Tag Info

New answers tagged

0

There are plenty android applications in the market. I am using K9 with APG (Android Privacy Guard) and I am very pleased. K-9 Mail is a free and open source email client for Android devices, that integrates seamlessly with Android Privacy Guard. Android Privacy Guard (APG) is a free and open source application that lets you encrypt, decrypt and sign ...


1

TL;DR, you can't. The protocol behind email is quite primitive, and in many ways very closely mimics the meatspace postal system. Nothing stops me from dropping a letter in the mailbox pretending to be from someone else (although the postmark might indicate that the letter wasn't actually picked up from where the return address specifies). That said, the ...


2

Bear in mind that if you and your friends all have each other as contacts the email could have been sent from one of their systems and simply masqueraded as you. The from address in an email is very easy to spoof, so just because it says it is from you (or a made up address that has your name so that it looks like you) it does not necessarily mean it was ...


2

I'm unfamiliar with the details of the systems you specify but understand email encryption in general. Once a message is encrypted, the system cannot re-encrypt it with a stronger algorithm without user intervention as the system can't decrypt the email to re-encrypt it. So you're email is frozen in time in terms of the encryption that was used. Even if the ...


1

First of all, anyone who stores data unencrypted on your behalf can read it. This is the simple physics of information, and there's no way around it. If you don't want it to be read, you encrypt it and don't give away the key. That's literally your only option. As for what does happen, the larger and more established the company, the better their technical ...


2

Sure they can but reputable providers typically don't. Google's Terms of Use are pretty specific about sharing. They'll share your info When you opt-in to something (eg: a purchase). With your admin if you are using a Google Apps domain. With a Google affiliate (ie: a different Google company). When required to by law. In the US this is likely a warrant. ...


4

1) Contact gmail, and ask them to shut down the gmail account that your customers would send their details to if they fall for the scam. 2) Notify all your customers that this is a scam, and they shouldn't reply to phishing emails like the one above. 3) Spend a bit of time and energy on finding out how/why this happene, and if possible who did it. E.g. a) ...


4

You can sign with both PGP and S/MIME. Contrary to Oliver Schmidt's response, it is possible to create an external signature using PGP (you can sign any file with a PGP key, not just text - a executable (.exe) is not a good candidate for inline signatures). This is referred to as "PGP/MIME". An external signature on a PGP file will be *.sig and S/MIME will ...


4

To make a long story short: Yes, that will work and it will make sense, too. I'll try to explain this: PGP stores the signature inside the email body. The body of a PGP-signed mail usually begins with -----BEGIN PGP SIGNED MESSAGE-----, followed by the hash algorithm and the message clear text, followed by -----BEGIN PGP SIGNATURE-----, followed by ...


1

"Accountability" will not change - you are still accountable for your activity. But, by doing what you mentioned (anonymous payment, disposable email), it will be very difficult for the investigators to "attribute" your activity to you through the administrative information provided to them by the VPN provider if you also obfuscate your IP by constantly ...


0

You can use an encryption algorithm like RC4 or AES. You can encrypt the auto generated password in your app with a key and decrypt the same at server before account creation. If any user catches the transfer he will only see some random sequence of letters. If your users have an account on your server than you can also generate a unique encryption key for a ...


3

A number of anti-virus, anti-spam, and anti-phishing solutions work by visiting every link in an email and checking to see if the link leads to a suspicious-looking site. Sometimes you can detect them by checking the user-agent, but more often, they imitate the user-agent of a well-known browser (typically Internet Explorer) to prevent malicious sites from ...


0

If the links lead to a http resource you can check the useragent field, maybe you'll find a common value for all suspicious mail clients.


3

It appears from Microsoft's documentation that the "Mark this domain as trusted" is a simple regex on the sender's email address, including the account name. So, it would appear that there is no analysis of the headers, MX records, SPF records, etc. on the client-side. That means that a spoofed allowed email address from a blocked domain could be treated as ...


-2

An attacker can do far more than spoof the "from" field. If a mail server is mis-configured, it can be used as a mail relay. In this case a malicious email can be crafted and really be from the domain you trust. That being said, Outlook is simply applying a filter. Even if it did analyze the headers, how would you handle emails from an organization ...


4

However, the server must store some form of the mailbox password so that the user can be authenticated. Should a security breach occur on the server, wouldn't it be just a matter of time for a determined hacker (and a powerful hacker, if, say, a government desides to be one) to figure out the real mailbox password? Security is about trade-offs. It is ...


2

You are correct, however note that there is no indication that AES256 is cracked (and normally it won't be anytime soon either). Considering the strength of AES256 it will take several millions of years (even with quantum computer as the best known theoretical attack is Grover's quantum search algorithm. This allows us to search an unsorted database of n ...


0

The query string after the domain name of the uri scheme are probably some kind of tracking id as well. There's probably a large cross domain database that correlates the clicks with whatever that could be installed on your computer.


2

Short answer: you can't, because they are two different and incompatible key+certificate systems. Longer answer: Windows Certificate Manager uses X.509 certificates, each of which must be signed by a Certification Authority whose root certificate is considered valid by Windows. Thunderbird will use the public key stored in your recipient's certificate to ...


0

I haven't worked with spam filtering scripting but this is something that I had known for a while, hoping this helps! One of the Apache Projects, named SpamAssassin could come in handy. It is a Spam filter for mail servers but I am guessing you will be able to work with it to some how suite your use-case on the client side. One thing particularly of ...


0

http://0x1F.8847525?-zcNQec8Mqyay9MwQufAZyDUlLviGZxNBtAvdjUQniA4jIwSjug… Components of URI schemes (with hierarchical part expanded): <scheme name> : [ <userinfo> @ ] <host> [ : <port> ] [ / <path> ] [ ? <query> ] [ # <fragment> ] All these URIs have is a scheme name, host, and query. While it is quite rare ...



Top 50 recent answers are included