Related to email protocols, clients, servers, content, and message format.
57
votes
9answers
7k views
How can PayPal spoof emails so easily to say it comes from someone else?
When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
27
votes
7answers
2k views
Is it illegal to read an e-mail that was accidentally sent to you?
I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)
This e-mail and ...
25
votes
2answers
3k views
What malicious things can happen when clicking on links in email?
I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
25
votes
4answers
1k views
If email is insecure, why do we use it for password resets?
I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application."
But then it struck me, Why is email considered insecure? If it is so insecure, why ...
19
votes
5answers
9k views
Is it still unsafe to email credit card number nowadays?
We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.
I'm wondering if the risk is so low I don't have to call to cancel my card.
The email is sent from a ...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
17
votes
5answers
850 views
What are the supposed security benefits of a “dead-drop” email strategy?
This was in the news recently. Here's what they were said to have been doing:
Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
16
votes
4answers
4k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
15
votes
5answers
1k views
How does preventing automatic download of pictures help to protect my privacy?
When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email:
"To help protect your privacy, Outlook prevented ...
15
votes
6answers
790 views
When secure email, is not really secure
We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the ...
15
votes
3answers
709 views
How can I protect against email tracking services?
Recently a free service came out for email tracking, bananatag.
It's able to track the fact that the email was read in gmail without any notice or strange inclusions in the email body. In this case ...
13
votes
4answers
644 views
What type of content better not to transfer by email?
Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?
I have always wondered how sensible it is ...
12
votes
11answers
866 views
For users that does not use PGP, what would be the other channel to securely send them a document?
I would like to send a document that is confidential to users that have no clue what PGP is (so no point in teaching them how to install it etc...) via email.
The real question is how to do that?
...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
11
votes
5answers
20k views
How to find out the IP address of email sender in Gmail
Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender.
Since Gmail ...
11
votes
3answers
303 views
Can I expect my e-mail to be routed securely?
If I connect to my e-mail server via SSL (SMTP/SSL) and the recipient also only checks his e-mail via SSL (web/https or IMAP/SSL), does this - generally speaking - increase the security for the ...
10
votes
7answers
8k views
Can my email account be accessed without the password? How secure is it?
Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to ...
10
votes
4answers
685 views
Why would someone want to block images in email?
While there is the possibility that this is just to prevent people from viewing offensive images against their will, somehow I don't think that's the reason why pretty much every email client defaults ...
10
votes
6answers
861 views
Identity-Based Encryption - how secure is it?
I was always taught never to invent my own crypto algorithm, and never to trust someone who has a proprietary algorithm.
I'm looking at Voltage SecureMail, which uses IBE (identity-based encryption) ...
10
votes
5answers
384 views
what would be a good way for a doctor to send xrays encrypted to another doctor?
As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted?
Our organization currently requires that all ...
10
votes
2answers
367 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
10
votes
2answers
375 views
Is email more secure when not letting any zipped content through?
Ah. This is a bit of a soft question, but I though there might be some here that can share some insight.
I'm a developer. Sometimes I need to send a (bugfixed) DLL or EXE file to a customer. If this ...
9
votes
6answers
370 views
Security of email [duplicate]
Possible Duplicate:
How commonly are SSL/TLS or S/MIME used by e-mail providers?
Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob.
Alice goes to gmail ...
9
votes
2answers
552 views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
9
votes
2answers
977 views
Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use
I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
9
votes
1answer
2k views
Paypal Account created using my gmail account
Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her.
I noticed that, removed the forward and changed the password. Now, I ...
8
votes
4answers
290 views
Next steps after webmail account was compromised
John Doe told me the following story:
I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
8
votes
4answers
377 views
How to ensure account security when accessing emails when overseas?
First of all, I hope this is the right stackexchange to ask this. Seems to be most relevant here.
Now, if one is planning to go overseas and he/she has a lot of data on the email account (say, gmail) ...
8
votes
4answers
553 views
When registering for most websites, why do you need to confirm your email address?
I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future ...
8
votes
5answers
319 views
E-mail can be made to appear like it came from a big organization?
I know almost nothing about security. So, please bear with me if the questions sound silly.
Is it possible for a malicious person to make an e-mail appear as if it came from a big company like ...
8
votes
2answers
369 views
Is it bad to only sign some of a domain's emails with DKIM?
Is it OK if I sign a subset of domain emails, or is this an all-or-nothing game?
We use Amazon's Simple-Email-Service for sending e-commerce emails.
We would like to sign these with DKIM.
This same ...
8
votes
3answers
2k views
Why would someone register a Facebook account with a stolen email address?
I witnessed an interesting attack today. Someone was able to register a new Facebook account with the email address of a friend of mine. We don't know how it happened, because Facebook requires you to ...
8
votes
1answer
193 views
PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?
I'm quite new to OpenPGP and am just starting to use it with Thunderbird.
When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
7
votes
4answers
5k views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
7
votes
3answers
328 views
How Reliably do mail systems transmit Encrypted PDFs
We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers.
We have tested the pdf's through the usual cast of internet mail ...
7
votes
2answers
758 views
How do I encrypt the source and destination IP address, along with various parts of an email?
If the subject makes no sense to you, that's fine, it makes no sense to me.
I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
7
votes
1answer
221 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
7
votes
1answer
124 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
7
votes
3answers
260 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
6
votes
3answers
258 views
How do I securely exchange server logins with remote developers?
I work for a virtual organization (we're all remote) that uses a lot of freelancers/subcontractors.
Very often I need to exchange SSH login information with developers working on projects for us. How ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
6answers
841 views
How can I send emails anonymously?
How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
6
votes
5answers
314 views
How do I safely inspect a suspicious email attachment?
I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
6
votes
3answers
256 views
What are common/official methods of reporting spam/phishing/nasty-grams to organizations?
A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
6
votes
4answers
425 views
Why is it even possible to forge sender header in e-mail? [duplicate]
With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the ...
6
votes
5answers
377 views
How do spammers verify the validity of a huge amount of email addresses?
I noticed that there is an email address validation method, that is to telnet to a email MX server and send rcpt command to the server.
But for this method, the MX server may abort connection after ...
6
votes
3answers
378 views
Is TLS flawless enough to prevent eavesdropping carried out by an ISP?
I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.
Will that prevent ISP and ...
