Tag Info

Hot answers tagged

51

In the OpenPGP format (that PGP implements), a given email can be encrypted for several recipient with only minute per-recipient size overhead. This is because email encryption actually uses hybrid encryption: A new random symmetric key K is generated for the email to encrypt. The bulk of the email is encrypted with a symmetric encryption algorithm, using ...


15

To add some information to the excellent explanation of Tom, you should be careful with a BCC if you really want to make sure that the BCC is actually a BCC since you can detect from the list of encrypted session keys that the message has been encrypted with some other PGP key. To be precise, the key ID of the PGP key but since most keys are stored on a PGP ...


7

First, some background information about how email works. The basic issue is that server-to-server contacts using SMTP are unauthenticated: all a server knows about the computer contacting it is The IP address Who the computer wants to send the email to Who the computer claims they are Who the computer claims the email is from Note that the last two ...


7

I've been supporting and administering email for 18 years, and never had a valid reason to block text attachments. Here are some issues that I can think of, that aren't exclusive to TXT attachments alone, but rather regard attachments in general Unicode parsing The only two issues I've come across is this unicode bug but it's theoretically possible that ...


6

Signing emails is useful only insofar as recipients verify the signature. Theoretically, signing the emails might improve deliverability, but only if a recipient configures his filters for incoming emails to verify email signatures and accept emails which have been verified to come from you. However, this is only theoretical; in practice, email filtering is ...


4

Most of the people who are in power to eavesdrop on the email, like the internet service providers and email providers of her and her recipient and the three letter agencies, are likely not very interested in that information. Providers are in a position to collect lots of sensitive information, but they can not risk to abuse it, because it would be quite a ...


3

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


2

If you are afraid of "snooping" then why would you use signatures ? A "snooper" is a passive eavesdropper, who wants to see the data but certainly not to make you aware that your emails are inspected. They won't alter emails, or send fake emails, which are the kind of things that signatures can help against. If you want to defeat such sniffing, then you ...


2

You client is looking for the server to provide copies of the intermediate certificates and it appears your server is not doing so. The exact configuration will vary based on your server, but it should be possible to download the intermediate certificates (from your CA) and share them along with your server certificate in order to get to a certificate that ...


2

In addition to makerofthings7's very thorough answer, another reason could be to prevent phishing attacks which tunnel dangerous content in the TXT attachment. For example, if you send a file called ILOVEYOU.EXE.TXT, sign it as "grandma", and instruct the user to save and rename the file - some percentage of users will happily follow those instructions to ...


2

There are no specific risks associated with plain text attachments as defined by the RFC. Ref: http://tools.ietf.org/html/rfc2046 Operating systems like Windows associate the "txt" extension of the file-name to the text/plain MIME type and have executable association on-click/open with some defined program (like notepad/wordpad, etc). By default on most ...


1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...


1

It's also possible that all attachment's are being blocked - regardless of extension. Or, there may be an organizational policy that permits only certain file types - maybe only .pdf has been approved, and so .txt is explicitly blocked. While not necessarily a security issue, there is the possibility that someone could send a lot of very large .txt files ...


1

It looks like the chain is not correct. It looks like there are three certificates but all of them are the same. It looks like you are missing at least the Comodo Intermediate certificate: CN=COMODO RSA Certification Authority.


1

It very much depends on what you mean with "legal risks". For example in Europe there is something called a "qualified signature". If something, a document, email etc, is signed with a qualified signature, it has full legal binding. You cannot deny having signed it (at least the proof is on the signers side that he/she did not voluntarily signed the ...


1

If you want to be as sure as you can be, reinstalling the operation system from read only media is a good idea.


1

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


1

The HTTPS traffic is encrypted, you can trick a computer into not using HTTPS but for this you'll need to setup a man in the middle attack. Then use something like sslstrip to trick the client into not using HTTPS. Kali linux has all these tools build in, so that would be a good OS to start with.


1

As things stand, there's not yet anything that makes me think of an attack. It could conceivably be a really, really convoluted and unlikely confidence scam: step 1: I make a payment to you (but I'd do that with a larger sum) step 2: I withdraw the payment Most confidence scams are based on the victim's dishonesty; their willingness to do something ...



Only top voted, non community-wiki answers of a minimum length are eligible