Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
3answers
3k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
4
votes
2answers
164 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
0
votes
3answers
159 views

Secure design for handling mail attachments

I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific ...
4
votes
1answer
323 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
-1
votes
4answers
155 views

Is there any way to know the contact email on a contact form? [closed]

When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
3
votes
2answers
1k views

How does the Yahoo webmail exploit work?

I got an email (referring to me by name) from somebody I knew a while ago and the email itself was just two/three lines containing a bit-ly link. Although it seemed like it actually could be ...
9
votes
4answers
2k views

Good, simple list of reasons that email is inherently insecure

I've been searching for a while, trying to find a good get of information about the inherent risks of transmitting sensitive data via email. I'm really looking for a comprehensive list of all the ...
1
vote
3answers
2k views

Emails wrongly flagged as spam by filter, claiming suspicious URLs

My wife runs a small website (in Japanese) selling vintage products online. She's sending out emails to customers with details about their order, together with images of the products and links to the ...
34
votes
4answers
2k views

If email is insecure, why do we use it for password resets?

I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application." But then it struck me, Why is email considered insecure? If it is so insecure, why ...
-1
votes
1answer
145 views

E-mail with obfuscated code / no trace in e-mail server

I've got a situation where one of my clients sent me an e-mail with what appears to be obfuscated shell code. The really bizarre thing here is that I see no trace of this e-mail showing up in the mail ...
3
votes
3answers
532 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
2
votes
2answers
781 views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
3
votes
3answers
2k views

Will SHA1 of Email Addresses Always be Unique?

We want to store data about a person without storing their email address, but we want to latter connect that person with their data upon them supplying their email address. Storing a SHA1 of their ...
6
votes
4answers
3k views

Reporting a GMail hacker attack

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on ...
1
vote
1answer
222 views

Any recipient can modify an order confirmation mail, right? Does this ever matter ?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
2
votes
1answer
279 views

Email Compromised due to Yahoo Mail Exploit

On Monday due to XSS vulnerability present in the Yahoo mail my email has been compromised. I have immediately changed my password but i am not sure is this enough i.e. do i need to delete my cookies ...
10
votes
1answer
1k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
4
votes
3answers
1k views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
8
votes
5answers
664 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
1
vote
3answers
2k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
6
votes
5answers
736 views

How do spammers verify the validity of a huge amount of email addresses?

I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server. But for this method, the MX server may abort connection after ...
3
votes
3answers
115 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
4
votes
5answers
240 views

Secure file sharing, instead of attaching files to emails?

Allow me to give some background information, so you may understand my situation better. We have been prone to sending emails to unintended recipients, many of which contained confidential data. ...
-1
votes
1answer
4k views

how to trace the IP address of gmail account sender via browser [duplicate]

Possible Duplicate: How to trace email? i wanted to know the location of sender email which sent us the threat email the header of email is mentioned below Analysis: Received: from ...
2
votes
3answers
311 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
3
votes
6answers
17k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
1answer
1k views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
2
votes
1answer
151 views

Encoding HTML email content

Say I have a form on my website. The input elements of the form are: email address, name and some feedback textarea. The server-side application that this form is submitted to will send an HTML ...
1
vote
2answers
115 views

access to email addresses

I am taking part in an online voting photo contest. In order to vote, you have to register using your email address. Is it possible that people who run the site will be able to see my email address ...
5
votes
5answers
623 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
4
votes
4answers
332 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
8
votes
6answers
624 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
-1
votes
2answers
127 views

Can 2FA help handle mixed personal and business accounts after leaving a company?

I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
3
votes
1answer
352 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
4
votes
3answers
763 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
13
votes
1answer
1k views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
1
vote
1answer
287 views

Fake email sent through newsletter service: how to know who sent them?

Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
8
votes
6answers
4k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
-1
votes
2answers
320 views

sanesecurity - clamav - getting a false positive - should I bother?

A client of mine reported that he isn't getting emails sent from our domain. This is offcourse a false positive, as we are a legitimate comapny. I am also not hearing this issue from other clients (we ...
5
votes
5answers
843 views

Is snail mail or HTTPS webmail safer for sensitive information?

I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep ...
3
votes
3answers
345 views

I found a malicious website embedded in Malware spam. What should I do?

An email is using social engineering to get users to click on a malicious URL that downloads javascript and then runs malicious code. Who should I report these malicious URLs to? (Microsoft ...
0
votes
3answers
319 views

Petraeus scandal - what would have been a better way to communicate electronically [closed]

Not a security professional here but .... having read through how it happened, it's clear sending these emails from the shared account by Paula Broadwell was the problem (if I understand correctly). ...
18
votes
5answers
2k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
3
votes
2answers
320 views

Is my email client violating my privacy?

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be ...
4
votes
3answers
448 views

Allow a PA to see a director's emails, but keep some emails private

We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows: Director A wants to send an email to Director B, both director A and ...
6
votes
2answers
272 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
3
votes
2answers
269 views

What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail?

But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the ...
2
votes
3answers
846 views

Google Mail alert message. Hacker from China

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China: IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China and ...
1
vote
2answers
155 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
3
votes
3answers
301 views

I stupidly responded to an email from a hacker posing as a friend

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, ...