Hot answers tagged

54

The problem with this scenario is that emails are typically not sent from the device itself, but from a central service. In order to do what you want, the investigators would have to make a few hops: to the email service (gets the user account details, including the IP the user used to connect with) to the ISP the device used at the time of sending (gets ...


43

If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know when it was sent) to find out - from the service provider - the precise location the email was sent from? Yes, this is very easy. However... the key word here is "precise location." Not exactly. Not unless the phone is hacked. ...


23

There's another common way that email leaks location information. If the email includes a photograph that was taken on a smartphone, the photo will usually have location information embedded. Since you're writing the story, you might contrive to have the sender email a photo for some reason. The JPEG standard (used for virtually all mobile phone photos) ...


19

In addition to what @schroeder wrote, I would like to point out a few things about geolocation. Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more. In some countries, mobile operators might always be able to ...


12

Email is a very old plain-text protocol (dating from the 1970s/1980s). Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other domain). SMTP doesn't include any checks that the mail came from a mail server who controlled the domain listed on the From: line. Extensions to email protocols ...


11

Earlier answers already describe the process of using triangulation to pinpoint the location of a specific phone better than I could describe it. However there is very little said about whether the investigators can figure out which exact phone the mail was sent from. In traditional mail services where the user run an email client on their device and use ...


9

Ask your credit card provider for a one-time card number. Or get a new account with a low limit. Put the credit card number (and maybe a short random string) in a plain text file. 7zip this file with AES encryption. Email the hotel with this file as an attachment. Phone them and tell them the password to decrypt the file. (You might have to do a bit of ...


8

Speaking as a wireless telecom professional, the answer to your question depends on how precise you expect the location to be. With minimal effort (and a legal obligation to do so), I can tell exactly which cellsite(s) you were using, which narrows your location down to a particular geographic area. And we don't even need to know the IP Address, we just ...


6

Send a unique string of text, a.k.a. a token (cryptographically secure, randomly generated), to the user via some other band besides e-mail, such as SMS or even snail mail. They can change their password in your app only if they input that token in a Web form on your site. Or use physical devices, like SmartCards, that all users must have in order to use ...


6

Your question appears to have nothing to do with certificates or hashes. Neither one involve symmetric ciphers (like DES or AES) at all. The actual answer is just a matter of how Outlook (or Mail.app) is configured on each machine, nothing more. I don't know how to control the ciphers used on Outlook for Mac, but here are the steps for Outlook 2013 on ...


6

They are standards for encryption of mails, notable S/MIME and PGP. There is defined how the encrypted message gets encapsulated so that the mail client knows that it is encrypted. These encapsulations have a very specific Content-Type headers or at least specific markers in the content, i.e. markers like -----BEGIN PGP MESSAGE----- or Content-Type's ...


4

Encrypted data should have a relatively uniform distribution of randomness, so if notable portions of it fed through tests such as a chi-squared test don't end up showing as random, then it's unlikely it's encrypted. Since you have multiple messages, close attention to the first bytes of each message is also relevant because it'll give a chance to detect a ...


4

The aim of phishing is to obtain information about the victim, to which the attacker is not entitled. There are two typical ways a phisher would obtain that information: The victim supplies it by including it in a reply to the phishing email, i.e. by sending the information to an email address controlled by the attacker. The victim supplies it by first ...


2

It's quite common for hotels to pre authorise payment using your card details. This is to prove you are who you say you are and check you have sufficient funds for your stay. Although emailing may not be the safest way of sending your credit card details. Perhaps a phone call would be better but still not "secure" What I would suggest is that you opt to ...


2

These are hard to get. Generally, you need to create and curate your own spam trap (hard!) or else get data from some existing spam trap. There are resources for this. See the following highly related questions: Brainstorm: How to quickly create a honeypot for mass spam? Publicly Available Spam Filter Training Set Spear phishing data set Databases ...


2

Well, if he was already a suspect, you wouldn't need the email to begin with. The investigators could have been watching their mobile phone wanderabouts the whole time (or another agency have already put this guy on watch, and thus the mobile has more data about it). The other option is that you have an email, but no idea who the criminal is (for example, ...


2

I am the author of Gmail script that you referenced in the question. The script is now available as a Google-approved add-on on the Chrome Store. It requires access to the entire Gmail because, unfortunately, that's how permissions works inside Google Scripts. You either have full access or no access. In the Gmail Scheduler script, it needs permissions to ...


2

I think that onetimesecret.com it's a very useful service, and it fits your needs. Of course, you should share the onetimesecret password by a different channel in order to increase the security and avoid the case of compromising the sensitive information if someone has access to the email account. I have dealt with these situations before and, depending on ...


2

If the link visible in the location bar of the browser is the same link you've clicked on then probably nothing dangerous happened. But, it might be that the link in the browser is different from the one you've clicked on and that there were redirections and reloads before you've actually reached the site blocked by Google Safebrowsing. In this case it ...


2

This might be a problem without a really good solution. Here are some suggestions. They all fall in two groups - not very effective but practical (1-4) or effective but a bit unpractical (5-6). Limit the amount of time the token is valid. Check that the IP that request the new password and the IP that click the link has the same geolocation. This could ...


2

This is phishing no doubt. I found a similar message on Google: http://niepodam.pl/wiadomosci/3455214 (Google cache) The destination of the link "> Click here to validate your account information " in that email was "http ://cbi-id2.com/", which obviously is not apple. Whois data places that server in Panama... The crooks have probably moved on to a ...


1

Short answer:If you actually have chrome in spanish yeah it probably prevented the attack (its google blacklist for sites) This seems to be the case of phishing so on the site they would ask you to log in with your Apple ID to "verify" your account, purchase or something like that. Three basic steps to prevent this in future: 1) always check the senders ...


1

Where I work we have a solution that will automatically detect sensitive information and replace the content with a link to a secured server. The company that sells this makes a business out of it so this isn't a crazy idea. As long as you make the links impossible to guess (long crypto-secure random strings.) The solution we use actually requires the ...


1

There already is a solution for encrypting email: It's called PGP and there are plugins available for most email programs on most operating systems. Its main problem in the real world is that you need the public key of anyone you are going to send an email to, but when you are using it internally you can fix that by setting up a keyserver on your company ...


1

Before the email is sent, you can grab all URLs with a regexp, and then submit them to Googles Safe Browsing API to check if they are known to be malicious. If so, just don't send the email or include a warning.


1

I will shoot in the dark as there is no way to know exactly what can be the reason without further details... Each time you forward those emails like : if you don't send this email to 20 accounts and the person who sent it to you in the next minute, you will be cursed..., spammers will receive a lot of information about you and your contacts (many people ...


1

I think you can safely reply the message. A MX record lookup gives outlook.com as top level domain. Also,the top level domain in mscloude@clickdimensions.microsoft.com is microsoft.com. Even if the email is spoofed with clickdimensions.microsoft.com. Your reply email will not be delivered to attacker. Also, just make sure that reply (reply-to) address ...



Only top voted, non community-wiki answers of a minimum length are eligible