Tag Info

Hot answers tagged

17

Set up Domain Keys Identified Mail on your own domain. That will digitally sign legitimate outgoing from your domain. More and more email providers are rejecting or flagging spoofed email where legit email is identified with a Domain Key signature. Added November 23: Your question says, "apart from SPF..." and that's what I answered. However, for others ...


13

Lucas Kauffman answer explain the how very well, as for why: If the user is failing to receive important emails and it turns out they got caught in the spam filter then they'll get angry at their admin. False positives can have a very high cost. When a lot of users get angry at the admin the admin is likely to change things so that the spam filter is ...


12

There's a good paper published named Bachelor thesis:The Effects of Different Bayesian Poison Methods on the Quality of the Bayesian Spam Filter ‘SpamBayes’ by Martijn Sprengers. I'll try to make TL;DR: Bayesian spamfilters try to decide if an email is spam or not by looking at keywords in an email. What it does is review the words present in normal and ...


8

Strictly speaking it is not possible, for the following reason: if the Web service encrypts the message, then the Web service gets to see the unencrypted message at some point (note: I write service, not server). At best, the service may be honest and do its best not to have a look at the messages at they flow. Now let's see the claims of that "ProtonMail" ...


6

I'm afraid not. You might be able to solve your problem with something called "two factor authentication" though. This is an option you can enable in Gmail where you will need to have your mobile phone with you whenever you log onto your mail. It is very easy to set up and highly recommended. If this won't fix your issue, edit your question to add some ...


5

Yes, it is a scam. Any email you get, from anyone you don't know, offering you money, is a scam. This is a rule of thumb that is essentially 100% accurate 100% of the time. The best course of action to take, when you receive emails like this, is to delete them as soon as you identify them, in order to minimize the amount of time you waste reading them. ...


5

This is done as you say, except with an optimization. The email itself is encrypted with a newly generated random symmetric key; and that key is then encrypted with the public key of each recipient. This means that if you have a 2MB email and send it to 20 people, total size is a bit more than 2MB, not 40MB.


4

It sounds like your message is signed using DKIM which is good, because this provides cryptographic proof that the sending mail server sent the message and verifies the integrity of several key fields such as the to and from addresses. Assuming that the sending mail server can be trusted to properly authenticate the sending user (eg. via their login) then ...


4

Originating email address is quite easy to spoof when SPF is not in the picture. However, given the nature of TCP it's much harder to spoof a source IP address. It is possible your account is compromised if you are seeing this source IP. I would highly recommend changing your password. There is a possibility there is something configured incorrectly with ...


3

YES it is possible that it is forged. Only the very last envelope/stamp/header is to be believed. Anything below/before that can be forged and you do not know the providence from which it came! When you get a piece of mail, you know the IP of the system you are talking to, and you trust your mail system, so you know that envelope/header/stamp is correct. ...


3

The short answer is that it's possible there is no way to find out more details about this. You should definitely enable two-factor and change your password ASAP. That being said, I can give you a few suggestions if you want to try to find out more. Google deliberately masks source IPs in their SMTP headers to protect your privacy. This is why you see a ...


2

The headers of the email will contain traces of the servers that were used and the originating account. But the authorities know this and will take care of it. Besides the technical proof, it is also possible to compare wording and phrasing to provide a likelihood that an individual sent an email. Threatening emails tend to get creative and provide many ...


2

A server that receives email and delivers it to local users needs root permissions for two things. The component that listens to incoming connections needs to bind the TCP ports for SMTP (25 without SSL, 465 with SSL), because port numbers below 1024 are reserved to administrator-controlled services and binding them is reserved to root (or processes with ...


2

The Postfix master process is the one that launches the other daemons. In particular, it launches the daemon that delivers mail locally; the latter must be able to impersonate any user ID in the system, which involves beginning its life as root. Thus, it is mostly unavoidable that the master process runs as root; otherwise, it would not work at all. ...


2

Most email virus require to be executed through either of these methods: The email software and/or the operating system automatically runs the file when it sees it. This is the case for pictures that exploit flaws in the picture-rendering libraries: the software processes the picture automatically (if only to show it as a thumbnail), triggering the ...


2

I had a very similar problem with Postfix and Dovecot on Ubuntu. I had purchased the basic SSL certificate from Comodo and because I selected "other" as the server type I ended up with a zip file with four certificate files in it, as per the above posts. I wasn't getting security exceptions in the client. In my case I couldn't even get past the account ...


2

I have a great example of a spam message with Bayesian poisoning on my blog. Bayesian spam filters basically keep track of each word used in each message. When a message is marked as spam, the filter treats the words in the message as representative of spam. By using this information, the filter can determine with good accuracy whether a particular message ...


1

Verify that your Key is not protected by passphrase. Postfix does not supports passphrase protected Keys anyway you can remove the passphrase from the key using an openssl command openssl rsa -in passphrase.key -out nopassphrase.key is not necessary to include the Root CA if your CA Bundle does not include your CA Root you can append it: cat ...


1

Yes - you should worry about this. Email addresses are personal information; they are linked to an individual. As G-Man mentions, there is a spam risk in divulging what email addresses exist. But moreover, the fact that a particular person uses your site is private information, that you should not disclose publicly. All sorts of sites could potentially be ...


1

Only the address? Not possible. Even with the full headers of the email it can be difficult to trace, because it's possible to forge most of them.


1

If the underlying algo's and methods (i.e. including signing) are the same then the reliance on the actual encryption is no different and in the real-world there is little difference in risk. From a theoretical cryptanalysis standpoint one could argue that if the plaintext covering email provided context it would aid an attack on the cipher text, but modern ...


1

In SSL/TLS, the server is supposed to send not only its certificate, but a complete chain that goes from the root to the server's certificate (the root itself may be omitted, but the intermediate CA should be sent). If the server does not send a complete chain, then it is up to the client to try to complete it, e.g. by downloading the missing certificate, ...


1

I will answer the question: How do I transport malware to host for analysis without it being deleted or tampered with during transmission (due to Email or A/V products)? To properly transport known malware, in a secure manner, you must first get it downloaded without host OS deleting because A/V software detected it. You can "pause" host A/V in most cases, ...


1

The reason the master process has to be started as root is because only root can bind to a port in the range of the first 1024 "privileged" ports. Running any type of software as root could be considered a security thread but it also depends how secure the software itself is, and if updates/patches are applied regularly. If you would like to add an extra ...


1

This is explained on their security details page: Securely communicate with other email providers. Even your communication with non-ProtonMail users can be secure. We support sending encrypted communication to non-ProtonMail users via symmetric encryption. When you send an encrypted message to a non-ProtonMail user, they receive a link which ...


1

Obfuscation is a technique used to, obfuscate, or make less obvious, something. From a security perspective, obfuscation can make it more difficult or time consuming for a human attacker to understand whatever it is they are looking at. (It could also be a method of security through obscurity, by hiding things, as an example.) Most of the time people view ...



Only top voted, non community-wiki answers of a minimum length are eligible