Related to email protocols, clients, servers, content, and message format.

learn more… | top users | synonyms

14
votes
2answers
648 views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
80
votes
9answers
9k views

How can PayPal spoof emails so easily to say it comes from someone else?

When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
50
votes
5answers
10k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
22
votes
3answers
12k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
18
votes
4answers
972 views

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
28
votes
2answers
6k views

What malicious things can happen when clicking on links in email?

I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
2
votes
3answers
6k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. ...
8
votes
6answers
3k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
10
votes
6answers
4k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
3answers
287 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
6
votes
2answers
1k views

spam with my own domain

At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spams mail with our own domain. This is obviously very prejudicial for us, because many ...
5
votes
2answers
447 views

How might an email do damage merely by being opened?

E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml Assuming that the user clicks no links and opens no ...
51
votes
4answers
2k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
17
votes
5answers
1k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
6
votes
3answers
1k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
2
votes
1answer
2k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
10
votes
3answers
550 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
8
votes
1answer
322 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
0
votes
1answer
645 views

What are the ports used by Online Email Accounts such as Yahoo Mail, Gmail, etc.?

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer? On which port does the email travel? HTTP, SMTP, POP3?
-1
votes
4answers
4k views

How to trace email?

Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
142
votes
2answers
13k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
10
votes
5answers
712 views

Is there any security benefit of not using email services recently associated with PRISM?

After the recent disclosure of several major email providers cooperating with NSA, is there any real security benefit of not using these email services and choose some alternative instead? Such as ...
10
votes
3answers
342 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
6
votes
5answers
2k views

Privacy issues with email providers [closed]

I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
4
votes
1answer
228 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
22
votes
5answers
19k views

Is it still unsafe to email credit card number nowadays?

We all know not to do it, but someone emailed my credit card number and cvv code to my gmail. I'm wondering if the risk is so low I don't have to call to cancel my card. The email is sent from a ...
13
votes
11answers
1k views

For users that does not use PGP, what would be the other channel to securely send them a document?

I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email. The real question is how to do that? ...
11
votes
2answers
3k views

Paypal Account created using my gmail account

Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her. I noticed that, removed the forward and changed the password. Now, I ...
9
votes
5answers
1k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
5
votes
4answers
1k views

Email header IP address

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
3
votes
6answers
9k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
29
votes
7answers
3k views

Is it illegal to read an e-mail that was accidentally sent to you?

I'm not sure if this is the right website to ask this but I'm giving it a shot. I got the following message in an email today: (it's translated so sorry for the typo's/mistakes) This e-mail and ...
12
votes
3answers
550 views

Can I expect my e-mail to be routed securely?

If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
6
votes
1answer
168 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
6
votes
3answers
143 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
4
votes
4answers
5k views

Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses?

Someone has sent a sensitive email from my Gmail account. I wanted to trace the IP address by checking out the Received: by X field in the header of the sent message. However, every message that is ...
3
votes
3answers
2k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
2
votes
5answers
536 views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
8
votes
5answers
428 views

E-mail can be made to appear like it came from a big organization?

I know almost nothing about security. So, please bear with me if the questions sound silly. Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
6
votes
1answer
85 views

Reading older mails signed with a certificate that has meanwhile expired

A few years ago I have used S/MIME certs to sign (and encrypt) my mails. The reason for which I stopped signing was the following: My (class 2) cert was issued on Jan. 1st 2008 (just a sample). It ...
6
votes
2answers
260 views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
5
votes
3answers
401 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
5
votes
4answers
327 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
3
votes
0answers
83 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
3
votes
2answers
118 views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
3
votes
4answers
1k views

How can an internet contest verify unique votes with only an email as an input parameter?

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
3answers
349 views

Should email verification links be 'time limited' after user registration?

Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
1answer
164 views

If most companies do not enable TLS for SMTP and IMAP, should we consider email not secure at all?

Many of our partner companies's email service do not enable encryption. Does that mean our email is not protected at all?
3
votes
4answers
473 views

What Gmail features should be Opted-Out to prevent PII from being indexed?

The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise). Of the free email providers, GMail does support TLS ...
1
vote
2answers
456 views

If I migrate from dovecot/imaps to exchange will I be less secure?

I have a client using Terminal Server and it would make some sense to use Exchange for email as well, rather than the current situation with postfix/dovecot running on a linux VM alongside - ...