Tag Info

New answers tagged

1

With KVM and Xen, the rogue administrator can take a snapshot of your live machine, then explore at his leisure what is in the RAM of your VM. In particular, he will easily obtain the encryption keys for the encrypted filesystem, and then proceed to read all your files. By the very nature of the snapshot system, you will not notice it. With OpenVZ, you ...


0

OP asks two questions that are related regarding: Encrypting content. Ensuring the content can only be viewed by intended recipient(s) - possibly in the cloud. Given the use-case, while PKI is a good general solution for both issues (encryption for the intended recipient) and is supported out-of-the-box in most email clients (after private-keys are ...


2

There are no specific risks associated with plain text attachments as defined by the RFC. Ref: http://tools.ietf.org/html/rfc2046 Operating systems like Windows associate the "txt" extension of the file-name to the text/plain MIME type and have executable association on-click/open with some defined program (like notepad/wordpad, etc). By default on most ...


0

Use a clean PC or VM for your VPN connection and never ever use that system outside of the VPN. A VM will only work if your host is clean. If you install free games or random software then you SHOULD NOT trust your PC anymore. Never login to accounts that you use outside of the VPN !!! Create separate accounts for any service you use over the VPN. Never ...


1

Regardless of what virtualization technology you use. Once the attacker has access to the hardware, it's game over. In case of a VPS, even when encrypting the root partition, if the key is stored in memory and you have no control of the hypervisor, then you cannot protect your system's confidentiality with encryption. Administrators with access to the ...


1

It's also possible that all attachment's are being blocked - regardless of extension. Or, there may be an organizational policy that permits only certain file types - maybe only .pdf has been approved, and so .txt is explicitly blocked. While not necessarily a security issue, there is the possibility that someone could send a lot of very large .txt files ...


2

In addition to makerofthings7's very thorough answer, another reason could be to prevent phishing attacks which tunnel dangerous content in the TXT attachment. For example, if you send a file called ILOVEYOU.EXE.TXT, sign it as "grandma", and instruct the user to save and rename the file - some percentage of users will happily follow those instructions to ...


0

As Tony mentioned, using DKIM on all emails for a domain becomes important when you want to implement DMARC. In the time that he answered your question DMARC has become much more relevant, with both Yahoo and AOL setting Reject policies for their domains. The major ISPs (Google, Yahoo, Comcast, etc) all support DMARC now as well. The problem with DMARC is ...


0

"Secure enough to use" -- secure enough to use for what? Are you a bank? Healthcare website? The "secure enough" question needs context and and understanding of your appetite for risk. If you sell $2 widgets and you're a daredevil then 10 charters is fine. If you're running something more sensitive and a 10-character token is going to keep you up at ...


0

First let me say, there is some truth in both answers from Tim X and David Wachtvogel. I'd still like to correct some of the statements of both of them. First, the impact Usually on a POP3 server, the messages are deleted after you download them. If a hacker would get your password he cannot get past messages. This is sometimes configurable, but by default ...


0

When you log into Hotmail through a web browser, it retrieves any email associated with that mail-box. Even if you've specifically set up email forwarding, aliasing or mail-box integration, then it is only ever connecting and authenticating to one server and one mail-box. When you specifically link your mail-box with another mail-box (or address in the case ...


0

First tell her that unencrypted email is sent via various servers that all can read all information. Then tell her that this happens all the time, and still it seems like all this information is seldom stolen. Then teach her about password protected zips and Word documents. Or even better... PGP?!


4

Most of the people who are in power to eavesdrop on the email, like the internet service providers and email providers of her and her recipient and the three letter agencies, are likely not very interested in that information. Providers are in a position to collect lots of sensitive information, but they can not risk to abuse it, because it would be quite a ...


0

... it's insecure; any combination of mailservers & infrastructure between the email leaving her and getting to her folks could've read it, or stored it to read later. This is just the kind of thing it turns out the NSA is collecting! Realistically, this happens all the time, it's not very likely she'll suffer identity theft. If you're in america I ...


15

To add some information to the excellent explanation of Tom, you should be careful with a BCC if you really want to make sure that the BCC is actually a BCC since you can detect from the list of encrypted session keys that the message has been encrypted with some other PGP key. To be precise, the key ID of the PGP key but since most keys are stored on a PGP ...


51

In the OpenPGP format (that PGP implements), a given email can be encrypted for several recipient with only minute per-recipient size overhead. This is because email encryption actually uses hybrid encryption: A new random symmetric key K is generated for the email to encrypt. The bulk of the email is encrypted with a symmetric encryption algorithm, using ...


7

I've been supporting and administering email for 18 years, and never had a valid reason to block text attachments. Here are some issues that I can think of, that aren't exclusive to TXT attachments alone, but rather regard attachments in general Unicode parsing The only two issues I've come across is this unicode bug but it's theoretically possible that ...


2

If you are afraid of "snooping" then why would you use signatures ? A "snooper" is a passive eavesdropper, who wants to see the data but certainly not to make you aware that your emails are inspected. They won't alter emails, or send fake emails, which are the kind of things that signatures can help against. If you want to defeat such sniffing, then you ...


1

It very much depends on what you mean with "legal risks". For example in Europe there is something called a "qualified signature". If something, a document, email etc, is signed with a qualified signature, it has full legal binding. You cannot deny having signed it (at least the proof is on the signers side that he/she did not voluntarily signed the ...


6

Signing emails is useful only insofar as recipients verify the signature. Theoretically, signing the emails might improve deliverability, but only if a recipient configures his filters for incoming emails to verify email signatures and accept emails which have been verified to come from you. However, this is only theoretical; in practice, email filtering is ...


1

It looks like the chain is not correct. It looks like there are three certificates but all of them are the same. It looks like you are missing at least the Comodo Intermediate certificate: CN=COMODO RSA Certification Authority.


2

You client is looking for the server to provide copies of the intermediate certificates and it appears your server is not doing so. The exact configuration will vary based on your server, but it should be possible to download the intermediate certificates (from your CA) and share them along with your server certificate in order to get to a certificate that ...


0

The easiest way would be to foward the mail to an online scanning service. You can submit files to virustotal by forwarding the email to scan@virustotal.com You will have to change the subject field to "SCAN". When it is done, you should receive a mail with the results. Email submissions is not prioritized, so it might take some time for the results to come ...


7

First, some background information about how email works. The basic issue is that server-to-server contacts using SMTP are unauthenticated: all a server knows about the computer contacting it is The IP address Who the computer wants to send the email to Who the computer claims they are Who the computer claims the email is from Note that the last two ...


0

You can't do this as private key crypto exists as the key pair generated uses the input (which varies). You'd need an algorithm (logrithmic?) That produces the same output each time, something that disregarded the input. You lose the very thing you're trying to accomplish, "signing" or the ability to provide non - repudiation. Why on earth would this ...


0

You can't do this as private key crypto exists as the key pair generated uses the input (which varies). You'd need an algorithm (logrithmic?) That produces the same output each time, something that disregarded the input. You lose the very thing you're trying to accomplish, "signing" or the ability to provide non - repudiation. Why on earth would this ...


0

How to generate a CSR using an existing keypair depends largely on the software you are using. There is however technically speaking no reason it should not work. May I ask why you want to reuse the same keypair for all certificates? With openssl you can specify which private key to use so if you generate a private key one and use the same private key for ...


0

Phishing is usually carried out by spoofing. You get a link asking you to login with the credentials to some site whose appearance is identical to some trusted sites you know. Your parents probably clicked on the link, and logged in too with gmail credentials. This way the attacker obtained the login credentials. However, I believe that the security of the ...


1

If you want to be as sure as you can be, reinstalling the operation system from read only media is a good idea.


0

Many organizations have a central email server that's the only one to be exposed to the outside and which forwards emails to some satellite node (one per geographical site or per organizational department) which isn't visible to the outside network. Furthermore email can be forwarded from server to server. Since forwarding can be based on the content of the ...


1

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


0

Intermediate email servers aren't generally required, but they allow for scale out, and allow for specialized email services to handle particular requirements such as: AV/AS scanning Content Filtering for information controls 3rd party auditing via BCCing (for SEC registered reps, schools, etc) Specialized routing (P1/P2 routing, sender routing) ...


0

Use multiple factors authentication, there are many options. Yubikey is the simplest - http://www.yubico.com/products/yubikey-hardware/yubikey/ And there're a lot of similar devices, just look for "authentication token" There's even a more strict approach which is if you want to secure your password - don't use it at all. like this ...


1

The HTTPS traffic is encrypted, you can trick a computer into not using HTTPS but for this you'll need to setup a man in the middle attack. Then use something like sslstrip to trick the client into not using HTTPS. Kali linux has all these tools build in, so that would be a good OS to start with.


0

You can use Fiddler if you want to sniff traffic on your own machine. http://www.telerik.com/fiddler If you, however, want to sniff SSL traffic on your network without access to the machines communicating, it will not be possible to make any sense of the traffic, since it is encrypted (https is HTTP over SSL).


1

As things stand, there's not yet anything that makes me think of an attack. It could conceivably be a really, really convoluted and unlikely confidence scam: step 1: I make a payment to you (but I'd do that with a larger sum) step 2: I withdraw the payment Most confidence scams are based on the victim's dishonesty; their willingness to do something ...


0

Legitimate emails from Paypal appear to come from the user email sending the payment. As to why this is, I do not know. I would attempt to see if you can gain access to the associated Paypal account that this payment has gone to, if it is indeed under your name and email address. Here is a Paypal community post that clarifies the issue from the sender's ...



Top 50 recent answers are included