Tag Info

Hot answers tagged

136

I think the one thing the others (as of this post) hasn't mentioned: Source of the spam I would say you should differentiate between "Good" spam (Something you signed up for - knowingly, accidentally, "opt-in" purposely, "opt-out" not clicked)... And "Bad"/"Unknown" spam (random garbage that likely uses the click for tracking). I have no issue clicking ...


61

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISPs do not provide law enforcement access to their sites and to the systems they provide for their customers? And with a home server: lots of sites explicitly deny access to their mail server from a "home" IP address (these are known address blocks), in ...


37

You should not click on any links. By clicking on the "unsubscribe" link you propably get marked as "Active Reader" which is willing to interact. You also get on the page of the sender, which might could infect you with malware. Remember: With clicking on any link you've confirmed to the sender that your email address is both valid and in active use. Just ...


34

As someone who has actually done this for a couple of years, I can tell you that it's not nearly as simple as you're describing and it doesn't offer the security properties you want. In summary: Why do so many security experts (i.e. cryptologists & co.) not host their own email? Because it takes enormous amounts of time and specialized knowledge ...


15

When you send emails in your scenario, you announce the IP of your custom, private email server. Every recipient, and any interested party, now knows you use your own email server and where it is. This results in a one-to-one mapping of this server and your connection to it. If a government agency wants to track you down, all they need to do is to look for ...


10

There speaks someone who has never run their own email. You don't mention an inbound antispam solution. DKIM and related techniques are for authenticating your own mail as not spam and making it deliverable. (Deliverability is the main barrier against home hosting: most providers block port 25 and many mail recipients block all ranges known to be ADSL). But ...


10

Short answer, it's not the easiest solution. " it's very easy to set up a self-hosted email server" You are wrong, the rest is wrong because it's based on this. I assume you imply it's easy to set up a safe server (otherwise, what's the purpose of it all?). Your laundry list of what you need is long, and not even so it is complete. It's much easier ...


7

You cannot reconstruct an OpenPGP key based on it's fingerprint. The fingerprint is a hash value of the public key, so calculating the fingerprint of a key is a one-way operation. But: if somebody only distributes his key's fingerprint, he will almost certainly have distributed his public key on the key server network, from where you can pull it. Given you ...


5

It's pretty much a coin toss. If the spammer is a honest one, you'll get unsubscribed. If he's a malicious one, you'll get marked as "active reader" and get enrolled in even more spam lists. The second option silently assumes that it's actually worth the spammer's time to keep track of "good" and "bad" recipients, that is, that having a tracking system is ...


5

In addition to being marked as an active reader as @Danny says, unsubscribe links could be used to infect your system with malware. If you actually subscribed to the site and want to unsubscribe the best way to do it is log into the site and change your preferences. Otherwise report it as spam and delete it.


4

The answer also depends on the physical aspect of the network configuration. If your modem or router (or combo) is easily accessible by someone else, it is much easier to eavesdrop through Wifi, although like @VirtualJJ said, the communication is encrypted. Because through the LAN with ethernet protocol the communication can be wide open for anyone to ...


4

Email verification doesn't provide extra security. It just validates than the newly registered user is the legitimate owner of that email address. For security concern a best practice for a web site would be not to send any email to an unconfirmed email address. This prevent leaking information to someone who mistyped his email address. Anyhow you ...


4

Email is insecure. It is completely insecure. Between you and the recipient it likely passed through dozens of servers and for each one it was passed as pure plain text. Without specific details and logs it is impossible to say where a copy was lifted but regardless you should always ASSUME that anyone can read anything you put in an email. If that ...


3

I use hotmail (live/outlook...) and in their web client, at the bottom of each email they have an unsubscribe button, it is not part of the email it's within the mail client and this button will unsubscribe you from sources which they trust and have set up this system with. If the source is not trusted they will simply block them from sending you further ...


3

If you know the sender has got your email address legitimately, as per @WernerCD's answer ('Something you signed up for - knowingly, accidentally, "opt-in" purposely, "opt-out" not clicked'), go to their website and unsubscribe there. Many companies use third party web sites as end points for the unsubscribe links ("mailbot.com/unsubscribe" as opposed to ...


3

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com? Yes, competitor can bypass this, but not easily. Lets say that SPF is "v=spf1 include:spf.mandrillapp.com ~all" This means that I allow server spf.mandrillapp.com to send emails for my domain, while all other will SoftFail (that is the ...


3

I feel like this is a major personal security risk for myself. Is it? It may be. You may not be targeted specifically, but "email is a private as a postcard". (Not enough reputation for a link, but it's googleable.) If so, how can I make that clear to them while still maintaining my eligibility for employment? I would've called my contact person ...


3

It does not have to be even this. On the Internet, there are lots of so called fake mailers. One of it is for example Emkei's Fake Mailer https://emkei.cz/ So you will have to be careful until your contact persons will (or their admins will) set up SPF record which will prevent this type of the attack.


3

Does the occurrence of ESMTPS in the first example mean that TLS was used for transport encryption? Yes, but only if you believe the MTA that inserted that header and every MTA that touched the message subsequently. Any of those MTAs could write that information into the header even if it isn't true. Does the occurrence of ESMTP in the second ...


3

I'm not a expert, but since nobody said the magic word " encryption " here yet, i will write this answer. It seems to me that what you want is to prevent NSA to get the hands on your communications data, but you are looking the wrong way, you must trust only the encryption algorithm that make the data secure and private and nothing more, you should aim to ...


3

The short answer is no. Sure you can make your email very legitimate looking, that isn't the problem. The problem is you are conditioning your users to click on links in emails and email is a 100% insecure medium. Links in emails are an anti-pattern. "Official looking" isn't secure. Almost everything in your email can be replicated by a dedicated ...


2

Virus Total and malwr and both good sites to submit suspicious files. Virus total will tell you if the file is flagged by any antivirus. Malwr will give you more detailed analysis (this may/may not be of interest to you). Note that you're submitting files to an online community, so don't submit anything that is potentially proprietary/secret.


2

Isn't it some kind of security lack that some guy is able to connect to your email account, and is able to change your alternative email without sending some link to it before confirming the change ? Yes. Some systems delay the change of secondary email from being effective in order to allow a legitimate owner to recover it, but most systems simply ...


2

An address and phone number is one thing. In certain cases, this might be considered public information, think about a telephone book. I agree with you that submitting your SSN is a bit tricky, to say the least. I can imagine that once you're hired you are required to submit this information. In my opinion there is no need to supply this kind of ...


2

Ethernet (802.3) and wireless (802.11) are simply communication protocols. How secure they are depends on configuration. How to configure security for both ethernet and wireless will be out of scope for this answer. Out of the box, with no security configuration at all it would be easier to eavesdrop on an unencrypted wireless connection since the person ...


2

You will need to analyse message headers to determine what is going on. Google's Message Header Analyser is here. Using the tool, check the from servers to find out if the emails pass through your contacts' servers or only your own. Also check whether SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) pass - if they do pass, it is more ...


2

It depends on the email system. In general, no, this is not possible. Traditional email messages were not written on interactive websites (unlike, say, Facebook messages); there is also no central server you are expected to continuously be connected to (it's a decentralized system). So, traditionally, messages were written entirely client-side, in a program ...


2

The theory is that traffic to the DMZ must be inbound. In that case, should something bad happen to the the DMZ host, the attack is contained within the DMZ. This means that the connections from your LAN must be initiated in the LAN, which usually means some kind of push (to the DMZ) or pull (from the DMZ) operations. This is doable for mail but sometimes ...


2

In the USA, there is the CAN SPAM act which requires advertisers to honor and respect unsubscribe requests. Violating this is a very serious crime. You can report it easily to the FTC, and if it's a US company, they will get into a lot of trouble. Because of how bad the punishment is, legitimate companies rarely disregard unsubscribe requests - you can ...


2

1) You can digitally sign the email, so it will look more trustworthy (if the mail app supports it and do not show it just as attachment). 2) It is not the best idea to include links in the email. It is better to give them instructions how to do the change and where. Also, the password change tool should be on your company URL that they know and trust it. ...



Only top voted, non community-wiki answers of a minimum length are eligible