Tag Info

New answers tagged

0

All of your confusion is because of the ZixDirectory. There is no public MX record for this mail server listing, although it was a good guess to look there. Zix uses a proprietary Zixvpm listing of all clients that can communicate directly. The {Secure Message} thingy is customizable by the sender. In recent years, Zix have used a blue bar which spans the ...


0

Microsoft appears to be addressing this with the focus on Office Server, where word documents are previewed (and edited in some cases) on a separate server that resides in the DMZ. Exchange 2013, and Lync 2013 (Skype for Business) both have some connection to the Office Web Server, but the Preferred Architecture for Exchange 2016 expects a deeper commitment ...


1

There is no such thing as bulletproof security. What could be done is to use a text based mail client such as mutt. This way, you'll see the link instead of being able to click on it. Also you can try a good spamfilter and setting it tight. There are multiple phishing training frameworks. For example the Simple Phising Toolkit, which you can use to educate ...


0

There is no one answer to this, a number of things can help, spam filters will help, but A.They won't catch everything and B. They might filter legit email (especially if you have it set to be very aggressive.) It is really a trade off. When explaining to users the best thing is general user education. Explain the risks, explain what to look out for and ...


0

If the account / address is compromised, any attempt to access the emails linked to this email address is useless, since it is not linked to an account. Many online accounts --> one registered email address. If someone gets hold of that "one" email account via brute force attack or other means, they would have access to all other accounts via ...


1

Try to assign a patent for your new encryption method. And try to sell licences or your patent. That's what the RSA guys have done. But keep the Kerckhoffs's principle in mind, and publish your algorithm. Because history has shown most proprietary algorithms fail, due to design errors.


1

Did I perform the right steps? Have I exposed myself to more risk by contacting these services? Yes and No. The fact the link you clicked on looked legit on Google with a valid certificate does not necessarily mean it is an innocuous one (you can set a certificate to your website and run any malicious script to target your visitors), and scammers ...


3

I would have performed the same actions. Confirm the validity of the website, and request the account be removed. I don't believe you've exposed yourself to more risk at all by contacting these services. The key to performing the above is to not actually click the link in the email. Go to the service's webpage separately where you can verify the ...


0

The OP asks: "So it seems that they (Google) could, if they wanted, turn gmail-to-gmail messages into a secure communication channel, and that this would probably be in their best interest." No doubt Google "could" turn Gmail into one of the most secure email services around. They clearly have the resources. But to answer the OP's question -- No, this ...


2

If sending orders to brokers and banks in your company require authorization (only authorized employees can do that) then email address is not an authorization method. Yes, it is very easy for someone else to pretend it is sending email from someone else. Using an SMTP client library you can very easily fake an email. See the following python code: ...


10

It is as easy to spoof the sender of the email as you can lie about the sender on the envelope of snail mail. It is also not only easy but heavily used: the majority of spam and phishing mails use address spoofing. The only real way to be sure about the sender is if the sender signs the mail and the recipient verifies the signature. Common solutions for ...


4

The point to "Made in Germany" isn't about security, but about compliance to German privacy laws, which are unique. It does not make those services more secure, but simply compliant to a specific set of privacy regulations.


2

All the other answers are concerned with someone reading your e-mail. However, that isn't the only concern - you also care about the identity of the sender. And that's another great weakness of e-mail - by default, there is no way to verify the identity. The sender is the one who supplies the "From" address, and I can easily send e-mails "from" ...


0

Dependency on the hosting provider to secure the email server aside, the only way to mitigate against your email account from being compromised is by taking the standard precautions. Only sign up to trusted websites and have good password hygiene. I.E change it regularly, make it complex do not use the same email/password combo on the sites you sign up to. ...


8

In the Snowden revelations it showed that the NSA had tapped into the fibre cables connecting Google's datacenters together. You can refer to the image below and make your own deductions about whether anything on Google's network is actually secure. They may have improved the situation since then, but it would be hard to prove to customers exactly what ...


0

In a Nutshell Yes, your ISP and government can read your emails, even when using encryption because of a number of vulnerabilities, and the fact that most emails are not encrypted on email provider's servers. Definitely Not in a Nutshell Your ISP can employ a number of tactics to read encrypted email: firstly email does not use HTTPS, instead it uses the ...


5

In addition to the other excellent answers, there is one more concern: just because the sender and the final destination are both on gmail does not mean that the email remains within Google. If the recipient uses his own domain name, it is entirely possible that he routes his emails through an external server before feeding it back into Google. Gmail may ...


15

A lot of this hinges on what you mean by "insecure". Traditionally e-mail was considered an insecure transport as it was transferred over an unencrypted protocol (SMTP) and typically you had limited control over how the e-mail actually reached it's destination, so you wouldn't necessarily know about the security of the systems that it traversed. These ...


82

Email is historically considered insecure for two reasons: The SMTP network protocol is unencrypted unless STARTTLS is negotiated, which is effectively optional The mail messages sit unencrypted on the disk of the source, destination, and any intermediate mail servers Google mail servers all speak STARTTLS if possible, so for gmail-to-gmail the ...


1

Self-destructing emails aren't emails as you'd think of them. The contents of a self-destructing email always remain on the server providing the destruction. When you send an email, it stores the data on the server and sends a regular email to each addressee. The regular email typically provides a link to the self-destructing message. This is a web page ...


0

You're correct, this is possible if the mail provider offers a mechanism to access user email using OAuth 2.0. However, not all online mail providers allow full IMAP access using an OAuth 2.0 token. From a quick glance around the web the only provider I found that allowed full IMAP access was Google. Office365 and Yahoo both only allow user email access ...


2

This would depend on the e-mail server that you're connecting to as opposed to being a function of the Mobile Phone operating system. The (old) default was to send outgoing mail over port 25/TCP using the SMTP protocol. Traffic over this port is, by default, unencrypted. Many modern e-mail services do not make use of this port and instead will use an ...


2

Short answer: no, you can't. There are 3 senders to your E-mail. 2 fakes and one hidden and unreachable. The one you find within the headers: From: field is free. Anyone can put whatever he wants there. You can't trust it. You cant't build anything on this one. The edited sender of the E-mail you received is do_not_reply@apple.co.uk. It looks serious ...


3

Servers passing messages is really not a problem. Your mail client has already opened the email so you forwarding it on is not opening your machine up to any further risk. The mailbox to send these things to is usually on a machine that has strong security and sand boxing capabilities (or can be created on the fly as a VM) If concerned, always delete, ...


4

Blocking the senders e-mail address is unlikely to be an effective measure as spammers/malicious actors will commonly change the address they use on a regular basis. That said it's worth noting in this case that a quick search for do_not_reply@apple.co.uk shows the only indexed instances of this address being spam related, so it doesn't appear to be one ...


3

The website http://www.419eater.com (mentioned also by one commenter) is a community of scambaiters that do exactly what you wrote: they bait and troll scammers in order to make them waste their time and forces (and sometimes, even their money). While this might be fun, and does a good service to the community by spreading the word and alerting against ...


3

I remember of an interview of someone having even written a book on subject (in French sadly). He explained how he entered the spammer game to appear as the worse complete unbearable moron as possible to them. The result how I saw them were the following: The spammer was just sending standard pre-written emails, one of them was even sent twice during the ...


-2

As far as I can see that would hurt them. but it's easier to attack their infrastructure, what they are doing is illegal in most places. Complain to the registrar of their domain, the company who hosts their server. their telephone provider, etc... those guys will have less patience and have the power to take action.


2

In the case of clear-signing, what is signed may not be exactly what you have typed. In order to be robust (RFC4880): lines starting with "-" are prefixed with "<SP>-" (to prevent misinterpretation) line endings, whatever they are, are replaced with <CR><LF> trailing whitespace is ignored In order to fulfill SMTP requirements ...


2

TL;DR: this is e-mail legacy. Neither GnuPG, nor Thunderbird, nor probably any other implementations of OpenPGP will bother about the line length. But the whole e-mail infrastructure does. E-Mail Legacy Historically, the limit to 78 characters (RFC 2822) came up because of the usual limitations of characters that fit on a screen per line. This is long ...


15

I can not make it simpler than this: Essentially, the trouble happens when Enigmail attaches an inline PGP signature to an email in Thunderbird's HTML message composer. The HTML composer is a different component than the plain-text composer, and it performs some "clean up" on the message body after the user hits send. That is an obvious recipe ...


5

Are there ways to passively fingerprint (infer) the operating system or mail client that an email sender is using, based upon the headers of an email from that sender? Yes, but they are extremely prone to errors and very easy to spoof, either intentionally or unintentionally (e.g. some high-end firewall systems will "repack" a message after ...


1

Got this email from Asian Domain Registration Service in China Dear Sir/Madam, About the "MyRealDomain". We are the department of Asian Domain Registration Service in China. Here I have something to confirm with you. We formally received an application on August 4th, 2015 that a company claimed "CarirLong Company" were applying to register ...


19

This email is most definitely spam (unless you know the sender and/or solicited this mail). Those odd strings are obfuscation techniques, which are a telltale sign of spam. See Tom Leek's answer for more information on that. There are three possible explanations for this email: It's an attempt to get you to respond; threads build psychological trust and ...


120

This is spam -- but possibly the spammer was not very good at spamming. The '=EA' bits are Quoted-Printable, an encoding for bytes into ASCII characters. '=EA=85=9F' thus stands for bytes of values 0xEA, 0x85 and 0x9F, in that order; this is the UTF-8 encoding for 'ꅟ' (that's U+A15F YI SYLLABLE NDEX, one of the symbols of Yi script). Whoever sent that email ...



Top 50 recent answers are included