New answers tagged

0

Theoretically, you could brute-force it. Decryption will take somewhere between "immediate" and "The end of the universe", so it depends on how lucky you are. Practically, no. It's not going to happen.


1

The presence of some security controls does not make a system secure. Yes I think you have identified a valid problem but that organization could still truthfully say the confidential data was never sent in an unencrypted fashion. Unfortunately there are many vendors touting things as being secure because they either have some security controls or because ...


4

If you are uncertain whether your account has been hacked, you should immediately reset the password. If your account was hacked, some damage may have already been done, but setting a new password will prevent any further damage. However, some sites allow you to create an account without first verifying your email address. This should not be alarming, and ...


0

If you are getting mails from websites which you haven't signed up for, there is a risk that your account has been hacked. Things you can do if you suspect that your account was hacked: Immediately change your password. Unsubscribe accounts by using third party services like mailstorm and unroll. Use people search sites like pipl and spokeo to search your ...


1

I think the goal of self-destructing email is not to erase the email, but to erase the information about who generates/sends the email. Under this idea: Self-destructing email works if content of the email can be easily generated. If the email contains only text (e.g. "I love you!"), then the receiver can easily write it down or copy it. But with a self-...


2

I could imagine the following scenario: Bob reads the email and think "Not for me, but this site would be perfect for my good friend Mallory". Bob forwards the email to him. Mallory now has the ability to sign up with Bobs email. Mallory uses the ability to impersonate Bob to e.g. stage social engineering attacks, or just to smear Bobs reputation. ...


3

The token should have at least 72 bits of entropy (9 bytes, or 12 Base64 characters) This should be generated with a Secure PSRNG (random number generator). So don't use the simple rand() operator of your programming language as it might be predictable, but look for the Secure random generator that PHP provides internally , or read bytes from /dev/urandom ...


1

Why not send him by Email? I might be missing something here but I believe that if you have a strong enough password and 2 factor authentication then using any of the big email providers that use HTTPS (Gmail, Outlook, Yahoo, etc..) should be perfectly fine and secure. Either way it's not like someone can do much with your bank information. The following ...


0

You cannot change the certificate but you can revoke it and issue a new one; or, keep the old one and let it expire on its own while issuing a new certificate for future email messages. The issue with revoking a certificate would be errors occurring if a mail client checks for revocation. To avoid this you can just leave the early certificate as valid and ...


5

This used to be common practice in the late 70s / early 80s. Back then UNIX systems truncated user passwords to 8 character before encrypting them. Newer operating systems use algorithms which pose no (reasonable) limit on password length, but some operating systems still support the old encryption method for backward compatibility. That means the email ...


0

This is fairly odd seeing as good security practice involves hashing and salting passwords. With a hashed password you can't tell if the password is partly correct (unless you have a script that looks for all possible hashes with your password + all the combinations of a X allowed characters - this would be terribly ineffecient) So this tells me that they ...


7

No, this is not accepted security practice. But it is probably not the only service either which silently cut off the entered password after a fixed number of characters. Check out their documentation if they document this behavior. If this is behavior if not documented please contact them so that they either fix this behavior or at least make this bad ...


0

Is providing an email address these days actually useful, or is it a security risk due to providing additional information that could be harmful? Yes it is useful because it allows access to be regained to a system should a password be forgotten. The weakness here is that passwords have been reused, not that the email address has been reused. If ...


1

Neil has good points. I would like to add some more thoughts. First: 2FA is a more generic term. Also your smartcard, fingerprint scanner and iris scan add a 2nd factor to 2FA. What you are talking of here is 2FA with OTP, one time passwords. And again with OTP there are many possibilities. OTP possibilities There is this cheap way of sending SMS or the ...


0

The exact procedure for resetting 2FA is site specific, but most let you do it just by authenticating to the site and/or proving that you have access to an appropriate email address; either the email associated with the account, or a rescue email address. While, as you point out, this is a fairly low-security hurdle, sites allow this because it is a cheap ...


0

One goal of modern spammers is to identify individuals who will likely be easy victims. Responding to such a random, unexpected message may indicate a certain naivety which can be lucrative when nefariously exploited. The random letters may be an attempt to throw off spam filters. In regards to the email being added to an existing conversation, did that ...


0

If Gmail combined them together, then they must be linked one way or another. This actually gives you the best explanation you can get that the spam is linked to that newsletter's mailing list.


2

You are correct in questioning the philosophy of the mailbox password, because it might actually undermine how ProtonMail manages their Public Key Infrastructure (PKI) and security model. Yes, in this case the mailbox password = the private key, which is the single most important aspect in a PKI. In other words, they have made (intentionally or not) the ...


4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups. The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized ...


0

If you're just looking for header info you can try the SMTP server test on wormly.com. It tries to use the target mail server as a relay for a message. It will probably fail if relaying is disabled, but there may be some information disclosure that may help. Additional sources and methods for gathering information regarding email servers are: Passive ...


1

The only single point of failure is your DNS provider is not redundant and it goes down, then your email is down. But most MTA's will keep resending the emails for 24 hours on failures. If the 2 different IP's you listed are assigned to the same machine - Then you will have a SPOF opportunity. But having multiple MX records point to the same IP is bad if ...


0

Spammers sometimes try out many addresses on the same host: a@example.com b@example.com c@example.com etcetera If you have a catch-all address all these e-mails will be delivered in your inbox. If the spammer sent a lot of mail this will break your e-mail system, or at least take a lot of time to handle.


2

Don't do it. Catch-all policy introduces the risk that a confidential email will end up being read by an unintended person (someone viewing the catch-all inbox) if the sender makes a typo error in the recipient address. It is far preferable for the email to bounce and a notification sent to be sent the sender, who can correct the address and send it again....


3

PROS Less likely to lose an email due to human error on the sending side. CONS If you're running anti-spam / antivirus that's scanning incoming emails for malware that scanning process can occur in the kernel to speed up the process. Any vulnerability in your antivirus / anti-spam (cough) Symantec could result in unnecessary exposure to exploit. ...


2

In general it isn't necessary to require the user to re-enter their email address if the link is received via that same email address. It is important though to use SSL, expire the link as soon as a password is created, and consider expiring the link if no password has been created after a certain amount of time. That being said, it is slightly more secure ...


1

You didn't really get the meaning of the EXISTS, I believe. What you describe (allow example.com to send mail from example.org) would be INCLUDE! INCLUDE:example.com means see the spf record for example.com and apply the rules. EXISTS is much simpler. It means "If the given DN resolves to any address, it will match (no matter the address it resolves to)." ...


1

SPF uses qualifiers (Pass, HardFail, SoftFail, Neutral) in order to determine the validity level of a request. The qualifiers are determined by checking any or even all the following configured mechanisms: ALL: Matches anything not already defined by another mechanism will match the all mechanism A: If the domain name has an address record (A or AAAA) ...


0

As this page says: https://support.google.com/googleplay/answer/6014972?hl=en identity is mainly used to get your "contact card" which is obviously useful if the application want to automatically fill signature or sender friendly name. By following the link guideline to check the authorization: Using the Settings app on your device (for apps you've ...


-1

It's a classic for a reason: Your post advocates a (X) technical ( ) legislative ( ) market-based ( ) vigilante approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was ...


0

Besides the standard ways (checking headers, broken clients, spam filters, etc) of detecting spammers, and depending on how strict your settings are, you can try to limit your emails only to fully qualified domains and ignore any "Unknown" sources (that is what I do). I personally believe that all emails should be sent from mail servers and not directly ...


2

Being a mail system administrator, I suppose you know that email messages do not contain anything that would allow you to identify whether they are sent by a human or a machine. The BOT will certainly not indicates that it's a BOT in the message or even the headers. Common SPAM detection methods apply to any messages whether sent by a BOT or not. I ...


2

You're right that relying on a third party for your system's authentication can have certain drawbacks. It's hard to grasp how you could consider letting a stranger (non authenticated user) link an existing account to another provider. That would certainly represent a huge flaw in your design. Normally, when using third party authentication, you allow a ...


1

Even all your MX records point to a single IP address these records by themselvs are not the single point of failure, because the MX records themselves will not fail. The single point of failure is instead if you have only a single server managing the mail. And in this case it does not matter if this single server has a single or multiple IP addresses. It ...


2

No. Taken from Wikipedia (Single point of failure - Wikipeda): A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. SPOFs are undesirable in any system with a goal of high availability or reliability, be it a business practice, software application, or other industrial system. Since in your ...


3

Well then, to try and fully answer your questions: Is it possible someone hacked to her phone and delete all her work contacts? I will say this with a resounding no. It's theoretically possible for them to hack into the device, but while not only highly unlikely it is also impractical for anybody to remove just her work contacts. The company has no ...


0

It's likely her former employer deactivated her work account. If her contacts were saved/associated with the work email, then they would have been lost in the process.


1

There are a number of alternative standard addresses that might work. For example, postmaster@example.com, admin@example.com, webmaster@example.com (full list: https://www.ietf.org/rfc/rfc2142.txt). If that fails, you might want to look for a contract form in the website hosted on the domain, if there's any. If you can't reach any of these, you may want to ...


3

What is the most and least secure way of going about encrypting emails? There is no difference in security: both use the same cryptographic principles, they just use another method of embedding OpenPGP into e-mails. I am looking for security and have no idea which to use, though I do know HTML will not work with PGP Inline but will with PGP/MIME. PGP/...


5

The first line 'iayQS28R... is a key to be XORed with the bytes given in the code variable. When interpreted by Javascript, it does nothing because it's just a string constant. But the script opens its own source file (something you can't do in pure Javascript, but you can with the extra packages that are available when Windows runs a Javascript script as a ...


1

To make anything PCI-DSS compliant you'll have to go further than just defining some tech specs and leave it at that. PCI-DSS wants you to OPERATE a secure environment, not just design it. So let's break it down. You want to regularly send e-mails containing one or more PANs to one or more authenticated parties. You've thought up a method of sending ...


2

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent. A check of the SPF records for email-2.microsoft.com shows: v=spf1 include:customers....


1

The question you have to ask yourself is, why would ClickDimensions be sending an email and would attempt to make it look like it came from Microsoft? This is what GMail is alerting you to; the source address doesn't 100% match up. Also, the notice is absolutely worth paying attention to, emphasis mine: It has a from address in email-2.microsoft.com ...


3

This is probably correct in a statistical sense. A legitimate e-mail will probably (but not certainly) go through several hops not only on the destination side (which are mostly always the same for a given recipient, so that number is not interesting) but also on the sending side, and these will be recorded in Received headers. A spam, however, while sent ...


4

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which actually happened earlier. Although we knew about the LinkedIn breach a few years ago, we thought it was only a case of "some passwords were stolen". 6 million ...



Top 50 recent answers are included