Tagged Questions

Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

-3
votes
3answers
161 views

I use an online email provider - how can I test my password strength?

I want to test my password strength, is there a program out there that can crack my password relatively quickly? I am familiar with BackTrack 5, but I usually use it to test WEP password strength. I ...
1
vote
1answer
436 views

Are there any security issues with importing mail via POP/IMAP?

I'd want to design import mail functionality for an email provider. The process is: user enters email and password for another service at my site and then site accesses another email provider and ...
4
votes
1answer
9k views

How do I create a valid email certificate for Outlook S/MIME with openssl?

I need to create a certificate for email encryption and signing that has to be used by Outlook 2003+. I'm using OpenSSL, my self-signed root-CA is already imported into the trusted root-CA store. ...
0
votes
0answers
220 views

What is the most secure way to recover password online? [duplicate]

Possible Duplicate: Can anyone provide references for implementing web application self password reset mechanisms properly? I have website which sends generated password to any person who ...
1
vote
2answers
547 views

Is it possible to fake the mail server address?

Suppose that I send an E-mail to someone. Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I ...
2
votes
4answers
262 views

Recently received a odd email

http://photomi.co.kr/httpcnbc9home-2.com.php?subpage216 Learn How to Make Money 0nline Fast __________________ . louanne visszakuldod Sun, 22 Jul 2012 0:33:42 Is there a way to identify what ...
6
votes
4answers
6k views

Can most mail from *.ru be considered spam?

Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).
-2
votes
2answers
423 views

End of mail spoofing?

I've made the simpliest e-mail program in C#. using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using ...
0
votes
2answers
652 views

How to encode letters in multipart/form-data to include CR/LF characters?

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like: ------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" ...
1
vote
2answers
285 views

AV inserting email header logic

I want to write a small PHP emailing class to be able to send HTML emails. My problem is that in the receiving email an antivirus will insert a header which sometimes simply breaks the entire email. ...
3
votes
1answer
170 views

Facebook changed the default email address for every contact. How do I mitigate the impact and risk?

Facebook created a problem for regulated industries and Registered Investment Advisers (RIAs) by changing the default outgoing SMTP address for every contact to a @Facebook.com address. This is an ...
1
vote
1answer
502 views

What user was this spammer trying to authenticate as?

I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay. Is it possible to determine what username they are trying to ...
5
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
0
votes
4answers
5k views

How to trace email?

Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
1
vote
2answers
1k views

How is mail automatically sent from my account?

Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of ...
2
votes
4answers
755 views

Should links to images contained in emails be secure?

We are generating emails which contain links to images: our client's branding, images showing other products offered by the client etc... What are the security pitfalls if these links in the emails ...
2
votes
1answer
351 views

Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?

Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability? Some definitions to get everyone on the same ...
2
votes
1answer
652 views

Advice if safe from mail header injection PHP [duplicate]

Possible Duplicate: PHP mail() Header Injection Prevention Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
4
votes
3answers
5k views

Suspicious email with my information in it: what do i do?

I just received this email: Billed To: d**********@****.NET John ****** Order Number: M1V62***2711 Receipt Date: 07/12/12 Order Total: $699.99 Billed To: Credit card Item Number Description ...
3
votes
2answers
328 views

Securely storing (email) lookup database

Looking for suggestions on implementing a server-side lookup table, where the key is an email address. Goal: Keep these email address private, even if data on the server is stolen. Assumptions: The ...
3
votes
1answer
439 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
5
votes
3answers
1k views

Is TLS flawless enough to prevent eavesdropping carried out by an ISP?

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic. Will that prevent ISP and ...
3
votes
2answers
176 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
1
vote
2answers
184 views

Which MTA don't have antivirus check for outbound emails?

I need to test whether MTA has antivirus check for inbound emails. To check this I need to send email with e.g. EICAR testfile from another MTA to this one. However, Gmail, Yahoo and other well-known ...
1
vote
2answers
589 views

Is spam more likely to be sent to info@example.com? Would I be better off using a different address?

I think that when bots gather domain names or process a list of domain names, they create email addresses like info@example.com or support@example.com. Does selecting something different help to ...
3
votes
5answers
914 views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...
3
votes
1answer
194 views

How to protect against exploitation of email addresses from an mistakenly expired domain?

I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
12
votes
7answers
20k views

Can my email account be accessed without the password? How secure is it?

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it? And how come Yahoo Mail asks me to tell them my friends and folders names to ...
4
votes
3answers
337 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
1
vote
4answers
312 views

Is e-mail sent from a Gmail address to another Gmail address encrypted?

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
3
votes
2answers
715 views

Do fake-address generators work?

There are several pages on the Web that generate fake e-mail addresses so spammers can harvest them; the purpose is to fight spam. (Some examples of this concept under discussion and, in some cases, ...
8
votes
3answers
1k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
1
vote
2answers
872 views

Open Source tool to block email attachments

Is there any way to stop users from sending attachments over Gmail or any web based email including private mail servers, if internet access is through a Linux box running Ip Tables/Squid etc. We are ...
9
votes
3answers
1k views

Is it bad to only sign some of a domain's emails with DKIM?

Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game? We use Amazon's Simple-Email-Service for sending e-commerce emails. We would like to sign these with DKIM. This same ...
1
vote
2answers
530 views

If I migrate from dovecot/imaps to exchange will I be less secure?

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
2
votes
1answer
682 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
2
votes
2answers
443 views

How to investigate possible illegal access by a staff member to emails?

At work we use Outlook 2010 (I think) and an exchange server. The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on ...
6
votes
2answers
625 views

The safest way to access GMail on mobile devices

There are three ways to access your GMail account on iPhone or iPad devices: 1. Use safari browser 2. Use Apple's default mail app 3. Use Google's Gmail app What is the safest way to access gmail ...
10
votes
2answers
3k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
1
vote
1answer
924 views

How to generate self-signed certificate for S/MIME with usage 'signing' only, like DOD uses

I'm testing a feature to support S/MIME mail signing and encryption. As far as I know US DOD has quite strict standard on these certificates. So that DoD uses separate authentication, signing, and ...
0
votes
3answers
614 views

Are Facebook, Yahoo, Google, etc. hackable?

Just to be clear, I am not asking how to hack in these services, I am just curious. Let me try to explain. Since I know a little bit about computers, people automatically assume I know how to have, ...
5
votes
6answers
4k views

How did the spam email sender get my name?

Some time ago I bought something online from a reputable website. I paid through my credit card and everything worked fine. The thing which is important to note is that the name used on the credit ...
2
votes
4answers
7k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
0
votes
2answers
524 views

Whether PGP is send over MIME?

If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security. When I send PGP message ...
10
votes
7answers
5k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
1answer
310 views

Does signing my e-mail with DKIM imply non-repudiation for all my users?

Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
6
votes
2answers
288 views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
3
votes
3answers
21k views

Why did secureserver.net (godaddy) access my gmail account? [closed]

Why did secureserver.net (godaddy) access my gmail account? One day later...gmail reports suspicious activity...really? So...Why did secureserver.net (godaddy) access my gmail account? ...
6
votes
2answers
2k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
16
votes
5answers
2k views

How does preventing automatic download of pictures help to protect my privacy?

When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email: "To help protect your privacy, Outlook prevented ...