Tag Info

Hot answers tagged

16

Let's break this up: Bob and Alice want to engage in two-way email communication. Bob and Alice need to use their personal email addresses. Eve has the ability to observe all communication in the system. Eve must not learn about any special communication between Bob and Alice. (Alice must not learn that Bob is married.) The last statement (5) prevents ...


7

It's a rather short list: ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ Now that's the fixed and static list. But: contact info from WHOIS is also legal. From the CAB-Forums' Baseline requirements, page 17: 11.1.1 Authorization by Domain Name Registrant For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL ...


6

If Bob can own Alice's computer (all of them) without being detected, he can wrap a bot around her email client which collaborates with Bob in the way most convenient to him, but then presents the communication to Alice as coming in plaintext from Bob's address, even though that's not the truth. Outgoing emails to Bob are also intercepted and communicated ...


5

Possible solution would be to use rule-based filtering/re-directing on the server and address-spoofing. 1.) Mail from Alice's account to Bob@Bob.Bob is immediately server-re-routed to a clandestine mail account which he uses for his affair. Unless Eve is able to view server filtering rules and/or the logs on the mailserver she will never know that Bob is ...


4

No solution. As Philipp points out, your requirements boil down to "Bob and Alice can only communicate in plain text directly over a monitored channel", because if Bob uses anything else Alice will realise he is hiding something.


4

At the bottom of the page in Gmail, you should see something like this: If you click the 'Details' link, you will get a pop-up window showing all the recent IP addresses used to access your account, along with some other information. You can probably use this to determine if someone else has been logging into your account. You can also set up 2-factor ...


4

Google has its own page for this: https://support.google.com/mail/checklist/2986618 Some items from this (and my own $0.02) that I think are worth emphasizing: Check where the account has been logged in from (https://support.google.com/mail/answer/45938?hl=en) and other recent activity. This will be the most telling. Check the administration settings to ...


4

However, the server must store some form of the mailbox password so that the user can be authenticated. Should a security breach occur on the server, wouldn't it be just a matter of time for a determined hacker (and a powerful hacker, if, say, a government desides to be one) to figure out the real mailbox password? Security is about trade-offs. It is ...


4

1) Contact gmail, and ask them to shut down the gmail account that your customers would send their details to if they fall for the scam. 2) Notify all your customers that this is a scam, and they shouldn't reply to phishing emails like the one above. 3) Spend a bit of time and energy on finding out how/why this happene, and if possible who did it. E.g. a) ...


4

You can sign with both PGP and S/MIME. Contrary to Oliver Schmidt's response, it is possible to create an external signature using PGP (you can sign any file with a PGP key, not just text - a executable (.exe) is not a good candidate for inline signatures). This is referred to as "PGP/MIME". An external signature on a PGP file will be *.sig and S/MIME will ...


4

To make a long story short: Yes, that will work and it will make sense, too. I'll try to explain this: PGP stores the signature inside the email body. The body of a PGP-signed mail usually begins with -----BEGIN PGP SIGNED MESSAGE-----, followed by the hash algorithm and the message clear text, followed by -----BEGIN PGP SIGNATURE-----, followed by ...


4

There are no practical attacks on SHA-1 yet. Experts estimate that SHA-1 attacks will start to appear around 2018. As you have correctly pointed out, companies like Google and Microsoft have already taken action and are replacing SHA-1 with newer and safer standards: Microsoft is recommending that customers and CA’s stop using SHA-1 for cryptographic ...


3

A number of anti-virus, anti-spam, and anti-phishing solutions work by visiting every link in an email and checking to see if the link leads to a suspicious-looking site. Sometimes you can detect them by checking the user-agent, but more often, they imitate the user-agent of a well-known browser (typically Internet Explorer) to prevent malicious sites from ...


3

It appears from Microsoft's documentation that the "Mark this domain as trusted" is a simple regex on the sender's email address, including the account name. So, it would appear that there is no analysis of the headers, MX records, SPF records, etc. on the client-side. That means that a spoofed allowed email address from a blocked domain could be treated as ...


3

You are presuming that a person can have only one personal email address, but that is not true. If Alice is not a knowing participant in Bob's adultery, there should be no reason for her to need to know that bob@bob.bob is the 'only' personal address for Bob. He could give her bob@gmail.com and she would be none the wiser. Alternately, if Eve is only ...


3

Very strange that noone mentions the solution how General David Petraeus hid his love affair from prying eyes: Both have a shared email web account. Each one is saving his/her message to the other person as Draft without sending them at all. So the only detectable transmission (which is normally encrypted) is between Petraeus and the server (Yahoo, Google ...


3

These links might help you: Compromised Gmail Account Start from here, this is the main page that listed the resources and actions you can take to recover from compromised account. Gmail Security Checklist Among the more important measures, other than changing passwords, are checking account recovery options, checking recent activities on your account, ...


3

The modern way of sending e-mails already gives an answer to Bob's problem. In fact, a service like GMail already encrypts the communication of e-mails between two GMail's addresses. Furthermore, Bob can connect to his e-mail front-end using HTTPS rendering all eavesdropping void. If we consider that Bob's is careless and sending his e-mail to his new ...


2

Bitmessage may be the solution. See https://bitmessage.org/wiki/Main_Page. Bitmessage hides who is communicating with whom, and all messages sent through the network are encrypted, authenticated, and digitally signed. From Wikipedia: Bitmessage is a decentralized, encrypted, peer-to-peer, trustless communications protocol that can be used by one person to ...


2

You are correct, however note that there is no indication that AES256 is cracked (and normally it won't be anytime soon either). Considering the strength of AES256 it will take several millions of years (even with quantum computer as the best known theoretical attack is Grover's quantum search algorithm. This allows us to search an unsorted database of n ...


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


2

Password reset mechanisms typically work like this: The server generates a secret random string (e. g. 16 bytes read from /dev/urandom). Then the server sends this string to the user, often embedded within a link to a password reset page. A hash of the string is stored in the database for later validation. Usually, the string is only valid within a certain ...


1

"Accountability" will not change - you are still accountable for your activity. But, by doing what you mentioned (anonymous payment, disposable email), it will be very difficult for the investigators to "attribute" your activity to you through the administrative information provided to them by the VPN provider if you also obfuscate your IP by constantly ...


1

In practice: No, you need to make sure many other elements of the network aren't fooling you. I will concentrate on the transmission here. First, you want to make sure, you can contact the right recipient’s server. To do that, your sending mail servers does a DNS-Lookup for the MX-Record of the domain. Then the resulting FQDN has to be resolved to get an ...


1

This was quite a good question and despite some comments, is very relevant to security. It is also a real problem. Don't get caught up in the mirky details. instead focus on the general problem, which could be equally applied to real world issues faced by Journalists or pretty much anyone who lives in a country where government control and civil liberties ...


1

In the United States the CAN-SPAM Act of 2003 regulates all commercial e-mail. You can try e-mailing each company individually and telling them they don't have your permission to contact you and if they don't you will file a complaint with the FTC. You can find out more information here: http://www.fcc.gov/guides/spam-unwanted-text-messages-and-email You ...


1

Most likely, the attacker has embedded a script in the document or in another document in the same account. Check all of the documents for embedded scripts and make sure there are no stand-alone scripts either. Also make sure that none of the files have been shared with an external user id. Then make sure the user turns on 2-factor authentication on their ...


1

In some cases, yes. Client It depends on the MUA/client, but forwarding a message will cause a copy to be stored in that person's sent items. That counts as a copy, as does the copy in the inbox. Outlook/Exchange can store these copies either on a local PST, on the Server, or both in the form of an OST Server Every MTA (server that touches the message) ...



Only top voted, non community-wiki answers of a minimum length are eligible