Related to email protocols, clients, servers, content, and message format.
8
votes
3answers
2k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
5
votes
5answers
100 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
57
votes
9answers
7k views
How can PayPal spoof emails so easily to say it comes from someone else?
When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
9
votes
1answer
2k views
Paypal Account created using my gmail account
Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.
I noticed that, removed the forward and changed the password. Now, I ...
5
votes
4answers
179 views
Technical security issues with proactively executing a phishing campaign targeting your own users
We've had some issues with compromised accounts due to users falling victim to phishing campaigns.
The possibility of us doing a phishing campaign against our own users to proactively shame them has ...
4
votes
2answers
94 views
Can a firewall tamper with email attachments?
I am using Thunderbird as an email client for managing my different email accounts. Yesterday my friend sent me an email with a PDF attachment. Today when I tried to open the attachment I get the ...
2
votes
1answer
61 views
If a hacker gets into my PC can he get to my saved windows live mail passwords?
If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
-1
votes
0answers
53 views
TLS Certificate in OSX Mail
My question hasn't been asked before here but when I googled for an answer I arrived at this thread @ macrumors.com. The question is quoted below:
I'm just curious, but in Lion's Mail there is a ...
5
votes
1answer
3k views
Malicious users trying to create yahoo accounts with random emails at my domain?
Recently, I have been getting a string of emails from yahoo with people trying to create accounts or add email addresses @mydomain.tld to their account. I was wondering if anyone else has seen this ...
3
votes
1answer
130 views
How to protect against exploitation of email addresses from an mistakenly expired domain?
I have a domain name that I have registered for a long time. Due to a combination of bad luck and oversight, the domain name expired and was rebought by somebody else. I am attempting to buy the ...
4
votes
3answers
120 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
-6
votes
2answers
57 views
Why my Email are received in the spam folder? [closed]
I am using Mass email marketing or shoot out email campaign but my subscriber received my mail in spam folder what are the reason of this and how can I prevent them.
Question reference: Email ...
3
votes
4answers
138 views
Safe to reply to a suspicious email?
Can something happen to me (or my computer) if I respond to a suspicious plain text email?
I received an email from an unknown address, and I am not sure if this is a "real" person.
I would have ...
0
votes
2answers
126 views
“You have new mail” message
I received a message from Google saying someone entered my email account.
I confirmed that there were an access from an IP in another country.
I have noticed "You have new mail" message when I open ...
2
votes
1answer
90 views
Securely notify users about account changes
I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes:
...
10
votes
7answers
8k views
Can my email account be accessed without the password? How secure is it?
Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to ...
6
votes
3answers
133 views
Is there any sense in using two-step authentication for personal email address?
There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
0
votes
2answers
245 views
Spam that comes from names in my address book, but not their email addresses
I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email ...
19
votes
5answers
9k views
Is it still unsafe to email credit card number nowadays?
We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.
I'm wondering if the risk is so low I don't have to call to cancel my card.
The email is sent from a ...
-3
votes
1answer
75 views
Automated scanning of personal email [closed]
I am a current user of gmail, and have recently become interested in the privacy policies of the large webmail providers like gmail, yahoo, hotmail etc. I understand that it is commonplace for them to ...
1
vote
1answer
59 views
How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA
I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
2
votes
1answer
80 views
The security of sending emails with SPF/DKIM, but not signed
We're using an email sending service (fairly known) to send our emails. We made DNS changes so that emails going through them would pass SPF and DKIM.
A few days ago we noticed that they allow any ...
2
votes
0answers
38 views
Is it the default in billing systems to send out the users password by email? [duplicate]
I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk.
One of their employees responded with ...
-1
votes
2answers
84 views
Keyloggers and Email Accounts [duplicate]
This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker.
How can these e-mails be intercepted? Let us say that I have a packet ...
0
votes
1answer
87 views
Ports used by Online Email Accounts such as Yahoo Mail, Gmail etc
Let us say that I send an email using Yahoo Mail or Gmail. Can this email be intercepted using a packet sniffer?
On which port does the email travel? HTTP, SMTP, POP3?
Thank you.
5
votes
2answers
339 views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
240 views
Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?
Our company policy is requires the local encryption of data for all email (in case the device is stolen)
Does the Windows Surface (either version) support local encryption?
Is the local device ...
0
votes
2answers
111 views
Keyloggers - Ports used by keyloggers
According to this article, keyloggers usually make use of the FTP ports and email ports:
http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html
My question is, can a ...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
2
votes
1answer
85 views
How to determine source of e-mail and verify if the source is/could be legitimate?
I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
6
votes
5answers
316 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
4
votes
1answer
164 views
Is it safe to abandon a free webmail account that has been in use for a significant amount of time?
I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address.
I have concerns around accounts that I may have ...
-1
votes
2answers
146 views
Hiding emails from Google [closed]
From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons.
If a have a group of people who want to hide their emails from Google, how ...
2
votes
0answers
109 views
User friendly PGP email [closed]
Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience?
Generate new key at first startup, rather than asking the user if they have an ...
11
votes
5answers
20k views
How to find out the IP address of email sender in Gmail
Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender.
Since Gmail ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
15
votes
6answers
790 views
When secure email, is not really secure
We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
0
votes
1answer
119 views
Using a separate email address for each contact
A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me ...
0
votes
5answers
2k views
Is update@em.facebookmail.com legitimate?
I'm having a hard time figuring out whether this email a friend of mine got is legit or a scam. The weird thing is there's only one link to facebook.com, which is the one about facebook terms. All the ...
2
votes
4answers
145 views
Open an e-mail account from only one particular system?
Is there a way to configure e-mail so that it can only be opened from one particular system? Or from multiple systems having some sort of unique key or particular static IP?
4
votes
4answers
227 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
2
votes
3answers
114 views
Is it possible to block emails (to all email accounts) that contain certain word/phrase patterns?
I'm not sure if this is the most appropriate SE group to ask this question but I'm hopeful that it will get some interesting and helpful input from the folks here before it is possibly moved.
A ...
7
votes
3answers
260 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
1
vote
3answers
127 views
How to Detect Zimbra Sniffing Trojan
I am a sys admin of our system, we are running zimbra as email server in our environment. I got the following message from the CEO.
"Everytime I send or receive an email - I get a SPAM ads a few ...
2
votes
4answers
267 views
Yahoo Email Keeps Getting Phished
I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
0
votes
1answer
166 views
How do I know if my email account has been hijacked?
A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and ...
1
vote
1answer
74 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
4
votes
1answer
173 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
2
votes
4answers
235 views
How can an internet contest verify unique votes with only an email as an input parameter?
For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
