Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

5
votes
4answers
121 views
+50

Sending password reset links in email

Nowadays, when everyone tries to be more secure then the other one, when companies spend billions on information security, it's seems a little bit odd that the password reset left behind, the place ...
1
vote
0answers
15 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
-1
votes
3answers
53 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
3
votes
1answer
509 views

Where do I report a friend's email account that has been hacked?

I just received an email from a friend's email account that conforms with the standard hoax where the person says they are traveling, have been robbed, and need money to pay for the hotel bill to get ...
206
votes
15answers
9k views

Tracing the location of a mobile IP from an email

I'm a TV scriptwriter - and not hugely tech-savvy, so please bear with me... If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know ...
6
votes
1answer
167 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
3
votes
3answers
179 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
0
votes
0answers
18 views

Certificate not showing up for signing in Outlook

I have a new ECA certificate installed on my Windows 7 machine, but when I use Outlook it is not letting me change the signing certificate to the new certificate, but it does let me change the ...
14
votes
2answers
16k views

Is it possible to use S/MIME in the web client of Gmail?

I could not find any options in the web interface of Gmail. All I could find was a Firefox plugin to use S/MIME with Gmail, but it seems to be outdated.
2
votes
2answers
207 views

How to tell if an email is encrypted, or just corrupted?

Ran a recovery program (Kroll Ontrack) on a Windows 7 PC and recovered many, many emails. Almost all of them open in my Windows 10 mail client (and Thunderbird), except for a handful from this March. ...
-1
votes
1answer
474 views

SQLMAP --OS-SHELL error [closed]

root@kali:~# sqlmap -u http://www.a***********.com/info.php?id=2 --os-shell _ _ _| |_____ _ {1.0-dev-nongit-20150907} | -| . | | | .'| . | || |||||,| | || |_| ...
5
votes
5answers
2k views

Security of faxes vs emails

Background The other day a friend who works in healthcare asked me which method of communication was more secure, faxing or email. He qualified his question by saying that his office faxes patient ...
2
votes
1answer
46 views

Are there any standard practices for protecting against malicious links being entered in a public form?

A website I'm working on needs to have a form for any visitor to submit a request for information about a service. The user will not need to create an account, and contact details are just part of the ...
1
vote
1answer
25 views

relationship between anti-spam solutions and whois databases

Are there anti-spam SMTP proxies(like ASSP, qpsmtpd) or e-mail spam filtering solutions in general(like SpamAssassin) out there which create for example block filters based on objects in RIR ...
1
vote
1answer
340 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
16
votes
3answers
10k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
0
votes
1answer
109 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
2
votes
1answer
67 views

Can I trust Google Scripts on sites like Labnol?

For example, consider this script. It requires me to grant permission to my Gmail account, but I'm confused why this is necessary -- is it not myself who is running the script? Or is my data going ...
0
votes
1answer
69 views

Email sending out spam to many contacts

I'm asking on behalf of a friend. A few days ago, I received a email with his full name (with no subject), thought that's from him. But when I opened it, there was only an obvious spam link, and I ...
3
votes
1answer
79 views

Where can I find a feed of actual spam emails? [duplicate]

I am looking for a feed of e-mail spam messages. I searched for one but found nothing that I can use. Does anyone know a site or service that offers a feed of actual spam messgaes that are currently ...
8
votes
3answers
251 views

Is it enough to look at the sender's email address?

I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by ...
1
vote
2answers
190 views

Is this a legitimate Microsoft email or is this a Phishing email and how can I tell?

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application. Today I got the following email: So given my above background this ...
6
votes
1answer
680 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
3
votes
1answer
118 views

How to secure/cleanup my accounts after having an old email account breached

I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth ...
2
votes
3answers
139 views

Emailing debit card details to a guesthouse

I'm trying to arrange a holiday out to the Aran Islands, and the guesthouse emailed me back confirming that they do have a room available. But here is the catch: they want me to email my credit card ...
1
vote
1answer
85 views

How can I contract an email tracking service and be silent about it?

I use a customized e-mail and my web-master, who is also the domain owner, doesn't allow me to see the settings that the DNS provides. Some DNS services provide, beside domain name registration, ...
5
votes
1answer
2k views

Gmail may be hacked - bulk spam emails being sent FROM Google apps account

I have a Google Apps email (Gmail with my own domain) - let's call it John@example.com. 3 days ago many people in my address book were sent a spam email FROM my John@example.com account. When I ...
3
votes
1answer
194 views

Why does my SHA256 certificate get encrypted with 168 bit 3DES?

We use S/Mime certificates for internal emails within our company. The certificates signature algorithm are all SHA256RSA with a hash of SHA256. I have confirmed the public keys are RSA(2048bits). ...
0
votes
1answer
63 views

Avast attempts to connect to the Internet when I try to download email [closed]

The file AVAST (Software\Avast\AvastSvc.exe) tries to connect when I check my email. When I forbid access to the internet for AvastSvc.exe, I can't connect to POP3 & SMTP. I'm not sure where all ...
1
vote
0answers
37 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
4
votes
1answer
84 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
2
votes
0answers
37 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
2
votes
1answer
244 views

How Risky is Paribus?

Paribus (https://paribus.co/) is a service that automatically gets money back for you if there's a price drop on a product you purchased. It seems to work by monitoring your email, to which you must ...
4
votes
0answers
135 views

Using your full name as your work email address? [closed]

Standard practice in the workplace appears to be using your full name as your email address. This presents some privacy concerns to me. Even though we all grew up being told it's advisable to use a ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
2
votes
5answers
3k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
29
votes
5answers
3k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: ...
0
votes
2answers
58 views

Reducing the success ratio of email harvesting

Would / does the following work to hamper email harvesting by spammers ? Since spammers - among other things - do automated email harvesting by looking for email addresses in web pages, it follows ...
-3
votes
2answers
113 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
3
votes
1answer
81 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
1
vote
1answer
22 views

How does Mail.app handle account credentials?

I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
3
votes
3answers
230 views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
1
vote
2answers
83 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
16
votes
4answers
21k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
1
vote
1answer
26 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
1
vote
1answer
43 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
9
votes
2answers
3k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
11
votes
2answers
647 views

Replay attacks and PGP email encryption

From my understanding of PGP email, the following is possible: Alice sends a message to Bob. Then Bob can take that exact same message and send to Carol while making it seem to Carol like it is from ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
14
votes
3answers
6k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...