3k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
3
votes
2answers
661 views

Do fake-address generators work?

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
1
vote
2answers
825 views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
2
votes
1answer
623 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
2answers
511 views

If I migrate from dovecot/imaps to exchange will I be less secure?

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
1
vote
1answer
892 views

How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses

I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and ...
0
votes
2answers
444 views

Whether PGP is send over MIME?

If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security. When I send PGP message ...
0
votes
3answers
592 views

Are Facebook, Yahoo, Google, etc. hackable?

Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain. Since I know a little bit about computers, people automatically assume I know how to have, ...
3
votes
3answers
173 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
1
vote
1answer
304 views

Does signing my e-mail with DKIM imply non-repudiation for all my users?

Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
6
votes
2answers
279 views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
3
votes
4answers
496 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
6
votes
2answers
1k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
3
votes
3answers
18k views

Why did secureserver.net (godaddy) access my gmail account? [closed]

Why did secureserver.net (godaddy) access my gmail account? One day later...gmail reports suspicious activity...really? So...Why did secureserver.net (godaddy) access my gmail account? ...
16
votes
5answers
2k views

How does preventing automatic download of pictures help to protect my privacy?

When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email: "To help protect your privacy, Outlook prevented ...
4
votes
2answers
1k views

If I send an email over SSL, will it always be transmitted over SSL?

This is largely a question of how MTAs and different components communicate. I'm curious that if I send an email using SMTP over SSL to my MTA, can it's next jump to the next MTA or MDA be insecure? ...
2
votes
2answers
259 views

Is it unsafe to allow apps other than Outlook to send email via the Exchange server?

My application is a .NET Windows Forms client, one of whose functions is to allow the user to send personalised mailshot emails to opted-in recipients stored in the database. The emails are sent ...
2
votes
1answer
312 views

Possible Hijacked Email Server [closed]

MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server. Our email server is a Virtual FreeBSD box hosted by Verio. Their ...
1
vote
3answers
798 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
1
vote
1answer
111 views

Should the email server/application be protected by 2 factor authentication? What applications should be protected?

When should email be protected by 2 factor authentication? Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
2
votes
1answer
1k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
0
votes
3answers
213 views

What is the most reliable way to transfer emails without specific recipient support?

Many suggestions on transfering emails securely can be found in this answer. But many of them (e.g. PGP) need support from recipient. I want to provide SMTP email server that will route emails of it's ...
1
vote
3answers
243 views

Is email between 2 parties secure if both mailboxes are on the same server and both clients use SSL?

Sorry if this is incredibly basic, but I'm not very familiar with how SMTP works. I have a mail server (running Postfix with Dovecot) with an SSL cert from a well-known/accepted CA installed and ...
5
votes
2answers
466 views

How might an email do damage merely by being opened?

E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml Assuming that the user clicks no links and opens no ...
1
vote
1answer
98 views

Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts)

FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information. They then use social engineering / persuasion to complete the attack. What ...
5
votes
7answers
3k views

Can I reclaim ex employee gmail account?

This is the best place in SE I can find to post this. We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com He left the company and ...
8
votes
1answer
359 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
2
votes
1answer
2k views

What algorithm/encryption type does Gmail use for security?

In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
2
votes
3answers
451 views

Security issues with email accounts

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email, There is a ...
0
votes
1answer
819 views

Email not received when sent by our app, received when sent by outlook [closed]

We have an application that sends mail in bulk, via a mail provider (Mailjet). Our clients are professional organizations, and they send important mails about meetings and stuff like that, to about 10 ...
3
votes
3answers
439 views

Encrypting an email server's local drives or filesystems

Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
3
votes
1answer
3k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
2
votes
2answers
433 views

How secure is Goodlink for mobile phones when compared to Activesync?

Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink. One argument is the ...
7
votes
2answers
889 views

Best practices for email security

I writing a security layer for my app and I would like your input on updating users' email addresses (also used for the login). I'm interested to hear from anyone who has written an application with ...
15
votes
4answers
15k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
12
votes
3answers
667 views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
13
votes
11answers
1k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...