Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

-2
votes
0answers
11 views

verification code problem, can't continue on my Yahoo inbox

Please help. I can log in with my Yahoo but it needs a verification code to continue to my inbox and I've lost my phone.
4
votes
3answers
5k views

Suspicious email with my information in it: what do i do?

I just received this email: Billed To: d**********@****.NET John ****** Order Number: M1V62***2711 Receipt Date: 07/12/12 Order Total: $699.99 Billed To: Credit card Item Number Description ...
0
votes
2answers
42 views

How can I stop an account I don't control from sending spam email in my name to my contacts?

Recently I received an email from a friend with "My" email to them attached. The email "I" sent them was obviously spam, one of those "You have to see this..." emails. The email had been sent to ...
-6
votes
0answers
43 views

look to crack email account password (server uses LDAP/Kerberos ) [on hold]

Looking to test the security of my email password. University server that uses LDAP. Is it possible to find the password?
0
votes
0answers
13 views

Dropbox with Google url encoding for file download [on hold]

I have been working on a case trying to identify the vector for an infection that had occurred. I have found an e-mail msg that contained a link that did not trigger a blocking event. For obvious ...
2
votes
1answer
63 views

How does this encrypted webmails works?

In the last days I was looking on Tutanota, ProtonMail, LavaBoom, and others webmails that promise to respect users privacy. For all those, the one I most liked was Tutanota. I did few tests with ...
-3
votes
2answers
77 views

Can free email provider's partners and affiliates read your emails? [closed]

I read that if you use free email, these entities have access to your very personal info!: "Your email provider company itself, like Google Their partners and affiliates Your ISP Various ...
1
vote
2answers
86 views

Disposable mail for anonymity

Initially asked in bitcoin, I wanted to know how is it supposed to be used for anonymity. I mean that I need to register wallets and buy bitcoins. For anonimity, guitedlines recommend to use ...
2
votes
1answer
32 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
1
vote
1answer
60 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
4
votes
2answers
114 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
1
vote
1answer
29 views

Short Lived Email account for VPN signup [closed]

I'm curious about how the process of signing up for a VPN service with a short lived 'disposable' email address would work. Firstly, what benefit (if any) is there to creating the account ...
2
votes
0answers
57 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
1
vote
1answer
37 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
1
vote
2answers
47 views

Are there any anti-virus programs that have a bot that clicks email links? [closed]

Just started a new job, and it looks like we have some bots that are clicking every link in some % of e-mails. The problem is, I can verify that at least a few of these people are real. The only ...
7
votes
2answers
45 views

Does Outlook “trusted domain” actually do any sort of checking?

When you receive an email containing pictures from a new domain in Outlook you can right-click on the address and "Mark this domain as trusted" which will autoload all the photos on future emails. ...
0
votes
0answers
32 views

What is the best online email client which supports GPG? [migrated]

I am looking for an online email client which supports GPG (or PGP). I know it is not suggested for the privacy and safety but for a reason I need it. Do you know any good online service for this ...
1
vote
0answers
20 views

Outlook not updating certificate [migrated]

Outlook is refusing to send an encrypted email to a recipient whose certificate recently expired. The recipient sent a signed email and I exported the certificate to a ".cer" file then updated their ...
5
votes
2answers
205 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
26
votes
3answers
2k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
1
vote
5answers
100 views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
0
votes
1answer
63 views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So ...
0
votes
0answers
56 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
2
votes
4answers
33 views

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
19
votes
3answers
3k views

How does Bayesian poisoning work?

This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it. The first case, where a spammer sends a spam with a payload (link, malicious ...
16
votes
9answers
3k views

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...
0
votes
1answer
52 views

What is the risk of using SHA1 in PGP email signatures?

SHA-1 is being phased out by a lot of major companies due to vulnerabilities. For example Chrome no longer considers it safe for public web PKI. Is it insecure to use SHA-1 for PGP email signatures?
1
vote
2answers
38 views

Dealing with Spam with an unkown party harvesting the email address [closed]

I have a situation where I keep receiving spam from several IT companies (solicitations, marketing etc.). I think I gave away my email to a company in the last couple of years for reading a white ...
11
votes
3answers
298 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
0
votes
4answers
295 views

How can I scan hosted POP3 or IMAP e-mail for viruses?

In our company we use a hosting provider for e-mails and it seems they don't scan incoming email against viruses. And our employees does not very careful about attachments... So we deal with virus ...
1
vote
1answer
37 views

How someone would routinely email out a Google Doc [closed]

I have seen an issue where an account has been compromised and someone is routinely emailing out the contents of a google doc to another gmail account. The account password has been changed and the ...
1
vote
0answers
25 views

Website Link in Signature corrupted while transmission [closed]

We placed our website link in our email signature for last one week. This link apparently converted into something corrupt, so all our mails gets bounced. We scan our web server files using ClamAV ...
1
vote
2answers
203 views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
0
votes
2answers
34 views

Does forwarding email result in an extra “persistence” of it's copy?

I understand that when an email is sent from point A to B, it can persist in other locations while in transit from A to B. When forwarding email, can this increase the extra locations where one's ...
0
votes
1answer
42 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
2
votes
2answers
671 views

How to prove someone sent an email to you?

There are similar question about how to prove YOU sent an email, but I want to know if it is possible to prove a 3rd party sent an email to me. An individual sent some very threatening emails to my ...
4
votes
3answers
161 views

How do I recover from an email breach?

I recently reported a religious figure who gave me extended harassment lasting a period of months. Details preferably withheld for now. A few days ago, I noticed something a little bit off from my ...
0
votes
1answer
29 views

From a deployment and OPS perspective, should a S/MIME signing and encryption key have different expiration dates?

Assuming the client supports different keys, what is some rationale that should be considered for signing and encryption keys? The encryption key needs to be present on each device that is used to ...
29
votes
4answers
20k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
0
votes
1answer
35 views

How do apps tell if there is a problem with ssl?

Email clients and other software use ssl. But what if someone is doing a mitm with sslstrip? how can i tell?
0
votes
0answers
44 views

Webmail for both deepnet and clearnet [closed]

I am looking for a free anonymous encrypted webmail I can access from both tor and the clearnet (i.e., no .onion) that is not based in the U.S., Canada, or in any way connected to a U.S. company.(I ...
5
votes
1answer
173 views

What are the security differences between SMIME email and PGP email? [closed]

Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP? Example comparisons Security ...
21
votes
2answers
1k views

Does this CSS code expose if a message is read, and how long they have been reading it?

This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted. They also claim it works in pretty ...
0
votes
1answer
52 views

Outlook Client and DKIM [closed]

We have our domain email setup with SPF and DKIM - both which seem to be operating normally. When sending emails from webmail, DKIM (and SPF) are working correctly. We have some users using Outlook as ...
8
votes
2answers
473 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
1
vote
0answers
38 views

what security features a good Email Service Provider (for marketing) should have?

To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors? In other ...
3
votes
1answer
65 views

Any reason for a user to use an email scanner if they don't use any offline mail clients?

I typically recommend that users enable a real-time email scanner (aka a mail shield) in order to detect a possible vector used by malware. Even if they don't use an email application, the rationale ...
6
votes
3answers
116 views

Is e-mailing personal information significantly riskier than transmitting the same information another way?

I've been asked by bankers, school administrators, insurance agents, car salesmen, realtors, you name it to send them all kinds of information over e-mail over the years. Everything from my address ...
2
votes
3answers
176 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
3
votes
1answer
73 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...