Tag Info

New answers tagged

0

There are two aspects of email security w.r.t. the DMZ: SMTP Transport (inbound) Client connectivity SMTP transport requires AV scanning and often requires DNS lookups, virus sandboxing, etc. If the SMTP processing is outsourced to Google, Microsoft, Proofpoint, then I see no issue in allowing it to relay directly in, as the 3rd party is the outsourced ...


3

The short answer is no. Sure you can make your email very legitimate looking, that isn't the problem. The problem is you are conditioning your users to click on links in emails and email is a 100% insecure medium. Links in emails are an anti-pattern. "Official looking" isn't secure. Almost everything in your email can be replicated by a dedicated ...


10

Short answer, it's not the easiest solution. " it's very easy to set up a self-hosted email server" You are wrong, the rest is wrong because it's based on this. I assume you imply it's easy to set up a safe server (otherwise, what's the purpose of it all?). Your laundry list of what you need is long, and not even so it is complete. It's much easier ...


4

Email is insecure. It is completely insecure. Between you and the recipient it likely passed through dozens of servers and for each one it was passed as pure plain text. Without specific details and logs it is impossible to say where a copy was lifted but regardless you should always ASSUME that anyone can read anything you put in an email. If that ...


34

As someone who has actually done this for a couple of years, I can tell you that it's not nearly as simple as you're describing and it doesn't offer the security properties you want. In summary: Why do so many security experts (i.e. cryptologists & co.) not host their own email? Because it takes enormous amounts of time and specialized knowledge ...


10

There speaks someone who has never run their own email. You don't mention an inbound antispam solution. DKIM and related techniques are for authenticating your own mail as not spam and making it deliverable. (Deliverability is the main barrier against home hosting: most providers block port 25 and many mail recipients block all ranges known to be ADSL). But ...


3

I'm not a expert, but since nobody said the magic word " encryption " here yet, i will write this answer. It seems to me that what you want is to prevent NSA to get the hands on your communications data, but you are looking the wrong way, you must trust only the encryption algorithm that make the data secure and private and nothing more, you should aim to ...


15

When you send emails in your scenario, you announce the IP of your custom, private email server. Every recipient, and any interested party, now knows you use your own email server and where it is. This results in a one-to-one mapping of this server and your connection to it. If a government agency wants to track you down, all they need to do is to look for ...


61

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISPs do not provide law enforcement access to their sites and to the systems they provide for their customers? And with a home server: lots of sites explicitly deny access to their mail server from a "home" IP address (these are known address blocks), in ...


2

In the USA, there is the CAN SPAM act which requires advertisers to honor and respect unsubscribe requests. Violating this is a very serious crime. You can report it easily to the FTC, and if it's a US company, they will get into a lot of trouble. Because of how bad the punishment is, legitimate companies rarely disregard unsubscribe requests - you can ...


2

1) You can digitally sign the email, so it will look more trustworthy (if the mail app supports it and do not show it just as attachment). 2) It is not the best idea to include links in the email. It is better to give them instructions how to do the change and where. Also, the password change tool should be on your company URL that they know and trust it. ...


1

My experience with such links is that the amount of spam that I receive tends to decrease when I click on such links. Although most such links go to a similar/identical page as each other, I am of the opinion that those links are provided in order to legally cover the spammers - because anyone sending email has a legal obligation to stop sending at the ...


3

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com? Yes, competitor can bypass this, but not easily. Lets say that SPF is "v=spf1 include:spf.mandrillapp.com ~all" This means that I allow server spf.mandrillapp.com to send emails for my domain, while all other will SoftFail (that is the ...


0

It would be more of real time chat and not email (electronic "mail"), isn't it? with a API based json calls one could easily accomplish that but there would be adverse security violation in having this feature.


2

It depends on the email system. In general, no, this is not possible. Traditional email messages were not written on interactive websites (unlike, say, Facebook messages); there is also no central server you are expected to continuously be connected to (it's a decentralized system). So, traditionally, messages were written entirely client-side, in a program ...


2

The theory is that traffic to the DMZ must be inbound. In that case, should something bad happen to the the DMZ host, the attack is contained within the DMZ. This means that the connections from your LAN must be initiated in the LAN, which usually means some kind of push (to the DMZ) or pull (from the DMZ) operations. This is doable for mail but sometimes ...


3

If you know the sender has got your email address legitimately, as per @WernerCD's answer ('Something you signed up for - knowingly, accidentally, "opt-in" purposely, "opt-out" not clicked'), go to their website and unsubscribe there. Many companies use third party web sites as end points for the unsubscribe links ("mailbot.com/unsubscribe" as opposed to ...


5

It's pretty much a coin toss. If the spammer is a honest one, you'll get unsubscribed. If he's a malicious one, you'll get marked as "active reader" and get enrolled in even more spam lists. The second option silently assumes that it's actually worth the spammer's time to keep track of "good" and "bad" recipients, that is, that having a tracking system is ...


136

I think the one thing the others (as of this post) hasn't mentioned: Source of the spam I would say you should differentiate between "Good" spam (Something you signed up for - knowingly, accidentally, "opt-in" purposely, "opt-out" not clicked)... And "Bad"/"Unknown" spam (random garbage that likely uses the click for tracking). I have no issue clicking ...


3

I use hotmail (live/outlook...) and in their web client, at the bottom of each email they have an unsubscribe button, it is not part of the email it's within the mail client and this button will unsubscribe you from sources which they trust and have set up this system with. If the source is not trusted they will simply block them from sending you further ...


5

In addition to being marked as an active reader as @Danny says, unsubscribe links could be used to infect your system with malware. If you actually subscribed to the site and want to unsubscribe the best way to do it is log into the site and change your preferences. Otherwise report it as spam and delete it.


37

You should not click on any links. By clicking on the "unsubscribe" link you propably get marked as "Active Reader" which is willing to interact. You also get on the page of the sender, which might could infect you with malware. Remember: With clicking on any link you've confirmed to the sender that your email address is both valid and in active use. Just ...


4

The answer also depends on the physical aspect of the network configuration. If your modem or router (or combo) is easily accessible by someone else, it is much easier to eavesdrop through Wifi, although like @VirtualJJ said, the communication is encrypted. Because through the LAN with ethernet protocol the communication can be wide open for anyone to ...


1

Wireless networks are always on, and always open to being cracked. That said, WPA2 with a strong passphrase will be very difficult to break. So, for wireless, it really depends on your settings. Physical ethernet wires are not encrypted, but they have the benefit of being physical: if you can secure the physical ports (and cable modem in your case) so that ...


2

Ethernet (802.3) and wireless (802.11) are simply communication protocols. How secure they are depends on configuration. How to configure security for both ethernet and wireless will be out of scope for this answer. Out of the box, with no security configuration at all it would be easier to eavesdrop on an unencrypted wireless connection since the person ...


-1

WPA is just encrypting your WIFI password. It doesn't encrypt the traffic. Stay connected through ethernet. There is no problem with ethernet. It is actually safer if you are concerned about it.


4

Email verification doesn't provide extra security. It just validates than the newly registered user is the legitimate owner of that email address. For security concern a best practice for a web site would be not to send any email to an unconfirmed email address. This prevent leaking information to someone who mistyped his email address. Anyhow you ...


-1

Try tracing and blocking his public IP address. That will most likely stop spam.


0

The purpose of the email verification for most services is to ensure user uniqueness (and thereby, hopefully, humanity) so that the provider can resist having many legions of spam accounts set up with ease (it's still possible, just more difficult). In getting a response, the service can then deny any future users from that email address from having a ...


1

Email verification stops spam and validates that user have this email. Before you send user an email message (or some confidental message like bank), you know that you are sending this message to this user, who has not mistaken in writing the adress, and nobody else.


0

Can you clarify your question? connections to google (to read your emails or to construct a new message) will be logged with your public ip-address at the side of google The email that is sent will be sent throught google's mail servers and will therefor only hold ip-address information of google's mailserver. your internal ip-address will be logged on ...


1

For the legal side of the question, you'll need to consult a lawyer in your own jurisdiction; legal requests for information are handled differently in Great Britain, Russia, Mexico, the United States, Japan, and so on. For the IP address side, as a purely practical matter, an IP address of 192.168.1.2 really isn't going to be helpful to anyone, ever. Your ...


2

You will need to analyse message headers to determine what is going on. Google's Message Header Analyser is here. Using the tool, check the from servers to find out if the emails pass through your contacts' servers or only your own. Also check whether SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) pass - if they do pass, it is more ...


3

I feel like this is a major personal security risk for myself. Is it? It may be. You may not be targeted specifically, but "email is a private as a postcard". (Not enough reputation for a link, but it's googleable.) If so, how can I make that clear to them while still maintaining my eligibility for employment? I would've called my contact person ...


0

By checking URL you can find malicious email in email before clicking on any link, check the link address. Mostly, hackers are using URL shortener for hiding the real URL. Check sender email ID


2

An address and phone number is one thing. In certain cases, this might be considered public information, think about a telephone book. I agree with you that submitting your SSN is a bit tricky, to say the least. I can imagine that once you're hired you are required to submit this information. In my opinion there is no need to supply this kind of ...


0

Just curious, if the spoofer sent an email with personal details and made it really sound like it came from the right person, does this mean that they were able to read the emails?


0

I am not sure the idea to use axolotl for email is sound or not, but it is worth a try. My team Tradle chose to create an alternative to email like @geargewalker had suggested. Still, here are some pointers for you: First problem that @georgewalker has mentioned is solvable. PGP have always had public key servers, but they were too clunky to use. One part ...


0

Probably one of your friends' email account got compromised and the list of contacts (which contains people that you know intimately) is now being used by scammers. This kind of scam involves the scammer impersonating your friend and pretending she's stranded in some foreign country and in distress (passport lost/stolen, etc) so she begs you to wire her ...


3

It does not have to be even this. On the Internet, there are lots of so called fake mailers. One of it is for example Emkei's Fake Mailer https://emkei.cz/ So you will have to be careful until your contact persons will (or their admins will) set up SPF record which will prevent this type of the attack.


3

Does the occurrence of ESMTPS in the first example mean that TLS was used for transport encryption? Yes, but only if you believe the MTA that inserted that header and every MTA that touched the message subsequently. Any of those MTAs could write that information into the header even if it isn't true. Does the occurrence of ESMTP in the second ...


7

You cannot reconstruct an OpenPGP key based on it's fingerprint. The fingerprint is a hash value of the public key, so calculating the fingerprint of a key is a one-way operation. But: if somebody only distributes his key's fingerprint, he will almost certainly have distributed his public key on the key server network, from where you can pull it. Given you ...


0

Per recent announcements from Google regarding their parsing and execution of Javascript and CSS ( http://googlewebmastercentral.blogspot.com/2014/05/understanding-web-pages-better.html ) and confirmed by 3rd parties (http://searchengineland.com/tested-googlebot-crawls-javascript-heres-learned-220157) , the likelihood of fooling spam bots using these old ...


0

The certificate has since been fixed by live.com. Previously, the error was only shown after login. As the certificate was not expired, I suspect the transition from http to https didn't meet the standards of HSTS. In any case, I have determined the issue to be consistent across popular browsers and OS, even email accounts. Seems like it's a server side ...


0

Assuming the cert chain is actually valid, it looks like its for bing.com instead of the *.mail.live.com domains. I'd be surprised if anything malicious is going on, but more likely a bad DNS entry, poorly configured certs by Microsoft, or potentially just one part of the browser not realizing another part of the browser is redirecting to the configured ...


1

configure your mail server so that when an outgoing e-mail is sent, I enforce STARTTLS ... verify the certificate I would pin in the next session. If the certificate does not match, the e-mail doesn't get sent. There are several problems: The mail is delivered in multiple hops, e.g. from your mail client to your mail server from their to the mail ...


1

What attacks do you want to prevent? If a malicious system administrator (or anybody/any agency forcing him to be one) is contained in the list, you're out of luck without end-to-end encryption, no matter what fancy validation schemes you apply. Regarding your approach: as I understand, it is absed on the idea that nobody will be able to control different ...


1

The easiest way is to ring your ex-employer and ask them is they sent you the email. If they say no, then you know it is a virus or similar and delete it with no further thought. If they say yes then you can go ahead and scan the attachment for a virus.


2

Virus Total and malwr and both good sites to submit suspicious files. Virus total will tell you if the file is flagged by any antivirus. Malwr will give you more detailed analysis (this may/may not be of interest to you). Note that you're submitting files to an online community, so don't submit anything that is potentially proprietary/secret.


0

Your statements are broadly correct, at least for public-key encrypted email. Of course, this is not the only way of doing things. One of the key limitations of this kind of encryption is the distribution and management of keys. This is indeed one of key factors limiting the takeup of email encryption. Even corporate takeup of email encryption is minimal ...



Top 50 recent answers are included