Hot answers tagged

7

No, this is not accepted security practice. But it is probably not the only service either which silently cut off the entered password after a fixed number of characters. Check out their documentation if they document this behavior. If this is behavior if not documented please contact them so that they either fix this behavior or at least make this bad ...


5

This used to be common practice in the late 70s / early 80s. Back then UNIX systems truncated user passwords to 8 character before encrypting them. Newer operating systems use algorithms which pose no (reasonable) limit on password length, but some operating systems still support the old encryption method for backward compatibility. That means the email ...


4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups. The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized ...


4

If you are uncertain whether your account has been hacked, you should immediately reset the password. If your account was hacked, some damage may have already been done, but setting a new password will prevent any further damage. However, some sites allow you to create an account without first verifying your email address. This should not be alarming, and ...


3

The token should have at least 72 bits of entropy (9 bytes, or 12 Base64 characters) This should be generated with a Secure PSRNG (random number generator). So don't use the simple rand() operator of your programming language as it might be predictable, but look for the Secure random generator that PHP provides internally , or read bytes from /dev/urandom ...


3

Thunderbird doesn't support two factor authentication, so Google has a means of generating a special credential set that can be used with Thunderbird. When configured in this way it works fine with Gmail, but I guess it is less secure than proper TFA.


3

PROS Less likely to lose an email due to human error on the sending side. CONS If you're running anti-spam / antivirus that's scanning incoming emails for malware that scanning process can occur in the kernel to speed up the process. Any vulnerability in your antivirus / anti-spam (cough) Symantec could result in unnecessary exposure to exploit. ...


3

Well then, to try and fully answer your questions: Is it possible someone hacked to her phone and delete all her work contacts? I will say this with a resounding no. It's theoretically possible for them to hack into the device, but while not only highly unlikely it is also impractical for anybody to remove just her work contacts. The company has no ...


2

No. Taken from Wikipedia (Single point of failure - Wikipeda): A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. SPOFs are undesirable in any system with a goal of high availability or reliability, be it a business practice, software application, or other industrial system. Since in your ...


2

You are correct in questioning the philosophy of the mailbox password, because it might actually undermine how ProtonMail manages their Public Key Infrastructure (PKI) and security model. Yes, in this case the mailbox password = the private key, which is the single most important aspect in a PKI. In other words, they have made (intentionally or not) the ...


2

Being a mail system administrator, I suppose you know that email messages do not contain anything that would allow you to identify whether they are sent by a human or a machine. The BOT will certainly not indicates that it's a BOT in the message or even the headers. Common SPAM detection methods apply to any messages whether sent by a BOT or not. I ...


2

You're right that relying on a third party for your system's authentication can have certain drawbacks. It's hard to grasp how you could consider letting a stranger (non authenticated user) link an existing account to another provider. That would certainly represent a huge flaw in your design. Normally, when using third party authentication, you allow a ...


2

I could imagine the following scenario: Bob reads the email and think "Not for me, but this site would be perfect for my good friend Mallory". Bob forwards the email to him. Mallory now has the ability to sign up with Bobs email. Mallory uses the ability to impersonate Bob to e.g. stage social engineering attacks, or just to smear Bobs reputation. ...


2

In general it isn't necessary to require the user to re-enter their email address if the link is received via that same email address. It is important though to use SSL, expire the link as soon as a password is created, and consider expiring the link if no password has been created after a certain amount of time. That being said, it is slightly more secure ...


2

Don't do it. Catch-all policy introduces the risk that a confidential email will end up being read by an unintended person (someone viewing the catch-all inbox) if the sender makes a typo error in the recipient address. It is far preferable for the email to bounce and a notification sent to be sent the sender, who can correct the address and send it again....


2

The reason why it is occurring is inappropriate defense. If you run organization which is frequently targeted by hackers you need to take some minimum precautions: Have all systems updated (e.g. Windows Update, Chrome update etc, switch/router update, VPN etc) All traffic inspected on firewalls Have monitoring of all networks and systems for bandwidth and ...


1

The presence of some security controls does not make a system secure. Yes I think you have identified a valid problem but that organization could still truthfully say the confidential data was never sent in an unencrypted fashion. Unfortunately there are many vendors touting things as being secure because they either have some security controls or because ...


1

Why not send him by Email? I might be missing something here but I believe that if you have a strong enough password and 2 factor authentication then using any of the big email providers that use HTTPS (Gmail, Outlook, Yahoo, etc..) should be perfectly fine and secure. Either way it's not like someone can do much with your bank information. The following ...


1

Neil has good points. I would like to add some more thoughts. First: 2FA is a more generic term. Also your smartcard, fingerprint scanner and iris scan add a 2nd factor to 2FA. What you are talking of here is 2FA with OTP, one time passwords. And again with OTP there are many possibilities. OTP possibilities There is this cheap way of sending SMS or the ...


1

You didn't really get the meaning of the EXISTS, I believe. What you describe (allow example.com to send mail from example.org) would be INCLUDE! INCLUDE:example.com means see the spf record for example.com and apply the rules. EXISTS is much simpler. It means "If the given DN resolves to any address, it will match (no matter the address it resolves to)." ...


1

SPF uses qualifiers (Pass, HardFail, SoftFail, Neutral) in order to determine the validity level of a request. The qualifiers are determined by checking any or even all the following configured mechanisms: ALL: Matches anything not already defined by another mechanism will match the all mechanism A: If the domain name has an address record (A or AAAA) ...


1

You can find more details on the link below for the permissions ProtonMail Android app is using, along with information why each of them is needed. https://protonmail.com/support/knowledge-base/android-permissions/


1

As this page says: https://support.google.com/googleplay/answer/6014972?hl=en identity is mainly used to get your "contact card" which is obviously useful if the application want to automatically fill signature or sender friendly name. By following the link guideline to check the authorization: Using the Settings app on your device (for apps you've ...


1

The only single point of failure is your DNS provider is not redundant and it goes down, then your email is down. But most MTA's will keep resending the emails for 24 hours on failures. If the 2 different IP's you listed are assigned to the same machine - Then you will have a SPOF opportunity. But having multiple MX records point to the same IP is bad if ...


1

Even all your MX records point to a single IP address these records by themselvs are not the single point of failure, because the MX records themselves will not fail. The single point of failure is instead if you have only a single server managing the mail. And in this case it does not matter if this single server has a single or multiple IP addresses. It ...


1

There are a number of alternative standard addresses that might work. For example, postmaster@example.com, admin@example.com, webmaster@example.com (full list: https://www.ietf.org/rfc/rfc2142.txt). If that fails, you might want to look for a contract form in the website hosted on the domain, if there's any. If you can't reach any of these, you may want to ...


1

I think the goal of self-destructing email is not to erase the email, but to erase the information about who generates/sends the email. Under this idea: Self-destructing email works if content of the email can be easily generated. If the email contains only text (e.g. "I love you!"), then the receiver can easily write it down or copy it. But with a self-...



Only top voted, non community-wiki answers of a minimum length are eligible