Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
2answers
66 views

Why does the ProtonMail Android app require Identity permissions?

The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require ...
7
votes
1answer
76 views

Why does Google consider Thunderbird not secure enough?

There is a special setting in Google accounts to allow "less secure applications" access to your account. If you turn this off, Mozilla Thunderbird won't work to check your e-mail. This is confirmed ...
-2
votes
2answers
64 views

Popular politicians and e-mail hacks [on hold]

Often, lately, I see e-mail servers hacked. Just recently I've heard of Hillary Clintons personal server being hacked, Turkish diplomatic/government e-mails and the most recent one: the DNC servers / ...
0
votes
1answer
23 views

Incoming email with smime.p7s attachment

This is a scenario I have at work. We're receiving emails with .p7s attached files from a single user of a company(hence the company domain for eg. abc.com) our users interact with via mail. We use ...
6
votes
1answer
179 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
0
votes
1answer
36 views

Is there a method to decrypt *.p7m file without key?

I need open .p7m message from my old PC, but I lost my old certs. Is there any method how to decrypt it without key?
3
votes
1answer
35 views

Security of “secure messaging” services

There are multiple vendors that offer so-called "secure messaging" services, designed to allow secure e-mail without the need for technology such as PGP, S/MIME or strict TLS between mail servers. The ...
2
votes
2answers
110 views

My Yahoo accounts keep making random accounts for me on other websites. Why?

I have two Yahoo email accounts. Both will randomly recieve new emails about a new account that was made under my name and my email address, however, I'm not setting up these accounts. I have had ...
3
votes
5answers
1k views

How to detect self destructing emails? How to prevent from self destruction?

Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine Now my ...
0
votes
1answer
36 views

relationship between anti-spam solutions and whois databases

Are there anti-spam SMTP proxies(like ASSP, qpsmtpd) or e-mail spam filtering solutions in general(like SpamAssassin) out there which create for example block filters based on objects in RIR databases?...
0
votes
1answer
497 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
0
votes
0answers
22 views

Sent emails have random sender email address [migrated]

A family member of mine is responding to my emails from different email addresses which are not hers. e.g. I sent an email from "me@myprovider.com" to "grandma@herprovider.com". I received two ...
-4
votes
0answers
11 views

External email from specific database going to junk folder [migrated]

I have migrated from Exchange 2010 to Exchange 2013, after which things are okay. I have four server plus two databases as below: Servers: CAS01, CAS02, MBX01, MBX02 Database: DB1 mounted on MBX01 ...
3
votes
2answers
112 views

Confirming an email address with a link

During an onboarding process, I want to confirm a user's email address by sending him a link in the form of a URL followed by a GUID as the parameter: www.somedomain.com?p=GUID What sort of security ...
4
votes
2answers
53 views

Verification-less signup when user has been invited?

The typical signup procedure is of course: Alice enters email address and desired password (and possibly other data). A verification email is sent to the address Alice provided. Alice confirms her ...
3
votes
1answer
92 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
0
votes
1answer
156 views

How to securely send bank details to someone?

I have completed my internship and my employer wants me send him my bank account details so that he can transfer me my stipend. How can I securely do this? I have Ubuntu MATE 16.04. My employer is not ...
11
votes
3answers
1k views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
4
votes
3answers
4k views

I'm getting spam e-mail…from myself?

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about ...
0
votes
1answer
41 views

s/mime edit an existing certificate

We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will ...
2
votes
3answers
117 views

Email login accepts incorrect password if everything is correct except the last digit

A quick question - wondering whether this is an accepted security practice or why this would be possible. I use a Shaw.ca email (a Canadian service provider) and I accidentally mistyped my password. I ...
1
vote
3answers
85 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
1
vote
2answers
51 views

Getting sudden spam emails with my name and city

The last three days I've been getting email spam to my Gmail account with some variation of the following body content: Hey [my name], are you from [my city]? And then there will be some random key ...
0
votes
2answers
25 views

Reconcile IMAP4 RFC with No RC4 RFC

RFC 3501 states: IMAP client and server implementations MUST implement the TLS_RSA_WITH_RC4_128_MD5. RFC 7465 states: o TLS clients MUST NOT include RC4 cipher suites in the ClientHello ...
3
votes
2answers
180 views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
1
vote
2answers
198 views

Having a consistent “don't reveal email addresses of members” policy [duplicate]

Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address. But there are two other ways our ...
1
vote
3answers
37 views

Are two DNS MX records pointing to the same IP a availability risk (single point of failure)?

Are two DNS MX records pointing to the same IP a availability risk as in a single point of failure (SPOF)? Even if there are three DNS MX records in total for example: mx1.example.com 192.168.1.1 ...
3
votes
3answers
335 views

What to consider security wise, when having a mail catch-all policy?

... a catch-all usually refers to a mailbox on a domain that will "catch all" of the emails addressed to the domain that do not exist in the mail server. Configuring a catch-all address can help avoid ...
1
vote
2answers
21 views

Does the use of the non-registered domains in SPF records introduce a security risk?

Recently I was reading about the Sender Policy Framework (SPF) record syntax on OpenSPF.com. Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by ...
2
votes
2answers
682 views

Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised ...
0
votes
0answers
16 views

PGP not decrypting when using gpg4win [migrated]

I have set up the GPGTools on OS X 10.11 and they work perfectly fine in Apple Mail, as I have verified by testing with two of my email addresses. Even in Outlook 2016 with the gpg4win plugin on my ...
0
votes
1answer
36 views

Which is better: detecting spam at receiver or source?

Background I researched a detection of spam sent out using bots. After studying different techniques used by bots to deliver spam, I have no generalised solution to detect spamming at the source ...
0
votes
2answers
45 views

Spam mails originating from botnet

Background I am working on spam detection at the receiver side,i.e where all mails are delivered,i.e at the mailserver side. Spammers are capable of sending spam mails through Bots,Open relays and ...
3
votes
1answer
32 views

Is it safe to rely on email address from 3rd party identity provider?

Assuming that a 3rd party identity provider is reliable (eg; Facebook, Google, WindowsLive), is it safe to use email address (as provided by the service) to connect a user logging in with different ...
3
votes
2answers
357 views

My friend was fired from her job. Overnight, on her personal phone all her work contacts mysteriously disappeared

As the title stated. My friend personal email is connected to her personal phone. She works on the iPad and her work iPad is connected to her work email. She never checked her personal email on her ...
1
vote
1answer
64 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...
0
votes
0answers
26 views

Is my mail web service secure? [duplicate]

I am using the mail.com web service and I cannot understand if it is secure enough. When I log in by entering my username and password, it redirects me to another page which is https and my browser ...
11
votes
4answers
16k views

Can most mail from *.ru be considered spam?

Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).
4
votes
1answer
154 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
3
votes
1answer
45 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
0
votes
1answer
763 views

Security implications for email address and url changes?

recently, we are seeing some From:, To:, Cc: addresses being rewritten from user1@companyA.com to: https://3c-lxa.mail.com/mail/client/mail/mailto;jsessionid=36725F1B090973DAF815646A3B096862-n1....
1
vote
1answer
41 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
0
votes
2answers
83 views

How am I being scammed?

I have received an email, claiming to be from Microsoft. Here is a snapshot of it: Google marked this email as spam with the following notice: These are some header details: Now, the text of ...
3
votes
6answers
27k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
1
vote
1answer
39 views

Hops encountered More for spam Mails than Legitimate Mails

Background I am working with email headers for spam detection. Each E-Mail header contains many "Received:" headers fields. Each "Received:" header is added by an intermediate Smtp/Mail server in the ...
-1
votes
2answers
797 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
8
votes
2answers
2k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
-1
votes
0answers
33 views

Preventing denial of email (Gmail)

Case 1: The attacker is or has access to MITM the ISP(3g/2g). The ISP also happens to be the GSM company. This could be because of police supervision. He is forced to use computer with a backdoor. ...
4
votes
1answer
75 views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
0
votes
1answer
34 views

Google mail - Paypal emails going directly to trash [closed]

Emails coming from paypal go directly to my trash, I noticed this today because i got a mail notification through OSx. However when i went to find the email it wasn't there. After some digging i ...