Tag Info

Hot answers tagged

33

Yes, email is insecure, and should not be used to deliver sensitive data. That doesn't mean that they should need to refuse to send anything via email, but given HIPAA and the potential penalties for non-compliance, I'm not surprised that some providers would choose to err on the side of extreme caution and shun email entirely. Here is why email is ...


15

Signing mails is in my experience the best method to show others they can send you encrypted mail. If they're using OpenPGP anyway, their mail client might even automatically enable encrypted mails as replies to signed ones. Recently I was very surprised receiving (S/MIME) encrypted mail from both a bank and a health care institute, just because I signed ...


6

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone ...


4

Certificate Authorities The email client would automatically look up the PGP key of all receivers in key stores (first local, then public keyservers, ideally provided by the receiving email provider) and encrypt the mail with these keys. Ideally, we would use trusted keys by regular PGP standards. However, we would fall back to any suitable key with less ...


4

No. You don't even have the email you are trying to "trace" let alone the headers. Even if you somehow managed to convince someone to disclose whatever it is you're trying to "trace" you have no way to verify the authenticity. Sorry, but you're out of luck.


3

There are a few things you can try to help prevent malicious actors from abusing your service: Require a CAPTCHA: This should help cut down on bots abusing your services. Limit usage of this feature by IP address & time: Don't let a single IP send large amount of mail within a short period of time (keep in mind that you may have multiple users behind ...


3

Yes, it is possible. Maybe the sender uses VPN or proxy, or the IP he uses belongs to a entity hosted in San Jose but have a remote link to Maryland, or he is using remote access software from Maryland to San Jose. And about the loopbacks, it's very common. Mail servers often work in clusters, so it's possible that one mail server received the email, and ...


2

I have helped people who have experienced exactly the same thing that you are describing and it was simply the result of an infection. A program connects to her gmail account, and searches for emails in her contacts and folders, including the deleted items folder. Then, spam is sent out. I know that you have scanned her machine, but scans do not always ...


2

Nagios has a feature that detects what is called "flapping" which you could implement yourself. Basically it will start sending you text messages, but will stop if it passes a certain tresshold within a given timeframe for a similar type of warning message. It's up to you to decide the thressholds and the intervals and the classification of the events. ...


2

As I said, full marks to @JeffClayton for using an e-mail account EXCLUSIVELY for password recovery. However, for added security: Every month, install a new version of TAILS to a USB drive. Use TAILS to make the account, and TAILS to access it. As soon as you have the fresh TAILS install on the drive, boot it up and change your password (that's every ...


2

I would not consider using a family member or friend's email to be a good idea, for reasons you mention yourself or simply if they ever change a password. I would create a new email address and use that, but for no other purpose. That way you would also not be putting others at risk. 2-Factor is not a bad idea. The harder you make it for an attacker to ...


2

You can't. The way the mail system is designed does not ensure that sender email addresses must be verified. The email system we used was originally designed for a closed environment where all the members of the network were known and trusted, security and verification of sender address was not a requirement. When the internet was created there was no ...


2

From my personal experience it would be better do send a link to a webpage where the user has to download the software by cklicking on a download link/button. There are many spam/ malware filters for mail out there blocking mails with direct links to software. I encountered this many times trying to get updates of our software to various clients. Now we ...


2

Including your PGP key fingerprint in the signature is not a good solution because there's no way to verify the identity of the person sending the message. It provides a bad example of what PGP is intended for. Including your PGP fingerprint on your business card is a reasonable way to handle fingerprints. A long signature describing the insecurity of ...


2

Account lockout is an effective rate limiting measure against brute forcing logins when the attacker is targeting one particular account. It is not effective against a bulk attack across many accounts. One could, for example, try all possible usernames whilst trying the same common password for all, and recover some proportion of the accounts. Even CAPTCHA ...


1

For posterity I'll add my own answer to illustrate the procedure I went through. Step 1) Discover which accounts are sending spam Log into WHM and go to "Mail Queue Manager". Do searches and view the emails to see which accounts are responsible. If for some reason you don't have access to WHM, chat with your web host to get this information. Step 2) ...


1

Many systems support the use of alias with a character such as +. So, makerofthings7+c6201404b8efbe@invalid-email.com would be equivalent to makerofthings7@invalid-email.com for the MDA (ie. they would end up in the same mailbox). Then, you keep a list of whitelisted tokens (maybe paired with the From header they must use): ...


1

When you read the headers, you see that the system you received that message from is server04.funet.co.il. [212.29.215.70] so that's where the spam should be reported. Now that domain does not appear to be available in English so your first option is to follow RFC 2142 recommendation and send the complain in English (with all the details about this spam) to ...


1

Encryption with SSL consists of the following steps: Identify the peer using a certificate. Create and exchange keys for the following communication. Exchange data, encrypted with the previously exchanged keys. You are usually employing encryption because you think that anybody might listen to the connection. A small step from this passive listening is ...


1

You're fine with a self-signed certificate. In my experience over several years, I never had any problems with a self-signed certificate on my mail server. I eventually switched to one signed by StartSSL and there was no discernible difference in interoperability. See also this post on ServerFault. The bottom line is, STARTTLS is about encryption, not ...


1

There is possible for one type of "automated web of trust", and that is DKIM. DKIM works by the signer (domain owner) publishes the key in DNS. Since only the owner of the domain can publish things in DNS, security is gained this way. Combining this with DNSSEC, you have a completely automated web of trust for SIGNING. However, this is not E2E. Instead, ...


1

Email and SMS are plain text solution. You can put a public key on the server and have it encrypt any alerts sent over any medium so they are unreadable and can only be decrypted by the authorized recipients. The encryption piece would give you confidentiality. This would also provide some degree of integrity because a fake alert could only be inserted if ...


1

For your questions relating to Gmail, they can intercept the traffic - but Gmail uses SSL/TLS to encrypt your traffic, so they would only be able to see the encrypted content. Google uses HSTS to enforce the use of HTTPS, so you should be fine. For any account that doesn't use an encrypted protocol (http, ftp, telnet, etc.), then yes - your credentials can ...


1

This is a very broad question, depending on your setup. If you use SSL from your PC to your mailserver (wich is not administrated by the same guys) and your connection is secure, they can't see anything about your mail, except for the size. If you use unencrypted communication with your mailserver or the mailserver is administrated by the same guys it ...


1

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly. A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world. they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) ...



Only top voted, non community-wiki answers of a minimum length are eligible