Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

0
votes
2answers
54 views

Could someone stop another from accessing their own online account?

Suppose Alice isn't able to break into Bob's email account, but Alice can still do damage to Bob (a VIP) if she can stop him from being able to use his own email (or any other online) account to send ...
0
votes
0answers
22 views

Ways to reverse simple encodings

I'm doing a blackbox website pentest for a client. I found a way to the database but the client won't accept something he doesn't understand. He's requesting users credentials. In the database the ...
-1
votes
1answer
93 views

Gmail disclosing your account name to recipients? [on hold]

My Gmail setting has forever been set to send emails with just my Gmail address as the identifier, so it should not send out my account name (first or last name)... or so I thought! Recently I got a ...
2
votes
3answers
138 views

Security of email sent/received on iPhone via Mail app

In regards to the default Mail app on iOS 8, setup with various mail accounts gmail, outlook etc. Are emails sent/received to/from the phone securely, if so, how? Can someone who is snooping on the ...
1
vote
3answers
57 views

Strong email validation. Is it really necessary?

I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide email so that a confirmation link will be sent to their email address for ...
-2
votes
0answers
52 views

Hide email sender's IP using Tor [on hold]

Hide email sender's IP using Tor I've developed a simple application to send emails using SMTP. The application connects to mail.server.com (with IP a.b.c.d) on port 587. All I want is to hide my IP ...
4
votes
1answer
40 views

phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
0
votes
4answers
124 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
0
votes
2answers
657 views

Does Thunderbird send IP address?

I send my gmail emails from thunderbird (on Ubuntu machine). I am wondering whether thunderbird sends out the IP? If so, how can I hide my IP from the outgoing emails?
0
votes
0answers
17 views

SNORT only alerting on inbound traffic

I am trying to raise an alert when someone is setting up a connection to PORT 25 (tcp), whatever source or destination. For this i came up with this simple rule: alert tcp any any -> any 25 ...
2
votes
1answer
269 views

Making a bitcoin-like secure mail protocol, how to tackle public keys?

I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way). Here's the summary(much simpler if you know bitcoin's inner workings): ...
2
votes
2answers
60 views

Email “privacy” when sending within same domain

Scenario: email is hosted third party (think Outlook, Gmail etc.) I am sending email to another person with an email account on the same domain (think from user1@example.com to user2@example.com) ...
0
votes
1answer
106 views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
2
votes
1answer
55 views

Email, Certificates and DANE [closed]

Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is jd@foo.com but mail.bar.com is the email server, ...
1
vote
0answers
24 views

Can't mail stolen session ID [closed]

I'm working on this platform: http://testfire.net/ With this script I can see the cookie: "><script>alert(document.cookie)</script> So now I'm trying to mail this cookie to me. ...
10
votes
3answers
326 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
17
votes
5answers
7k views

Is this “Domain Registration Service” email a scam?

I received an email to the email address listed on our website (it's a generic info@ourcompany.com to help "weed out" spam, whereas each employee has something like andreas@ourcompany.com to which I ...
1
vote
2answers
234 views

Getting Loads of Emails 'linking' my account to Gmail accounts I know nothing about

I have just come out of hospital and have in the region of 30 e-mails from gmail over the past few days 'linking' a gmail account to my (hotmail) email address. I have not done this once never mind ...
0
votes
1answer
20 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
1
vote
0answers
31 views

Are old Android OS's a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
1
vote
2answers
1k views

My certificate seems fine but my TLS fails (Cert not validated)

I set up my certificate for my mail server at https://mail.xxxx.com/ I exported my certificate as described in my mail servers documentation and pointed to it in the server settings. The certificate ...
0
votes
0answers
8 views

S/MIME for Mac and iOS [migrated]

I have been trying to generate S/MIME certificates for my MacOS and iOS devices and it does not seem to work. I have researched on this matter and it seems that keyUsage and extendedKeyUsage are ...
3
votes
3answers
461 views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
1
vote
2answers
104 views

is this secure: email account that can only be accessed by sending and receiving emails within gmail

i am creating a game of sorts where you use and earn credits to accomplish tasks. I am curious if you can effectively use gmail's security features to secure these submissions if the emails are all in ...
12
votes
7answers
6k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
3
votes
1answer
76 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
1
vote
1answer
106 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
23
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
2
votes
3answers
157 views

Fake “FROM” email to allocate to account

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the ...
1
vote
1answer
4k views

Yahoo Account hacked, changed pw, spam still going out elsewhere?

Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts. I changed the password, then saw (via rejected emails sent to my Yahoo ...
-1
votes
1answer
61 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
1
vote
0answers
107 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
0
votes
1answer
77 views

What does proxyexec + cagefs.server mean in the e-mail X-Source-Args?

I've the following headers in the e-mail which I've received as spam: X-Source: X-Source-Args: /usr/sbin/proxyexec -q -d -s /var/run/proxyexec/cagefs.sock/socket /bin/cagefs.server X-Source-Dir: ...
1
vote
3answers
882 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the ASCII decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
4
votes
1answer
73 views

Suspecious js file sent as email attachment

I received a js file with following code in my spam folder but I decided to take a look into the file. Do anybody of you know what does this code might do? var evl='';function nr() { evl = '}; ' + ...
2
votes
3answers
261 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
1
vote
2answers
2k views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
1
vote
3answers
654 views

Are Facebook, Yahoo, Google, etc. hackable?

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store ...
0
votes
1answer
52 views

PHP: Save e-mail address hashed or plain [duplicate]

I've been wondering about something, is it more secure to store an encrypted (hashed with password_hash) email address in the database, or just as plain text? I've google'd this matter and saw that ...
0
votes
0answers
39 views

How can I secure a reply-via-email system?

I am working on setting up a reply-via-email system (similar in functionality to what Basecamp uses) in which a user can reply to an email generated by the system in order to add a message to a ...
5
votes
2answers
93 views

Is e-mailing personal information significantly riskier than transmitting the same information another way?

I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address ...
4
votes
1answer
65 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
0
votes
1answer
49 views

Disposable mail for anonymity

Initially asked in bitcoin, I wanted to know how is it supposed to be used for anonymity. I mean that I need to register wallets and buy bitcoins. For anonimity, guitedlines recommend to use ...
0
votes
2answers
702 views

How to report abuse spam with X-AntiAbuse header which was added to track abuse?

I've received the following spam e-mail (with the link to viagra site): Return-Path: <silviani@server04.funet.co.il> Received: from server04.funet.co.il (server04.funet.co.il. [212.29.215.70]) ...
18
votes
4answers
3k views

Would 'spam' mail really avoid eavesdropping?

spammimic.com offers a service that 'encrypts' your mail as 'spam', the rationale being that all mail services automatically filter out spam, and so if you're wanting to communicate with someone ...
-1
votes
4answers
238 views

Creating a secure and encrypted e-mail service

Model People living in countries with totalitarian, oppressive and other threatening regimes should be able to use this system and have some degree of privacy when communicating. Objectives ...
2
votes
3answers
189 views

Could embedding website links in an email lead to more hack attempts?

My organization currently sends out emails directing our customers to login and view information on a customer portal site we have developed. The content of these emails is usually pretty generic ...
13
votes
6answers
4k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
2
votes
3answers
74 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
11
votes
3answers
4k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...