Hot answers tagged

48

It's not that hard, why isn't it standard for years? Because that would not have solved the problem that PGP is trying to solve. PGP is an end to end encryption, so if there is any way for the SMTP server to subvert the encryption, then the scheme fails. In the case of the scheme you proposed, suppose Alice (alice@charlie.com) wants to send a private ...


30

integrating PGP into SMTP. PGP is a container format for data (like mails but not restricted to mails), which adds encryption and/or signature to the data. SMTP is a transport protocol. You don't integrate container formats into transport protocols. This would be the same as saying that you should integrate Office (container for text, images...) with ...


7

If you have access to email sent from those domains, the headers will contain a wealth of information that will help you determine where they're hosted. The downside is that, unlike poking at their public MX records, you'll need to get actual email from someone there in order to get headers to examine. The Received header of is prepended to the message by ...


6

So how can I make a secure password reset system, without trusting the email provider? You could have a notion of "trusted devices" - i.e. once a valid login is completed, you set a long lived token for that device which is stored as a cookie, and also stored (hashed) server-side. When the password reset token is sent via email, simply require that the ...


4

The main options are: Email verification only - most sites do this. It's simple and essentially free, and secure enough for sites like forums, e-commerce, social networking. Most users accept that they need to trust their email provider. Security questions - the most common additional security mechanism. This could be questions like "What's the name of ...


4

The header you show is not the original mail header but has spaces where they don't belong, has lost spaces where they belong, has added line breaks and is missing several Received Headers. But, even if one would have the original header it will be impossible to verify the real sender, because too much can be faked. Using the DKIM signature shown in the ...


3

Depends what you mean by "email service", since as a general rule you're using some client to access an email service, and clients have different capabilities and restrictions. For example, mobile clients (smartphones) usually provide some support for Mobile Device Management (MDM). While MDM doesn't often involve retrieving files from the device - it's ...


3

Writing a standard is easy. I thought about this very problem about ten years ago. It comes down to the human/cost factor. How do you convince a billion technologically illiterate people to update their software for no perceived benefit, and convince the thousands of developers across a smattering of platforms to implement this protocol, and millions of ...


3

This is probably correct in a statistical sense. A legitimate e-mail will probably (but not certainly) go through several hops not only on the destination side (which are mostly always the same for a given recipient, so that number is not interesting) but also on the sending side, and these will be recorded in Received headers. A spam, however, while sent ...


3

I think it would be enough if you can actually restrict the Sign up process to specific domain(s) in the Application itself. Three very important security points I can think of are below You can actually have a list of allowed domains for signup and thoroughly check every signup email against this list. Also should verify the signed up email by ...


3

In short: You cannot simply set up a rogue Google or Reddit e-mail server, because DNS. E-mail clients and servers rely upon DNS in very much the same way most web browsers and websites do. When a node has a package that requires delivery to an address at domain.tld, that node will first query their DNS servers to retrieve the MX record for that domain. ...


3

Encryption is already in place during mail transit (STARTTLS in SMTP), but not sophisticated enough to protect against MITM. I believe PGP is more of an end-user experience between email clients, which is helpful if you don't have full trust of the servers involved. (PGP is sometimes susceptible to MITM to the less-than-careful user, however, like in SSH, ...


3

There will not be any silver bullet for this. Fact: If you don´t want to trust other service providers, and don´t want to provide a private independent solution based on some 2nd factor app or token, you will end up needing to ask the user to keep a secret with him and make sure he will understand that he needs to keep it safe. An example: Take a look at ...


2

You do not need to trust the email provider to achieve this. The following architecture can be used to create a secure enough password reset link. Database A table with the following columns. UserID (100 char) ReqID (128 char) Stime (timestamp) VHash (128 char) On request page On the request page accept the user name, and along with that use a JS ...


2

Yes, but there is a difference. While "cute-kittens.gif.exe" can raise some eyebrows, since a GIF shouldn't be executable, I wouldn't say the same about .tar.gz files. To be more clear, .tar.gz should be considered as dangerous as .zip. In fact, since any compressed archive coming from a Unix-like system is usually .tar.gz, a .tar.gz file could have a ...


2

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent. A check of the SPF records for email-2.microsoft.com shows: v=spf1 include:customers....


1

The question you have to ask yourself is, why would ClickDimensions be sending an email and would attempt to make it look like it came from Microsoft? This is what GMail is alerting you to; the source address doesn't 100% match up. Also, the notice is absolutely worth paying attention to, emphasis mine: It has a from address in email-2.microsoft.com ...


1

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which actually happened earlier. Although we knew about the LinkedIn breach a few years ago, we thought it was only a case of "some passwords were stolen". 6 million ...


1

This doesn't sound like a natural influx of customer. Something fishy is probably going on. I would guess that this is a bot. So why would a bot sign up for your newsletter? It is probably looking for bulletin boards or comment fields or anything where it can post spam. Since bots can be quite dumb, it doesn't understand that it is just a newsletter it is ...


1

The issue was with a mailing list unsubscription service unroll.me that i subscribed to a while back. from their documentation: Unroll.me unsubscribes you by following a sender's unsubscribe instructions 24 hours after you've unsubscribed. As a backup, we automatically trash all future emails you'll receive from that sender. This is to ensure that if the ...


1

Anyone can create new email accounts with "John1234", and those usernames are considered "public" so you have no control over that. What is more interesting is how the spammer got a hold of the distribution lists. I would highlight the "change password" advice and make sure that proper hygiene is being practiced.


1

If you have your publick key on key servers you can only share fingerprint, a link for download your public key is good if you haven't key on key servers or even when you have on key servers because maybe not all people use same key servers. I use fingerprint and also I have a link to my public key on my blog. gpg --recv-key ...


1

The headers can be spoofed as well. You need to check the Received: headers and see if there is any provider that you do not trust, then there might be a phishing attempt. Headers can be spoofed for legitimate purposes in some cases. Related to this particular amazon e-mail you might want to check: Is this "security update" from security-update@...


1

How come this is in the email? OpenVPN does not care about application layer, which means that it did not introduce such content to the email. This means that this content is either introduced by the sender or by the mail server. While you offer only a few information about the mail itself let me just guess: there is a hostname openvpn. there is some ...


1

To make anything PCI-DSS compliant you'll have to go further than just defining some tech specs and leave it at that. PCI-DSS wants you to OPERATE a secure environment, not just design it. So let's break it down. You want to regularly send e-mails containing one or more PANs to one or more authenticated parties. You've thought up a method of sending ...


1

This is an interesting topic. Unfortunately you have narrowed down the possibilities with your exclusions. Otherwise I would have recommended a second channel. Some sites on the Darknet have the same desires you have outlined in your question: Either they don't expect people to have an email account (anonymous email is not that easy) or they don't trust the ...


1

I doubt there exists any solution that will satisfy all of your requirements. You want a different, more secure solution than the ones that big companies have spent millions on researching. It can’t trust email, it can’t use outside sources like SMS, it can’t rely on security questions, doesn’t use offline (print) security codes, must be usable by any ...


1

You can't build a secure password reset system without a trusted method of communication. If the provider can't be sure who is attempting to reset the password, they can't be sure that they are only resetting it for the legitimate owner of the account. Therefore most modern password reset functions are a balance between a certain level of trust and a ...



Only top voted, non community-wiki answers of a minimum length are eligible