Tag Info

Hot answers tagged

28

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client. As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. ...


15

Let's break this up: Bob and Alice want to engage in two-way email communication. Bob and Alice need to use their personal email addresses. Eve has the ability to observe all communication in the system. Eve must not learn about any special communication between Bob and Alice. (Alice must not learn that Bob is married.) The last statement (5) prevents ...


8

The piece you're missing is that with these services (at least in my experience) you are required to create a login credential to access the secure service mail box the first time you use that particular service for that particular sender. Further, the sender (who contracted with the service) can set time limits for the items so that they become ...


8

Rate-limit on a per-user or per-email-address basis. Since re-sending confirmation emails is rare, setting the limit absurdly low (say, two re-sends per day) should be sufficient to keep from flooding a user.


7

It's a rather short list: ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ Now that's the fixed and static list. But: contact info from WHOIS is also legal. From the CAB-Forums' Baseline requirements, page 17: 11.1.1 Authorization by Domain Name Registrant For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL ...


6

If Bob can own Alice's computer (all of them) without being detected, he can wrap a bot around her email client which collaborates with Bob in the way most convenient to him, but then presents the communication to Alice as coming in plaintext from Bob's address, even though that's not the truth. Outgoing emails to Bob are also intercepted and communicated ...


6

Google spends a lot of money each year in bug bounty to ensure that Gmail isn't susceptible to XSS. Part of this effort has produced Google-Caja, which is an open source project that filters HTML to a "safe" subset. HTML filter sandboxes like Caja rely upon an "older" solution that uses complex parsing techniques, and thousands of regular expressions to ...


5

They don't need your public key at all to decrypt. You need their public key to encrypt the message, which they decrypt with their private key. The only thing they need your public key for is to verify that the message comes from you. In that sense it doesn't make sense to attach your public key, unless, for instance, you plan to confirm fingerprints over ...


5

Add a time stamp to the email field, if an email has been resent in the last x minutes do not send another email. I would not use a captcha as bots are better at solving those than humans are anyway.


5

Possible solution would be to use rule-based filtering/re-directing on the server and address-spoofing. 1.) Mail from Alice's account to Bob@Bob.Bob is immediately server-re-routed to a clandestine mail account which he uses for his affair. Unless Eve is able to view server filtering rules and/or the logs on the mailserver she will never know that Bob is ...


4

What you are looking for is theoretically viable, provided that you add the missing extra piece, i.e. some form of time stamping. However, behaviour of existing, deployed implementations is likely to be a problem. The conceptual idea is that if you verify a signature at date T on some message, then, at a later date T', you can still remember that the ...


4

No solution. As Philipp points out, your requirements boil down to "Bob and Alice can only communicate in plain text directly over a monitored channel", because if Bob uses anything else Alice will realise he is hiding something.


4

At the bottom of the page in Gmail, you should see something like this: If you click the 'Details' link, you will get a pop-up window showing all the recent IP addresses used to access your account, along with some other information. You can probably use this to determine if someone else has been logging into your account. You can also set up 2-factor ...


4

Google has its own page for this: https://support.google.com/mail/checklist/2986618 Some items from this (and my own $0.02) that I think are worth emphasizing: Check where the account has been logged in from (https://support.google.com/mail/answer/45938?hl=en) and other recent activity. This will be the most telling. Check the administration settings to ...


4

There are no practical attacks on SHA-1 yet. Experts estimate that SHA-1 attacks will start to appear around 2018. As you have correctly pointed out, companies like Google and Microsoft have already taken action and are replacing SHA-1 with newer and safer standards: Microsoft is recommending that customers and CA’s stop using SHA-1 for cryptographic ...


3

These links might help you: Compromised Gmail Account Start from here, this is the main page that listed the resources and actions you can take to recover from compromised account. Gmail Security Checklist Among the more important measures, other than changing passwords, are checking account recovery options, checking recent activities on your account, ...


3

The modern way of sending e-mails already gives an answer to Bob's problem. In fact, a service like GMail already encrypts the communication of e-mails between two GMail's addresses. Furthermore, Bob can connect to his e-mail front-end using HTTPS rendering all eavesdropping void. If we consider that Bob's is careless and sending his e-mail to his new ...


3

You are presuming that a person can have only one personal email address, but that is not true. If Alice is not a knowing participant in Bob's adultery, there should be no reason for her to need to know that bob@bob.bob is the 'only' personal address for Bob. He could give her bob@gmail.com and she would be none the wiser. Alternately, if Eve is only ...


3

At work, I've implemented a very rudimentar and basic system to a contact form. Each IP is only allowed to send 5-9 emails a day (random number generated by IP). You can adapt this and add some options to (for example), allow only 1 or 2 per day in case the user asks it in a somewhat constant manner. Or block at all and only allow to resend if a specific ...


3

1: The advantage of S/MIME over PGP is that you sign/encrypt a complete mime entity, not a text. This makes it possible to sign/encrypt a entire message/rfc822. Yes, headers must be visible and changeable to the MTA, but that can be accomplished by taking the WHOLE mail, S/MIME sign or encrypt it, and then package the signed/encrypted S/MIME entity it in a ...


3

I get these questions from clients on a regular basis. The fundamental problem is that any email tracking technology requires cooperation from the client. The other answer dissected the image tracking so I won't repeat it here, other than to point out that the client must load the image from their server (said server is now on my block list). Web-based ...


3

Very strange that noone mentions the solution how General David Petraeus hid his love affair from prying eyes: Both have a shared email web account. Each one is saving his/her message to the other person as Draft without sending them at all. So the only detectable transmission (which is normally encrypted) is between Petraeus and the server (Yahoo, Google ...


2

Neat idea, good question, but there are a couple issues that make axolotl not a good drop-in solution for existing email clients and/or servers: 1) The asynchronous part of TextSecure requires help from the server that email servers don't provide. Specifically, TextSecure/Signal servers distribute ephemeral public keys for offline users. Email servers ...


2

Bitmessage may be the solution. See https://bitmessage.org/wiki/Main_Page. Bitmessage hides who is communicating with whom, and all messages sent through the network are encrypted, authenticated, and digitally signed. From Wikipedia: Bitmessage is a decentralized, encrypted, peer-to-peer, trustless communications protocol that can be used by one person to ...


2

Password reset mechanisms typically work like this: The server generates a secret random string (e. g. 16 bytes read from /dev/urandom). Then the server sends this string to the user, often embedded within a link to a password reset page. A hash of the string is stored in the database for later validation. Usually, the string is only valid within a certain ...


1

Most likely, the attacker has embedded a script in the document or in another document in the same account. Check all of the documents for embedded scripts and make sure there are no stand-alone scripts either. Also make sure that none of the files have been shared with an external user id. Then make sure the user turns on 2-factor authentication on their ...


1

In some cases, yes. Client It depends on the MUA/client, but forwarding a message will cause a copy to be stored in that person's sent items. That counts as a copy, as does the copy in the inbox. Outlook/Exchange can store these copies either on a local PST, on the Server, or both in the form of an OST Server Every MTA (server that touches the message) ...


1

I would suggest that the lifetime of a key should be determined by its strength, according to both its keysize, and to the likelihood of reports of weaknesses in the algoritm used to create the keys. According to Technet.com in 2009, regarding how long RSA suggest the validity period of a certificate should be, based on how long it would take an adversary ...


1

sslstrip works by changing all https links to http. It is restricted to HTTP but tools for other protocols might exist or at least are easily doable. These kind of tools don't break the TLS connection but instead enforce a downgrade to an insecure unencrypted connection. How good these kind of tools can work depends a lot on the application and on the ...


1

When the SPF is not validating, its clear that the mail are not going through your servers. Propably the end user has configured their client to mail through a ISP-owned "smarthost" that the ISP enforces. Double check the client configuration and firewall settings, and ensure the mails are really reaching your relay SMTP.



Only top voted, non community-wiki answers of a minimum length are eligible