Related to email protocols, clients, servers, content, and message format.
58
votes
9answers
7k views
How can PayPal spoof emails so easily to say it comes from someone else?
When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
26
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
2
votes
2answers
3k views
How commonly are SSL/TLS or S/MIME used by e-mail providers?
I was reading through different posts here about email security. After reading these I still have some questions.
I understand that S/MIME can be used to transfer email securely between servers.
...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
14
votes
4answers
669 views
What type of content better not to transfer by email?
Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?
I have always wondered how sensible it is ...
10
votes
2answers
376 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
6
votes
6answers
1k views
How can I send emails anonymously?
How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
6
votes
3answers
260 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
7
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
5
votes
2answers
799 views
spam with my own domain
At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spams mail with our own domain. This is obviously very prejudicial for us, because many ...
18
votes
5answers
876 views
What are the supposed security benefits of a “dead-drop” email strategy?
This was in the news recently. Here's what they were said to have been doing:
Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
2
votes
1answer
1k views
Email Spoofed. Explain?
So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
7
votes
1answer
226 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
6
votes
3answers
892 views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
0
votes
1answer
109 views
Ports used by Online Email Accounts such as Yahoo Mail, Gmail etc
Let us say that I send an email using Yahoo Mail or Gmail. Can this email be intercepted using a packet sniffer?
On which port does the email travel? HTTP, SMTP, POP3?
Thank you.
-3
votes
3answers
2k views
How to trace email?
Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
8
votes
5answers
2k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
12
votes
11answers
883 views
For users that does not use PGP, what would be the other channel to securely send them a document?
I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email.
The real question is how to do that?
...
9
votes
1answer
2k views
Paypal Account created using my gmail account
Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.
I noticed that, removed the forward and changed the password. Now, I ...
8
votes
3answers
268 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
19
votes
5answers
10k views
Is it still unsafe to email credit card number nowadays?
We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.
I'm wondering if the risk is so low I don't have to call to cancel my card.
The email is sent from a ...
2
votes
1answer
94 views
Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?
From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
11
votes
3answers
320 views
Can I expect my e-mail to be routed securely?
If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
6
votes
5answers
339 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
1
vote
6answers
2k views
Possible ways to track down anonymous mail senders?
In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things
...
8
votes
5answers
327 views
E-mail can be made to appear like it came from a big organization?
I know almost nothing about security. So, please bear with me if the questions sound silly.
Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
6
votes
2answers
379 views
How might an email do damage merely by being opened?
E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml
Assuming that the user clicks no links and opens no ...
5
votes
2answers
208 views
Is it secure to have an “email no longer available” feature on your registration form?
I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
3
votes
4answers
304 views
How can an internet contest verify unique votes with only an email as an input parameter?
For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
3answers
164 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
4answers
403 views
What Gmail features should be Opted-Out to prevent PII from being indexed?
The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).
Of the free email providers, GMail does support TLS ...
1
vote
2answers
296 views
If I migrate from dovecot/imaps to exchange will I be less secure?
I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...
0
votes
2answers
261 views
Can a man engaged in phishing be prosecuted if I know his IP?
My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
