Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

3
votes
1answer
56 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
2
votes
0answers
36 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
2
votes
1answer
167 views

How Risky is Paribus?

Paribus (https://paribus.co/) is a service that automatically gets money back for you if there's a price drop on a product you purchased. It seems to work by monitoring your email, to which you must ...
-3
votes
0answers
29 views

How many email accounts should one have? [on hold]

How many different email accounts should a person have, and how should they be distributed? Should there be a separate personal email, an email for online accounts and newsletters, a professional, ...
6
votes
1answer
164 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
5
votes
0answers
106 views

Using your full name as your work email address?

Standard practice in the workplace appears to be using your full name as your email address. This presents some privacy concerns to me. Even though we all grew up being told it's advisable to use a ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
0
votes
1answer
666 views

How do I force kill an OWA, Activesync, or Outlook session?

A user with a BYOD is still able to access the email system, even after the user account has been disabled and password changed. Since it's clear that a re-authentication event doesn't continually ...
1
vote
0answers
36 views

How does avast! add a signature into my webmail? [migrated]

I have the free version of avast! installed on my computer. When I just sent an email on https://mail.google.com with Firefox a signature was added, saying that the sent mail is Virus-free. ...
0
votes
1answer
276 views

Corporation Best Practices for Encrypting Locally Stored Email Data

Since the recent Sony hacks took place, the attackers have published troves of data from users' email accounts. Some of this data is very detrimental to the company's image. I suspect that based on an ...
2
votes
5answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
29
votes
5answers
3k views

Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: ...
0
votes
2answers
50 views

Reducing the success ratio of email harvesting

Would / does the following work to hamper email harvesting by spammers ? Since spammers - among other things - do automated email harvesting by looking for email addresses in web pages, it follows ...
-3
votes
2answers
109 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
3
votes
1answer
62 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
1
vote
1answer
20 views

How does Mail.app handle account credentials?

I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
1
vote
0answers
13 views

relationship between anti-spam solutions and whois databases

Are there anti-spam SMTP proxies(like ASSP, qpsmtpd) or e-mail spam filtering solutions in general(like SpamAssassin) out there which create for example block filters based on objects in RIR ...
3
votes
3answers
167 views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
1
vote
2answers
81 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
16
votes
4answers
21k views

How does someone with HubSpot Sidekick knows when I opened their sent email?

This app claims to know when recipients opened the emails that were sent to them. Tracking clicked URLs is fairly straightforward. What I don't understand is how a 3rd party can possibly know when I ...
1
vote
1answer
108 views

How to secure/cleanup my accounts after having an old email account breached

I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth ...
1
vote
1answer
26 views

Securing Web Contact Forms Against Spams

I created a web contact from with the following restrictions: An IP can send only 1 query per 8 hours. A generic text based bootstrap captcha for the form (I know this can be replaced with ...
1
vote
1answer
42 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
9
votes
2answers
3k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from ...
-1
votes
0answers
67 views

Gmail never actually deletes emails? [migrated]

I'm getting a bad feeling about gmail. I've had used it for years and lately I deleted all of my private conversations from all possible devices and folders. When I go to the search box of gmail ...
11
votes
2answers
635 views

Replay attacks and PGP email encryption

From my understanding of PGP email, the following is possible: Alice sends a message to Bob. Then Bob can take that exact same message and send to Carol while making it seem to Carol like it is from ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
14
votes
3answers
6k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
4
votes
1answer
102 views

“Hacking” account when someone uses your email?

I have, on multiple occasions, received this email from Twitter: Since I have received it multiple times either this person clearly thinks the email is theirs or it's spelled similarly, something to ...
68
votes
12answers
23k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
1
vote
3answers
1k views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
7
votes
3answers
420 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
-5
votes
2answers
661 views

End of mail spoofing?

I've made the simplest e-mail program in C#. using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using ...
1
vote
1answer
54 views

How does my unused e-mail address get spoofed? [closed]

I have 2 e-mail accounts - one on GMail and other one on a popular mail provider in my country (O2). GMail has a secondary e-mail set for security - that is the O2. I started getting e-mails from ...
1
vote
1answer
29 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
1
vote
1answer
70 views

How to deal with spam that contains my personal details?

I just noticed some spam in my inbox in GMail that is from a very suspicious e-mail address (partially redacted anonymous@webXXXXXXX.ad.aruba.it) containing a link to a similarly suspect URL ...
1
vote
5answers
77 views

Using an e-mail service anonymously [closed]

What are the options, to use an e-mail service anonymously without exposing yourself (your private info, name etc.) ?
10
votes
5answers
2k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
3
votes
1answer
65 views

How Vulnerable Is An Older Version Of Outlook As An Email Application?

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked ...
3
votes
1answer
97 views

What happens when encrypted email is in-transit?

If you're using a service that offers end-to-end encryption, what happens when you send an email to another non-encrypted email address? Let's say I write my email in ProtonMail and then send it to a ...
3
votes
1answer
161 views

Has my server been compromised? (Ransomware related)

I just received an email that corresponds to the description here, which was posted just a couple of hours ago: ...
15
votes
3answers
10k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
3
votes
1answer
80 views

How does ProtonMail manage search?

There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and sends it encrypted in some fashion (depending on what email service the recipient ...
1
vote
2answers
111 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
3
votes
2answers
87 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
4
votes
3answers
4k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
3
votes
1answer
40 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
7
votes
3answers
76 views

Best practices for sending tax data to and from a tax professional

I started doing business with my tax preparers when we all lived in the same city. Recently I moved to a different state. I requested that they send my "Tax Organizer" which contains some personal ...
2
votes
4answers
115 views

Is it possible to fake incoming IP?

I would like to whitelist an IP address on my smtp server so that non-authenticated emails on connections originating from that IP could be routed. I control that other IP, so I can make sure that ...
4
votes
2answers
93 views

Notifying users of a possible security breach

Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open. I undertook the usual steps to prevent the malware from spreading to ...