Tag Info

New answers tagged

1

Self destructing emails, like email read receipts and mail services which tell you they can tell you which recipients have read your message and which have not are at best misleading and at worse a con perpetrated on ignorant managers, executives and uses who don't understand how email works. In general, all of these schemes rely on the recipient buying ...


4

The user, intentionally or accidentally, likely left a mocked email address of which GroupOn did not validate. As a result, you were able to identify as the account holder because you were able to access the account's email. This is the users' problem for using mocked emails for their account and is a living example of why email verification is important.


1

Even if it may sound counter-intuitive, self-destructing email actually works. The trick is that the email itself will actually not convey any useful data, but only something referencing the actual data to be shown which is safely stored in the service provider server. For instance the most trivial transparent implementation would be to transform the email ...


8

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command). This because of the nature of the message, which once reaches the recipient' machine can be copied at will. This applies to email as well as instant messages. Therefore any service promising you messages that ...


0

"Self-destructing" email does not and cannot work: the act of sending email involves copying the message repeatedly. I don't know the details of how this particular attempt works, but the basic techniques for defeating it are to either make a copy before performing any action that might trigger the "self-destruct mechanism", or make a copy while reading it ...


0

First try to change your passwords, second check if there are a shells in your files docs,third contact the administraation of the web hosting for this problem because hacker can use the network ports to send spam messages via websites hosting on the server.


0

protonmail looks promising https://protonmail.ch/ but (a word of caution) done by smart people who are not cryptographers by trade or training.


1

You can indeed use an end to end cryptographic encryption tool with Gmail. But be warned that it is still in test stage so there is a chance it is still buggy. Or you could always wait for the next version (which I think will be 4 to 6 months ahead) by which point it will be released as a stable extension (hopefully!) Another caveat is that it is a Chrome ...


1

Yes. The way end-to-end email encryption works is this: You use a mail client like Outlook or Thunderbird or Mail or Claws to write a message. You encrypt the message using a local tool such as GPG, then send it. The encryption key and the email address are unrelated. Your mail server sends the encrypted message to my mail server. Hopefully it uses SSL ...


0

While You can setup encrypted emailing this is not on by default. It is not trivial to do so and requires action from both sender and receiver Email is essentially a clear text protocol and since you do not host it yourself you have no clue about how it's transmitted between sender / receiver. It's better to assume that whatever you write as an email can ...


0

Gmail does not include native encryption features that can be used via webmail. Broadly speaking, webmail services that provide encryption are doomed to failure, and this for a very simple reason: the only encryption that you can trust is end-to-end i.e. from your machine to your correspondent's machine. You can achieve this by installing a plugin for ...


3

Unless you're doing end-to-end encryption (where the servers only see encrypted messages, other than the recipient's name), there's no real security, so having something like this in the mail submission or transport protocols isn't going to be useful. The receiving server could certainly encrypt incoming (unencrypted) messages with the recipient's public ...


0

As far as I know, there are two ways to secure email communication: PGP and S/MIME. http://www.techrepublic.com/blog/it-security/email-encryption-using-pgp-and-s-mime/ In your example, develop a customized email gateway using PGP is feasible.


2

Regular email provides no support for encryption from the mail servers. This includes Gmail.com, securemail.com, and intermediary servers in your example. But PGP extends mail to secure the email body though not the headers. As with much of PKI, managing keys can be difficult. PGP leaves key management to sneakernet. There are more private solutions but ...


3

SSL certificates provide two things: Authentication of the organization to whom the visitor is connecting (the organization is verified to be www.foobar.com) Confidentiality of the communication (data is encrypted using the public keys in the certificate) Concerning point 2, there's no difference in using a self-signed cert, a certificate issued from a ...


-2

No, it is even less safe. If you have no knowledge of security or of certificates you should not roll your own. (luckily its not as bad as running your own CA without knowledge) CACert helps you to get the proper values in your certificates so your safe from misuse. the web of trust also means the CAcert will be on par with a face 2 face audit form a ...


0

Is this in any way a threat? No. Your server correctly rejects the mails before they reach your server (the spammer only greeted), so only minimal resources are used and you can just ignore it. How can I stop this person? By blocking such attempts if they do it too often, e.g. using fail2ban, which you can install via package management. It is used ...


2

Regarding security, usually such connection attempts are just made by automated spam bots operating from malware contaminated PC. In all case it seems that these requests are correctly rejected by your server. I recommend you to check SPAM protection measures to protect your mail server, and in particular I recommend you to setup a check toward SpamHaus ...


0

These records show that this sender is trying to relay mail through your mail server. But fortunately, your mail server is not setup to allow open relaying, so that's preventing these attempts from succeeding. If this mail server is only being used to send outgoing mail, and is not being used to receive incoming mail, then you may want to setup your ...


0

It's probably a machine trying to use your mailserver to send spam. To answer your questions: The risk for you here is that, if he succeeds, your mailserver is going to be blacklisted as an Open Relay. You must configure your mailserver to accept connections on port 25 only from the hosts you want to be able to send mail. As an additional protection, ...


3

What if they entered their email as "></a><script>alert("XSS")</script><a href=" which (might) be rendered by the application as <a href="mailto:"></a><script>alert("XSS")</script><a href="">"></a><script>alert("XSS")</script><a href="</a>. giving rise to a Stored XSS ...


1

Message size limits are an important mechanism to control mailbox sizes, guarantee service availability, and also protect from potential DoS attacks.


2

I can think of the following reasons for the limitation : Traffic, A mail server is busy a lot of the time (eating bandwidth). and most of that mail is SPAM... a size limit also limits the SPAM sizes to that limit. Disk Size, every mail server in the chain has to e able to store the messages, the bigger the mail size the larger the 'cache' has to be on all ...


5

MTAs often virus scan, DLP scan, or perform other scans that take CPU time. Sometimes a MTA is on a bandwidth constrained network link. Base64 encoding bloats a message from its binary size by 33%, which increases pressure on disk and on the network. Exceeding these limits will cause a denial of service attack against the MTAs, or even against the host ...


1

Am I just running around and is there a better way to do this or is this not going to accomplish a private email account anyway? It's not going to accomplish privacy from the prying eyes of major governments for a very simple reason: the e-mails sent to your company can be read from the sender's outbox (perhaps even while they are being composed!). ...


1

"is email a trusted way to carry such sensible data" No. Do many websites do it? Yes. A saving grace is to make the link one-time-use-only and require the user to choose a new password immediately. That way, if an attacker does intercept the email and use it to hijack the account, when the legitimate user clicks on the link later, they will get an error ...


1

To be safe from having mails that possibly harm your system through an attack you first need to know what attacks you want to be protected against. Mail body Attacks (like malicious HTML inside the mail) Protection options are Open Mail in plain text mode, in this mode None of the text is treated as having special meaning and is just show on the screen, ...


4

Yes, basically you're right: if you (or your mail client) do not specify yourself as somebody that should be able to decrypt the message, only the recipient will be able to read the message. Multiple encryption keys are possible But: who can read your data depends on whom it is encrypted for. For example, most mail clients will encrypt for everybody in the ...


0

A certificate's authenticity is verified using the trusted party's public key. A certificate spoofer can enter any data they want in any cert they make but can not sign the cert with the trusted party's private (signing) key as they do not have it. When the trusted party's pub or if you like verification key is used on the wrong private (signing) key the ...


13

It's perfectly true. Encrypting an e-mail with someone public key, you get as output a ciphered text that you cannot decrypt yourself, this is the point of asymetric cryptography after all. There are many methods to keep the original text. keep it as clear-text encrypt it with your own public key (to keep confidentiality)


4

You should play with GPG, your question will answer itself real quick. I recommend a GPG tool called Mailvelope which works with most web-based emails (gmail, hotmail, yahoo, etc). You can encrypt a message for multiple recipients, and as @Xaqq said, most clients will include the sender in the recipients list for exactly the reason you state. But if you ...


-1

This is explained by the first, second, and third immutable laws of security: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore. If a bad guy can alter the operating system on your computer, it's not your computer anymore. If a bad guy has unrestricted physical access to your computer, it's not your ...



Top 50 recent answers are included