New answers tagged

1

The OP lists email as a specific example, so I will provide an example with something other than email. More consumers use text messaging and voice calls to communicate; at least I do when outside of work. Therefore, an app to protect those communications would cover most of what I send. There are a few apps that are cross platform and have a good ...


0

I had the same question and discovered that mxtoolbox.com (now) provides an interface to query an SMTP server and report on whether it supports TLS. That's the only evidence we seem to be able to present that TLS is in place.


1

Use Tor Deep Web Email provider services OnionMail SIGAINT (No Javascript Needed) MailTor Mail2Tor You Need Tor Onion Links For All Of them just search on google and easily you find links


4

Well the bad news is you can't stop it, it is fairly easy to spoof the email address. And you can't effectively stop others from using your email. The good news for you is that most of the time your spam folder is going to filter this out due to the spam like nature as well as the other identifying factors. Emails have some information in the headers that ...


2

Solution 1 : There is a lot of annymous email sender through the web just do some googling here is a list providing you 20 Sites To Keep Your Identity Hidden http://www.hongkiat.com/blog/anonymous-email-providers/ if you want to receive back an answer you could use yopmail.com (no need to create an account) Solution 2 : You could setup a gmail/yahoo ...


1

Download Tor Browser Using Tor Browser, go to a site like Send Anonymous Email


2

It depends on the order of operations. If A signed the email and then encrypted it with B's public key, then when B decrypts the email, the signature is still valid, and thus B can sign the email signed by A and encrypt it with C's public key. When C receives the email, they can decrypt the email and check both signatures and all is well. If however A ...


1

Yes. Once B decrypts from A, B can encrypt the message with C's public key and C will be able to decrypt and read message. B decrypting the message from A is crucial however, if B does not and just encrypts the ciphertext from A with C's key, C will be be able to decrypt the outer layer, but will then be stuck with an encrypted message that only B can ...


1

AdHominem is right; using email verification prevents this attack vector. It's a usability challenge, though. I think that for many sites the right (but cumbersome) way to do it is as follows: Allow the user to complete the entire signup process and start using the site with a low-privilege, temporary account. You should probably prevent them from taking ...


7

The email harvesting scenario you describe is really slow and not likely to happen, at least as a way to gather lots of email addresses. The attacker would need to brute force really long strings against your form. As already stated by symcbean, emails are already very cheap if you buy them and it's pretty easy to block such attempts if someone tries to use ...


0

instead we could just use in the login form a username without leaking the registered email, and sending an alert to the users in case there is a failed login attempt to their account to warm them that there is someone who wants to connect... Giving such information/clous will just make brute force easiest for an attacker, for example if i give to a website ...


1

Plenty of things could have happened. To start with, emails which are not digitally signed cannot be trusted: they can be tampered with in transit (not very likely when the exchange is between two large providers) the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach ...


0

Could the attacker do more damage than I think? Not if you perform the following: Remove all account recovery information except cell phone. Keep your cell phone encrypted and use password or pin. Check and remove access granted to other apps and websites. Logout from all other sessions. Remove all trusted device from your account. Don't use password ...


4

If you're getting bounce messages back to you, that's known as backscatter. It's possible to filter out bogus bounce messages. See also http://www.dontbouncespam.org/#BS for other ways to filter backscatter. This does not stop the spammer from sending emails to victims, using your name in the From: line.


6

From the mail it looks like they are sending from a google account, circumenting the SPF record.Misread the respective headers. It's not the case My recommendation would be to roll out DMARC and DKIM. This allows you to ask the receiving servers to discard or quarantine mail if it wasn't sent and signed by your server. I don't know if DKIM is possible ...


16

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of course this only affects mail server which check the SPF records, which are not all.


0

Are you asking how one email service provider can collect and cosolidate mail from other services into one mail box? Well, pretty much the same way you yourself login in most services: no they don't store your password on their end or in cookies. They store session ID or other security token instead. Just like your browser gets such token on login and sends ...


2

I'm assuming that they either need to be on the same network as the sending or receiving end of the email. There are lot more possibilities: In the sending or receiving network. This vector could be mostly eliminated when sending/receiving the mail with TLS, at least if the certificates are correctly validated (which is mostly the case in this step of ...


3

I disagree with @quietsigns answer. There are other people that could potentially see your email. For one - email can be sniffed while in transit. Probably not super likely but still possible. Second - if the destination email is ever compromised (or is currently compromised) then it's likely that this email will just be sitting there. If you are really ...


5

Usually you cannot detect if a mail was tampered with. You can only detect this if the mail was signed and the person you suspect to tamper with the mail is not in possession of the key needed to sign the mail again. In theory it might be possible to store a fingerprint or similar for all delivered mails and thus check if this is the original mail, but I ...


0

I'm surprised nobody mentioned bitcoin. While hashcash may have been impractical for email systems, it has proved useful in cryptocurrencies algorithms for proof of work of miners. "Hashcash is a proof-of-work system used to limit email spam and denial-of-service attacks, and more recently has become known for its use in bitcoin (and other ...


3

There is a way to safely encrypt email, but you would know (without looking at the headers) since there must be a way for you to authenticate yourself as the receiver. If they put a signature cert on the email, that does not mean that it is encrypted, that only provides a way for you to confirm the identity of the sender. The encryption must be performed ...


0

Agree with everyone else in stating that the first email address is the only valid one. Would also like to point out that it's a bad practice to allow for additional spaces at the end of a logon name. If I understand this correctly you're attempting to make the point of potential similarities in user/customer logons to the system. So in answer to your ...


1

There is definitely a security issue that stems from a provider allowing the registration of almost identical email addresses. But it's not quite the one that your specific examples are testing. And its effects aren't even necessarily limited to users of the email service, but can more broadly impact anyone receiving mail from a user that service. The ...


-3

I develop Web applications for a living, and I can say this. While it may not be a "big" security risk, it certainly is sloppy development to allow someone to register with test@test.com; and/or 'test@test.com '. Simply because the developer did not take the usually minimal time to add input validation. I mean even using plain HTML5, if you used an ...


1

All but the first should be rejected simply because they are not valid email addresses. When you copy&paste them verbatim into your favorite email client they might do what you expect, but the most likely behavior is that it interprets them all the same. So if you want email addresses to uniquely identify users, you should insist on entering one ...


17

Only the first email address is actually a valid address. Of course, email address validation is hard, so trying to implement perfect validation does not make sense. At a maximum, you can approximate validation, and for usability reasons, you should be lenient with your filter. Because of this, you should not base your security on the validity of email ...


33

The one and foremost problem with this approach is that in your example, only the first one is actually a syntactically valid email address. The three others are not. This means that one of the two following options holds: The "email address" is merely a suggestion. The system wants a unique login identifier; email addresses are reasonably good identifier ...


0

Configure an email client to store emails in your flash drive. Connect it to secure computer when needed to read it. Connect it to the other computer when mails need syncing. I know there are other possible threats to this system arising from the usage of the flash drive. Minimise them as much as possible: Encrypt the complete flash drive with passphrases ...


4

What you are speaking about is an airgap, a device or network with no network connections outside of its own loop. If you had an email client within the airgap then you could view emails that have been transferred over to the airgapped system on removable media, but you could still be infected by any malware that is contained within them. A well known ...


2

If you're reading your mail in a browser, then the browser can read your mail. This means that Firefox or Google or Microsoft or Apple or Opera or whoever makes your browser can read your email. But it's worth pointing out that Google is no more likely than any other browser maker to want to read your mail. They don't have a reason to. Plus, open source ...


2

Should I then use Chrome or another browser to check my inbox? The problem is probably less the browser since this browser is used by lots of others and such behavior might be detected. More of a problem are likely browser extensions you have installed, malware injected into the browser or any software which does SSL interception. SSL interception is ...


1

In theory yes. This could be possible for any company with any Browser they have code access to. They only need to send the response to their own servers. However, I can not imagine this will be ever the case. It would be a huge scandal if that would be publicly and the user can easily recognize this by viewing the upload size. This would be the end for ...


3

I can't help with why this is happening. There could be too many reasons. However, I can tell you what it's doing: It has a large list of numbers (var b) which are actually stored character codes. The program splits them up into var z like this: ...


1

The problem that you are describing is known as spoofing, where you are able to send a message from personA@company.com, even though you are not personA@company.com. Because the SMTP protocol dates back to the early 1980's, when the internet was in its early stages and used only by a relatively small number of users, the engineers of the SMTP protocol did ...


2

Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory: There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing ...


-4

The Government, FBI specifically if I recall correctly, (therefore also the NSA and CIA) openly uses software that can do this, at least on certain systems. If I recall correctly, they can infect you without even hovering or opening, just sending the attachment. This has been known for years, if you want a source, you will have to do some googling yourself. ...


0

No because there exist a shortest path (of attack) and a dead end. The thumbnail image is computed by your client E-mail reader from the original attachment. Hence an eventual attack code will have to go through this image filter. There are 2 possibilities at this level: this filter contains flaws permitting an attack, this filter was correctly coded ( :) ...


2

By default there is no such functionality that could be exploited itself. What is possible and mostly done with attached PDF's but also possible with other file formats is to exploit vulnerablities in the viewer software. This is the only way to compromize a system through a non executeable file. But also in that case the success of the attack relies on the ...


0

A keylogger like Micro keylogger can easily steal your passwords. Just change your passwords and never login your private account in those public computers.


0

Yes. ProtonMail uses client side encryption.Your browser encrypts the message. You are limited to your browser's weakness but yes, it is as they claim. End to end with no knowledge of your message.


0

I have been in a similar situation. The only option that I found universally acceptable for end users of all skill levels was to send files in an encrypted .zip file as attachments. On Linux these files are easy to create with the -e flag for zip: $ touch foo.txt $ zip -e foo.zip foo.txt Enter password: Verify password: adding: foo.txt (stored 0%) $ ...


4

First of all, I would change my password. Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access again, and actually change your password (is this possible with Hotmail? I know GMail supports it). You definitely don't want to be locked out of your own ...


1

Change your passwords from a trusted machine to prevent further access. Check your local privacy laws if that amount of monitoring is even legal in your jurisdiction. File a complaint that the monitoring activity interferes with your work and that you have reason to suspect abuse. But do not accuse a specific person without any proof.


7

TL;DR: Change your passwords Enable two-factor authentication to prevent attackers from changing your password Warn your sysadmin You should change your passwords ASAP. From a machine that you trust. What good is it going to do that the attacker can still log in too? What if they find a way to change the password, too? Any suspicious activity should ...


1

It might not be an admin, networksec, or a teacher. What if someone hacked their login? It might be best to raise the issue with your school. Do they have anyone that manages the security of their systems? Perhaps ask for a meeting with them and your college principal to have the issue investigated.


2

They may use machine learning and data analysis techniques similar to those used for spam filtering to find seditious content. As with spam filters, if you chose your wording carefully, most likely it will get through (but you need to be aware of what wording they are filtering on so it might take some trial and error). If you want to employ methods of ...



Top 50 recent answers are included