Tag Info

Hot answers tagged

63

There is no security vulnerability per se with having a '+' in your email address. It's permitted as per RFC 2822, and not particularly useful for SQL or other common forms of injection. However, many systems (let's call Meetup a system for this purpose) enforce security through whitelisting, not blacklisting. Someone defined a limited list of characters ...


55

They are likely incompetent and may not even know they are lying to you. From a input-validation standpoint, they have no leg to stand on; there are a specific set of RFCs that robustly describe the format of a valid email address. Even if an email address is technically invalid according to the RFC, it may still be possible to deliver mail to it anyway. ...


12

As others have pointed out, there are no real security reasons to disallow a plus sign in email address. Being a web developer, the main reason I can think of is to prevent users from making multiple registrations using different aliases, especially on an E-commerce website where you have a one-time free offer that you want to limit to each individual. ...


8

If they are indeed sending you a new password (i.e.: a system-generated password other than the one you previously had) when you click 'forgot my password' then no, that doesn't mean they're not hashing passwords. They can have their forgot password function generate a password, hash it and store it in their database, and then (while it's still in memory) ...


3

Yes, it is possible. Maybe the sender uses VPN or proxy, or the IP he uses belongs to a entity hosted in San Jose but have a remote link to Maryland, or he is using remote access software from Maryland to San Jose. And about the loopbacks, it's very common. Mail servers often work in clusters, so it's possible that one mail server received the email, and ...


3

Two minutes of your time on Google (no fancy search terms, just "zix gmail") would have told you that Google have been doing some work with Zix to bring some features to their Gmail product... thus you can assume they have Zix integrated. ;-) Reading the product description on the Zix website, you can inferr that both sender and receivers need Zix servers ...


2

Your first priority: repression. Make sure that your security is tight and no more information is leaked. Second priority: repair. Don't try to fight the criminal yourself. Go to the police and report a crime. Most police forces have a digital forensic team that can do the things needed. Let's just hope that they have the time/resources/priority to look ...


2

A small one. Some spammers grab email address and domains to forge From: addresses. If this user's email is public, that might increase the odds that a spammer will forge with it, pretending to be sending email from your domain even though the spam is actually coming from someplace else. In which case, you might notice a slight uptick in warning notices ...


2

1) In general S/MIME is not supported by Gmail, Yahoo, etc when using their web-based email client (i.e. going to www.gmail.com). If you want to use S/MIME with these services you have to use a 3rd party email client (i.e Mozilla Thunderbird, MS Outlook, etc) and have a way to manage and distribute your public and private keys. The reason it is not easy to ...


2

You're correct, the 'protection' is pointless against an adversary who's motivated enough to clean up their lists of email addresses. As pointed out by the OP, getting rid of +'s is trivial. I've seen some security researchers (and others) create actual addresses instead, e.g. name.topic@... and setup aliases to their main address. The advantage is that ...


2

From my personal experience it would be better do send a link to a webpage where the user has to download the software by cklicking on a download link/button. There are many spam/ malware filters for mail out there blocking mails with direct links to software. I encountered this many times trying to get updates of our software to various clients. Now we ...


2

Looking at the first message, I see: Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT That is probably the address of the router from which the mail originated, and not the address of a PC which would be behind the router. A search on 209.79.72.16 gives me some confusing information; it's either in ...


2

Nagios has a feature that detects what is called "flapping" which you could implement yourself. Basically it will start sending you text messages, but will stop if it passes a certain tresshold within a given timeframe for a similar type of warning message. It's up to you to decide the thressholds and the intervals and the classification of the events. ...


2

As I said, full marks to @JeffClayton for using an e-mail account EXCLUSIVELY for password recovery. However, for added security: Every month, install a new version of TAILS to a USB drive. Use TAILS to make the account, and TAILS to access it. As soon as you have the fresh TAILS install on the drive, boot it up and change your password (that's every ...


2

I would not consider using a family member or friend's email to be a good idea, for reasons you mention yourself or simply if they ever change a password. I would create a new email address and use that, but for no other purpose. That way you would also not be putting others at risk. 2-Factor is not a bad idea. The harder you make it for an attacker to ...


2

I have helped people who have experienced exactly the same thing that you are describing and it was simply the result of an infection. A program connects to her gmail account, and searches for emails in her contacts and folders, including the deleted items folder. Then, spam is sent out. I know that you have scanned her machine, but scans do not always ...


1

For your questions relating to Gmail, they can intercept the traffic - but Gmail uses SSL/TLS to encrypt your traffic, so they would only be able to see the encrypted content. Google uses HSTS to enforce the use of HTTPS, so you should be fine. For any account that doesn't use an encrypted protocol (http, ftp, telnet, etc.), then yes - your credentials can ...


1

This is a very broad question, depending on your setup. If you use SSL from your PC to your mailserver (wich is not administrated by the same guys) and your connection is secure, they can't see anything about your mail, except for the size. If you use unencrypted communication with your mailserver or the mailserver is administrated by the same guys it ...


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...


1

If you are concerned that some site is going to spam you or (worse yet) sell your email address, then you will want to use a unique address for that site. If you're worried about a site being hacked, well, your email address is mostly public anyway; a hack just makes it a little bit more public. What you must not do is use the same password across sites. ...


1

I have not encountered a site that actually sends a new password in years. What they do is send a password reset link that expires fairly soon. The lengthy character string won't be brute-forced anytime in this universe but is simply matched (and expiry time checked) to allow you to enter a new password of your choosing. Good sites will do that on an SSL ...


1

If gives you the assurance that the email, and the sensitive data it contains, never transits over an unencrypted channel, with a side-benefit of allows you to audit access. Generally with SMTP, you don't know what happens after it leaves the edge of your network to the edge of the next. It could be insecurely transferred from one MTA to the next, it ...


1

That is not what a mesh network is. See http://en.wikipedia.org/wiki/Mesh_networking. I think perhaps you mean a network that uses Network Address Translation (NAT). At the IP level, the mail provider does only see the external address of the router, this is true. Subsequent tracing has to be done by the administrator of the mail router. There may be ...


1

You could try Boxcryptor. I haven't used it personally, but it looks like you can manage and create groups for secure file sharing. The video on how to do secure file sharing on their site. Which is included in the free version of their software. I know it isn't a service, but have you looked into using PGP/GPG? With PGP/GPG you can create a ...


1

Citrix ShareFile is one such service. It is primarily used for transferring large files, but you can encrypt them. It's not free, though.


1

It is unlikely that you are getting spam because you used a hotspot. Gmail should have their certificate pinned and their traffic should be https only, so there is no way to intercept it unless you install 3rd party certificates on the phone, or accept any warnings about invalid certificates. Spammers also do not need access to your account to send you ...


1

It depends on your gmail account settings. Not sure if you have enabled the Undo Send option for your account. If you haven't then it is not possible to stop the sent mail. Go to account settings in your gmail account by clicking the settings icon. click Settings click the Labs tab Check the Undo Send option If Enabled already, then you will have the ...


1

Can I treat it as I would a normal username or should extra precautions be taken, like 'sanitizing' the email address before comparing it for uniqueness by removing any + parts (e.g. somebody+note@example.org)? See I Knew How To Validate An Email Address Until I Read The RFC for more information, but I wouldn't go about sanitising the address, as ...


1

The email address is often a bad thing as a username (for highly sensitive functionality such as banking) because: It allows someone causing someone elses account to be locked maliciously (if I know your email address and you bank with Barclays I can lock you out of your account by repeatedly attempting wrong passwords). You can try hacked username and ...


1

In general when addressing encryption as long as two different session keys are used, and something other than block cipher mode ECB is used, very rarely will patterns be seen in the encryption. GPG supports compression which would remove most patterns in the data first. It then uses one time randomly generated session keys to symmetrically encrypt the ...



Only top voted, non community-wiki answers of a minimum length are eligible