Hot answers tagged

27

"Eight digits" means 108 = a hundred million possible passwords. At best, you selected your password fully randomly, implying that the attacker, on average, will have to try half of them before hitting the right one (so fifty million connection attempts). (The "at best" means here that the attacker always has the option of trying passwords in a random ...


13

Your argument is valid, with Sign & Encrypt method, the 2 layers are independent and this gives you (as Bob) the ability to re-encrypt Alice's message while the signature is still in place and forward it to Carol. One other option would be to Encrypt then Sign but there's also a vulnerability in this approach. Bob or any eavesdropper can remove the ...


8

As luck would have it, Microsoft has documented this. The answer to your question is yes. They use TLS 1.2 between any Office 365 groups, and they also use it opportunistically for external destinations, so as long as the recipient's server supports it, that message path will also be encrypted. https://technet.microsoft.com/en-us/library/mt163898.aspx and ...


6

My guess is that you have Avast Mail Shield active and therefore it will scan any incoming and outgoing messages. This is probably done by being a man in the middle, i.e. your mail client actually connects to a local process from Avast which then connects to the real mail server. This means the internet access is necessary to actually get the mails from the ...


4

Generally, it is ill-advised to implementing your own session handling. If you can, you would be better off by using a well known and well tested implementation. These are the issues I see in your procedure. User requests password reset How will you handle misuse of this function - will you send one email per reset attempt, or will you implement a ...


4

I think that if you continue down that line of thinking towards a rock-solid solution, you're going to have to consider things like "what if the weekly email is spoofed?" ... "Maybe I need to digitally sign those lists", etc and you are going to end up inventing something very similar to a Certificate Authority. Use an in-house Certificate Authority I ...


3

This is prevented by simply, using proper human communication. Normally, you begin a message with like: "Hello Bob Nice to hear from you again. bla bla bla" Thus Carol, would easily to detect this disrepiancy since the message is not adressed to him/her, and would of course ask Alice "Did you send this to me? Then you have the wrong adress." and Alice ...


3

You will never prevent all spammers; not with a CAPTCHA or any technical means. Some spammers hire "smurfs", which are large numbers of people who each send one spam per web site, but each person spams hundreds of sites. The motive of the spammers is likely to use your site to deliver their spam in your response emails. If your response to the contact ...


2

I'm going to take this question as to "how do you stop MitMs from intercepting temporary links" whether those links are for email confirmations or to initiate password resets, because email is considered insecure. Well the answer is around the fact that not all Men-In-The-Middle are created equal. It might well be the fact that the email in transport is ...


2

No, that is not what they are saying. Both IMAP and POP have a encrypted version of the protocol. It doesn't matter if the volume is encrypted if the hacker can guess your username and password. What they are saying is if you download the message to your computer and delete them from their server a someone who breaks into your account will have nothing to ...


2

Email servers store all mails they forward in cleartext. That means you must trust your email service provider to not snoop on you. An automatic forwarder is not necessary to do that. There are other ways to forward the content of your emails without using email. Also, all email tracking solutions depend on cooperation of the email reader. Most email readers ...


1

Well let's think about it for a moment. The character set for passwords is usually [A-Za-z1-0\~\!...] or 26+26+10+10=72 characters for a total of 728 or 722,204,136,308,736 different combinations(including combinations that are bad. Trying to catch all of those patterns is a bit inane). At 1000Guesses/1Second that's 22,900.9Years. Okay, so the metric of ...


1

I don't think that your idea is effective to pollute the spammers lists with so much fake entries that the costs of sending spam increases noticeable. But as far as I know such fake accounts are still used to fight spam, although in different ways: Since spammer don't handcraft a new spam mail for each recipient but base mails on templates such dummy ...


1

As mentioned both have security counter parts to them. However POP is slowly losing favor as IMAP is typically deployed with far better security. it's also very dependent on the mail service providers security posture. Some of them don't care if secure communications exist between the end user's device and server and others take it very seriously.


1

The default mail app's credentials are stored on the device but could leak to either a local (iTunes) backup if backup encryption is turned on or to iCloud if cloud backup is enabled. For third-party mail apps there are no ways to prove they aren't malicious besides disassembling it and reading the whole disassembly (good luck!). Now your second question ...


1

Registration Email Confirmation So what's stopping the link in the email from being hijacked by a middle-man who uses the link to reset the user's password? That's not how your registration email should work. It should work like this: User registers You send out a confirmation email with a one-time token The user gets the email and clicks the link ...


1

Regarding TLS SMTP communications: there is an issue with downgrade attacks. Basically, you can't trust email transactions to be 100% encrypted. You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM, a US government program to ...


1

Email was never designed to verify an email actually came from the person it says it came from. The model is largely one of snail mail, where it's trivial to print an address of President Of The United States as the origin. The most likely scenario is the header address appeared as employee B, but the reply to: address was set to someone else like ...



Only top voted, non community-wiki answers of a minimum length are eligible