Tag Info

Hot answers tagged

54

Your answer is pretty OK, but you could explain the ongoing "game" between spammers and spamfilters a bit more. This makes it understandable why some spam always will find its way to the customer. Spam filters try to catch all mail that is spam. Spammers try to create mails that are trusted not to be spam - both by spam filters and by humans. For ...


22

The main function of a SPAM filter is to block anything that looks like a SPAM. The objective of an anti-virus software is to detect and remove anything that possess the signature of a virus (worms included) based on the virus definition installed. Both programs work differently based on different heuristics. An email that doesn't look like a SPAM may ...


18

Changing your e-mail and phone number is silly. Your phone number, unless unlisted, is a matter of public record and easily discoverable. Even if unlisted, it is still a publicly shared identifier that can be discovered with some investigating. Your e-mail address is also a public identifier and can be discovered with some effort. Having identifiers in ...


15

They track opens the same way every other email sending/analytics company does it: by inserting a tracking pixel within the HTML of the email. If your email client blocks image loading by default, then you won't be tracked. If you load the images, or your client automatically downloads the images (iPhone email client) then you're being tracked. You can see ...


10

A spam filter can be created that will block all spam; one could simply have the filter block all incoming email. Most users would find such a filter unacceptable, though, so the challenge is to find a balance between blocking email that users don't want to receive, but at the same time allowing through all the email they want to receive. If the filter is ...


10

I like to use the analogy of an arms race as it's a familiar theme that non-technical people understand. Analogies are useful when trying to explain concepts such as this. Also throw in statistics. Last, use some pseudo-personal stuff to make them feel like you're in the same boat. Something like this may work: I completely understand your frustration with ...


9

No, they can only see the encrypted traffic flowing from yourself to Google's servers. They cannot see the actual content of the traffic (your emails). However, if your ISP forces you through a web proxy and makes you use their certificate, they could then see the content of your traffic. I would be cautious if you see untrusted certs when going to ...


9

Basically, almost every method of discovering the sender is considerably unreliable. Usually, you don't send the email "directly" from your PC. Usually, you use a SMTP server owned by your internet provider or your email service provider. This SMTP server takes care of your email. For instance if the end destination SMTP server was unavailable it delays the ...


7

The explanation I have always used is the analogy of "Why did my bullet proof vest not stop that bullet?" is because the bullet proof is a misnomer, and someone simply used a bullet designed to defeat your bullet resistant vest ;) Most people seem to get that concept that it is a balance of too tight (false positives restricting mail flow) and too loose ...


7

The problem you're running into is that GET is supposed to be both "safe" and "idempotent": that is, calling it isn't supposed to make any change on the server, and calling it many times should have the same effect as calling it once. From a standards standpoint, you should be using a POST to use the token. Obviously, you can't do that from an email. One ...


6

I think your answer is correct. Nothing is 100% bullet proof. That is why the user has to have some awareness and some knowledge to understand when and how things look strange and what to do next. (this last part is forgotten and people tend to trust too much in applications) That is why those situations occur, people discover that applications are not 100% ...


6

Experts are experts. What an expert says stands in court as long as: He is an expert. The other party cannot provide another expert, who says that the first expert is wrong, and says it in a more convincingly expertish way. In practice, a email will be reputed to have been sent from a given PC if the context makes it a lot more plausible than any ...


6

If the attacker gained access to your PayPal account via your username and password, the best thing to do is change your email and bank passwords. I'm hoping that you did not use the same password for all of these accounts. If you did re-use your password for PayPal on other accounts (Amazon, Ebay, etc), I would highly recommend changing those passwords as ...


5

I'm not familiar with Sidekick, but another way to verify that an email has been opened is to use an image tag in the body of an HTML email. Let us pretend that the image tag looks like <img src="server.com/images/tracker.jpg?recipient=sparkler@domain.com" /> The server delivering tracker.jpg can then record the query string ...


5

They can't. Encryption is encryption. Email services won't spend time and energy trying to brute force your password, nor do I believe they would create backdoors for the sake of email. If they let you send encrypted archives then they simply don't check the contents.


4

From a technical point of view it possible to prove that an e-mail has been sent from a specific mail account, if the original SMTP server enforces such a policy and all intermediate servers authenticate the origin of pass-through messages, e. g. with DKIM (and assuming the servers themselves have not been tampered with). From a legal point of view you need ...


4

The short answer is no, nothing will stand in the court, all possible tracing techniques can be defeated in court by a clever lawyer and a tech savvy. However, another way to think of the problem is to add additional proofs to what ever tracking information about the source of the email you have. For example if you can trace the IP address and link ...


4

You should not only focus on your cellphone, as there are other possibilities how this can happen. If a mail is sent from a pc it will also be shown in you GMail App, so this is no evidence that your mobile phone is the root of the mails. Look at your Google Account's recent activity, perhaps your password has been guessed or stolen from somewhere. There ...


3

You were right in your explanation. In trying to relay the issue, I would try to explain in less technical terms. Non-tech people don't like, and will have problems understanding technical explanations. So try to avoid them. Especially when they're already upset. I like to use cars. In this case, spam filters are like looking at a car. A look at the car ...


3

You can't necessarily know if an email you receive is designed to be tracked but as tracking is limited to certain techniques, you can infer a higher probability of this behaviour if the email seems tailored towards such an end: Email includes images that need to be downloaded remotely Typically an email can have all images and formatting stored internally ...


3

As Tokk said it is possible that your mail account is compromised from some place else but as you said you are using two factor authentication I believe it is more likely your phone is infected. Check your recently installed apps. Look at comments of the app and installation count. Sometimes they make a clone of an app to spread malware. If you find ...


2

There is no way to be sure that the resipient won't retransmit your documents unsecured to others. You could use password secured PDF files, theoretically they sould be safe if you forbit to print and edit them. But even in this case, one could easily take a screenshot and get the crititcal Information out of the PDF. Or someone resends your files in the ...


2

I would create tokens (Some random hashes or GUID) for each intended user and pass that in the query string to identify the individual users. Kind of like a temporary password. Putting this on the query string is convenient for the user. Making the GUID, or token temporary or for one time use will reduce sharing. Your only concern after this is if your users ...


2

If you're asking whether a generic email provider such as gmail has PCI compliance issues because of what it's users may do, then no. Consider the DSSv3 definition: PCI DSS applies to all entities involved in payment card processing—including merchants, processors, financial institutions, and service providers, as well as all other entities that ...


2

The email spam filters are not 100% effective, that's a fact and you said it correctly. As their name suggests they are filters, if something doesn't match the filter, it slips through, but that is why there are multiple levels of security used while receiving an email. Therefore if one fails, there are more checks being performed. This time it got caught by ...


2

OH MAN am I glad that I no longer have to deal with these. I would explain how a spam filter actually works. Generally spam filters have a "rating" system (The one provided to our company by Google worked this way). The rating would go up if it matched known-patterns The rating would go up if it matched known keywords (Many keywords related to drugs, ...


2

Theory is that everything works automatically. Practice sometimes differs. I suppose that you are talking about S/MIME and X.509 certificates. With S/MIME, when you send an email: The email is encrypted with the public key of the recipient, so you have to know the current recipient's certificate. The email is signed with your private key and the signature ...


2

As @MrDCGN and @saltface pointed out, the tracking is done using hidden objects in the HTML view of the email. Blocking this kind of tracking can be achieved in a few ways: Stop using HTML view, and use only plain text. This would prevent loading of any non-text object, and will damage RTF formatting. Disable image loading in the settings of the email ...


2

Everyone is trying to explain the arms race, which is true, but there is the very simple logic that if spamfilters were perfect, then spam would not exist anymore because it's no longer profitable. And a spambox would not exist because we are 100% sure of what is spam and what is not, so it could go straight to trash without landing in a spambox first. ...


1

You seem to talk about two different things: retrieving mail and encrypting mail. From reading the question I think encryption is not what this is about. So for now I forget about it. When you login to Hotmail or Gmail via your browser, you use your login. It looks like you have more email addresses and possibly popboxes. Now it depends on how you setup ...



Only top voted, non community-wiki answers of a minimum length are eligible