New answers tagged email
2
Lately, it has been very common for e-mails to be spoofed as if they are from someone on your contact list or on your Facebook friends. These often don't require actually compromising the account and are instead simply faked and sent. The best way to determine if this is the case is to look at the header of one of the e-mails and see if it actually ...
0
You may want to look into a best-of-breed type of email encryption provider. I've worked with companies like DataMotion in the past and they secure all outbound communications and typically they're able to track all of the messages too, which helps in case you need to prove that you're encrypting the messages. I don't know specifically what type of ...
14
Your case is common in the corporate world, it is usually described as corporate MiTM. When you connect to the Internet from inside your network, you're likely connecting to a gateway/router the belongs to your company first. That router can simply hand you public key in a "fake" certificate whenever you connect to an SSL-enabled site and fool your browser ...
5
Unless it is encrypted before going to the server, there isn't much point in encrypting it on the server. If the server is going to do bad things, it can just not encrypt it. Additionally, decryption on the other end would have to be done on the server, so the recipient server could also leak it.
The connection in between servers can be secure if TLS ...
1
Anything you do outside a secure network is subject to traffic analysis. With the advent of big, extremely big number-crunching facilities there is little hope of hiding in the complexity of routine Internet traffic.
Oppressive regimes maintain a lot of Tor exit nodes and attempt to jam or intercept dark networks.
Corporations run e-mail/contact services ...
3
It sounds like you're talking about receiving clear text emails and then encrypting them. If this is the case, the architecture is already insecure.
What you could do is set up a mail relay server which handles encrypted mail transfers on behalf of end users. Those users would handle their key management and distribution and contacts' public keys. All your ...
2
Cost is relative, good certificates aren't cheap, and perhaps 'good enough' certificates aren't very pricey...but as to the password question, IMO, you should NEVER email someone their password - you shouldn't be able to Any online service that was able to email me my forgotten password I cancel my account and move on; had to do it several times. Shows a ...
7
Spilling the session token over an insecure channel, such as HTTP, is a violation of OWASP a9 and can be used to compromise an authenticated session (Firesheep). The password, and every request that contains a session token must be transmitted over HTTPS.
If your web application uses authentication, HTTPS is mandatory.
10
As a rule, if you run a website that requires authentication, you should run SSL. And I'd debate your statement that SSL certificates are costly...I've just purchased one for a personal website of mine for less than 15 euros for two years. It's cheaper than the domain name is, in fact.
You shouldn't send passwords via email either. It's slightly more ...
0
So, we could talk about VPNs, PGP, tor, etc....but please consider this:
The bottom line here is all those tools may 'flag' you and next thing you know, all of your data is recorded. So what? The data is encrypted! Well, the traffic can still be captured and decrypted later. One day clusters of computers will be powerful enough to decrypt it all. But, ...
0
A VPN does nothing you described. It still is a known end point and since most VPNs don't delay information, it is still easy to see the information going in and out of them and link it to a user if you have visibility to enough routers along the way.
TOR with packet delaying is your best bet at true anonymity on the Internet, though even it is limited if ...
0
Without using PGP or some similar client based system, the best bet is a trusted mail server on both ends that enforce TLS to be used for e-mail exchange. It may or may not be possible for TLS to be broken by a highly sophisticated attacker like the NSA using quantum computers at this time, but it would still be highly expensive and thus unlikely they would ...
2
PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key.
There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, ...
4
SPF records stop one particular type of spam, but only one type.
As the owner of example.com I know what the IP addresses of my mail servers are. I can publish a DNS record that lasts these IP addresses and a policy for other mail servers to follow when receiving mail that claims to be from my domain example.com.
That's the type it stops. It stops ...
3
To avoid this kind of leak, you could also begin the registration process by asking for the e-mail. After entering it, you would send an e-mail with a link so that the user could continue with the registration process. If the e-mail was already registered, you would send an e-mail saying that.
That way, only the owner of the e-mail could register.
...
1
I have seen more sites change the response to accounts having been created (notification), to something like: "If the account exists, an e-mail will be sent" versus: "there is no such account" (which allows someone registering to know whether or not an account already exists) If you are looking to stop "account enumeration," give OWASP a look: "Testing for ...
2
Using a username rather than an e-mail address is one method or use a combination of both for security sensitive stuff like password resets. This renders discovering a particular e-mail address exists less useful if both a username and e-mail are needed.
It isn't such a big deal to leak the fact a particular e-mail address exists in most cases unless ...
0
Look at the original address those emails were sent from. If it's something like test@mailserverdomain.tld, there's a 99.999% chance it was your mail server is vulnerable. If it was an email address directly related to an employee, it could have come from their computer, but even that's unlikely with 9,000 emails unless someone remoted in and scripted the ...
0
if you get a reseller account, you can always manage your whois information. I did check Domain Whois as olynomial did. But again, if you have a reseller account, you can make your whois information anyone anywhere you like weather it is legitimate or not.
3
Well macro's would allow you to automatically start running scripts on the machine once the document was opened. Hence they get opened in a protected mode to prevent code execution from happening automatically (the user needs to aprove it explicitly).
Also from the MS website:
Files from the Internet and from other potentially unsafe locations
can ...
0
He could have tried to spoof a login to another service that uses OpenID/Facebook Connect/Oauth. This assumes the service uses just the email address to identify the user.
Top 50 recent answers are included
