Tag Info

New answers tagged

2

I suppose the SSL is used to encrypt the password No, SSL is not about encrypting passwords, that is the common misunderstanding. SSL is rather establishing an encrypted link between a server and a client such as a web server (website) and a browser, or a mail server and a mail client. I once read that all data on the internet is encrypted in ...


0

How commonly is SSL/TLS used by e-mail providers? Google provides some great up-to-date stats on domains that are using TLS to encrypt email between hops. http://www.google.com/transparencyreport/saferemail/


3

1) Using POP3 unencrypted opens you up to all sorts of exploits. Typically, you aren't going to be so concerned about someone intercepting your mail, or more importantly your login credentials, via the open internet. The folks who do this would have to have access to internet exchanges, ISP routers, . It can happen, but it's not that common. What does ...


35

That's not an "exploit", rather the way e-mail works. Datetime, sender, receiver, and all other headers of an e-mail message can be set by the sender to whatever value he wishes; mail protocols make no security check on them. Hence, spoofing the sender of an e-mail (as spammers, scammers, and phishers often do) it's a child's play. As Priyank correctly ...


2

Most messaging systems do allow drag-in/out copying of emails from the client to the desktop. So if you want to send spams with any dates you want, there are various options. Actually you can quickly code a mass mailer in Python and change automatically whatever parameter you want in the headers, including time (how to change email's header ...


8

It is kind of possible.Suppose you change your system date/time and use a local client like Outlook to send an email, then the receiver will see the changed time. But in the email headers, the actual time of the email when it was received by the server, will be mentioned.But if you are using some email service on your browser, then the actual time will be ...


0

This is a good recipe but working only if you add another technical measure. If you register foo+company@gmail.com as your E-mail, you have to protect yourself against stupid and advanced robots (the ones who don't know the use of +, and the ones who know how to try to lower this protection through strings rewriting). You have to make foo@gmail.com a ...


2

From how I understand what you are asking, the short answer is: Sorry, you can`t do that. If you are at any point handling any data from a client (i.e. an email), then there is simply no way you can prove conclusively to that client that you are not at any point keeping a copy of that data. If you did want to keep the customers data, there would simply be ...


1

Yes they can by replicating a certificate and your browser will not warning you about it: Answer from another question: Yes it is possible. With another valid TLS leaf certificate the CA flag can be bypassed and that certificate used to sign a certificate for any site: ...


1

With the few details you have provided, the very general answer is to publish an architecture document that describes at what point you do and do not have access to their information. In this document, you would outline the data flow and the boundaries of your control and where each client's data intermixes (or not). This document is important. Your ...


3

If you ask some company to create some domain for you and several e-mail account with that domain and forward that information to your gmail account...I do not really understand, ANY web developer can check all mails from any client, or Am I missing someting? In a way your question is funny: you fear that the domain provider might intercept and read ...


6

It is more secure than a password in some ways, but as you describe, it also makes accounts more vulnerable to other attack vectors. As a best practice, properly implemented two-factor authentication offers much superior security to a single factor, regardless if that single factor is a memorized password or an "on demand" password. Reduced Vulnerability ...


3

You already seem to have realized that there is no way to attach user IDs to subkeys. You cannot impose ultimate trust on others The problem with your concept is that while you can issue ultimate trust on your own devices, you cannot impose this for other users. If they're able to validate your "master" primary key through the web of trust, the other keys ...


4

non-technical answer: If your connection is (good) encrypted between your Phone and your Mailserver - it should not be a problem. But if not - or accessing via web interface without HTTPS -some bad people or companies will be able to read the data. If you do not trust the encryption and also not the network - don't do it. You also have to trust your ...


5

I ran into the same issue when using a Ruby gmail gem. According to this post, "less secure apps" directly handle your credentials, rather than using something like OAuth that verifies your identity without exposing your credentials to the app. Given that your app is running locally on your machine (and you hopefully trust it!) this shouldn't be a problem.


3

In the United States, generally anyone can subpoena anyone or anything as part of the "discovery" process. It is up to the presiding Judge to decide whether or not this is relevant or allowable. In a civil action, as opposed to a criminal one; some typical protections (e.g. 5th amendment protection against self-incrimination) do not apply. Thus, it is far ...


1

If they are using IPv6 without privacy extension or if their ISP embed the MAC address in the reverse DNS name, then you can deduce their MAC address from their IP address. The IP address is usually found inside the mail headers. But be aware that if they are using webmail, then the email originates from a webserver rather than from the sender's own ...


2

No, you can't. THe MAC address acts as address parameter only in subnet (till Data Link Layer). But there is a way to find the Network Address using this. As the sender email account is longer there, as you told, then you can't even do the above thing either. Moreover spammers use services like this and generally they use known reputed company mails. But ...


2

Short answer: no Long(er) answer: Up until some time ago you could see(in both yahoo and gmail) the network address of the sender by looking at the full headers of the e-mail message. Currently, this option is no longer available in gmail. An attacker can use a service like this to send an e-mail with custom headers(meaning that the source address can be ...


0

Yes, I'm fascinated by this as a possible passwordless authentication mechanism. And as you & others have already mentioned, it does offer the same security as most forgot-your-password systems ...although the better ones do require you to answer some kind of security question also, making it more like two-factor. Anyway Passwordless.org is good read ...


9

You can find a possible explanation on the Google Support pages regarding the "Recent Activity" option: "If you're using Mail Fetcher with another Gmail account, a Google IP will appear; this is simply because the messages are being fetched through our servers." Edit: To answer your comment: I would not call Gmail insecure. For the average user, they are ...


2

There already is a system which could do what you propose: Just use standard SMTP via TOR. Each communication partner would run their own mailserver as a hidden service on TOR. You can then write emails to conveniently named email addresses like bob@3g2upl4pq6kufc4m.onion. But that won't ever become meainstream. Why? The reason is that a communication ...


0

My question: if such system can be created why there isn't one. Resource limitations is why. I'd quit my job and start writing the necessary tools to piggyback encrypted mail on the BitCoin (or other) blockchain tomorrow, if I could ensure I still have somewhere to live, something to eat, and everything else my day-job pays for. The ironic phrase ...


3

Using a strong password and 2FA should be sufficient to prevent those who knew your password from succeeding again. Yes, it is very possible that an attacker would have access to servers around the world to try and log into your account, so that's not surprising at all. It is also possible that your account credentials were sold, posted on a public forum. ...


3

It is not unexpected for enterprise networks to run web security proxies that inspect encrypted traffic when given a reason to suspect something problematic. This allows them to detect encrypted malware and prevent it from infecting you. (It also allows them to restrict other content, such as porn or some other policy enforcement that is not related to ...


2

Email is certainly the most common method of pushing malware to a network, but it is not the only one. Also, while malicious files can be delivered as attachments to emails, they can also be presented as links that end users click on, resulting in a drive-by download or perhaps a more traditional virus that the user then has to download and execute ...


37

First things first, change your password and make sure the new password is secure (10+ characters, a number somewhere other than the last character, a capital somewhere other than the first character, not an iteration on your past password, etc). This is good to do periodically anyway. GMail has tools for seeking suspicious account activity. Specifically, ...


1

First, check the Account Activity Details link at the bottom of the webpage. Second, re-secure your account (change password, add 2-factor authentication,...) This question deals with a similar situation of needing to re-secure a gmail account and check for unwanted access: Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?


2

Email is sent over SMTP. Normally speaking your email client sends the message to a configured SMTP server. That server then uses DNS to resolve the MX (mail exchanger) record for the destination domain (the part after the @ sign). It then sends the message on to that server. If your SMTP server or the DNS it uses were compromised it could send to a ...


0

By 'Email Injection' , I am assuming that you mean malicious links embedded inside newsletters or spam emails. Well, you are right in assuming that the hackers have an ulterior motive besides annoying you. These motives could vary from simply stealing your personal information to accessing your bank accounts. Typically, hackers are well aware that users ...


3

Email injection works exploiting the way a email server processes the requests. A typical email transaction works like this (S is the server, C is the client): S: 220 BBN-UNIX.ARPA Simple Mail Transfer Service Ready C: HELO USC-ISIF.ARPA S: 250 BBN-UNIX.ARPA C: MAIL FROM:<Smith@USC-ISIF.ARPA> S: 250 OK C: RCPT TO:<Jones@BBN-UNIX.ARPA> ...


1

Email injection is a vulnerability of an application which allows a spammer to piggy-back on that application and send emails through it. There are several advantages of using this technique: the application sends them = the spammer is anonymous your antispam system may lower its "spam threshold" if the email comes from a reputable place Why do you ...


0

There are two aspects of email security w.r.t. the DMZ: SMTP Transport (inbound) Client connectivity SMTP transport requires AV scanning and often requires DNS lookups, virus sandboxing, etc. If the SMTP processing is outsourced to Google, Microsoft, Proofpoint, then I see no issue in allowing it to relay directly in, as the 3rd party is the outsourced ...


3

The short answer is no. Sure you can make your email very legitimate looking, that isn't the problem. The problem is you are conditioning your users to click on links in emails and email is a 100% insecure medium. Links in emails are an anti-pattern. "Official looking" isn't secure. Almost everything in your email can be replicated by a dedicated ...


10

Short answer, it's not the easiest solution. " it's very easy to set up a self-hosted email server" You are wrong, the rest is wrong because it's based on this. I assume you imply it's easy to set up a safe server (otherwise, what's the purpose of it all?). Your laundry list of what you need is long, and not even so it is complete. It's much easier ...


4

Email is insecure. It is completely insecure. Between you and the recipient it likely passed through dozens of servers and for each one it was passed as pure plain text. Without specific details and logs it is impossible to say where a copy was lifted but regardless you should always ASSUME that anyone can read anything you put in an email. If that ...


42

As someone who has actually done this for a couple of years, I can tell you that it's not nearly as simple as you're describing and it doesn't offer the security properties you want. In summary: Why do so many security experts (i.e. cryptologists & co.) not host their own email? Because it takes enormous amounts of time and specialized knowledge ...


10

There speaks someone who has never run their own email. You don't mention an inbound antispam solution. DKIM and related techniques are for authenticating your own mail as not spam and making it deliverable. (Deliverability is the main barrier against home hosting: most providers block port 25 and many mail recipients block all ranges known to be ADSL). But ...


3

I'm not a expert, but since nobody said the magic word " encryption " here yet, i will write this answer. It seems to me that what you want is to prevent NSA to get the hands on your communications data, but you are looking the wrong way, you must trust only the encryption algorithm that make the data secure and private and nothing more, you should aim to ...


16

When you send emails in your scenario, you announce the IP of your custom, private email server. Every recipient, and any interested party, now knows you use your own email server and where it is. This results in a one-to-one mapping of this server and your connection to it. If a government agency wants to track you down, all they need to do is to look for ...


65

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISPs do not provide law enforcement access to their sites and to the systems they provide for their customers? And with a home server: lots of sites explicitly deny access to their mail server from a "home" IP address (these are known address blocks), in ...


2

In the USA, there is the CAN SPAM act which requires advertisers to honor and respect unsubscribe requests. Violating this is a very serious crime. You can report it easily to the FTC, and if it's a US company, they will get into a lot of trouble. Because of how bad the punishment is, legitimate companies rarely disregard unsubscribe requests - you can ...


1

My experience with such links is that the amount of spam that I receive tends to decrease when I click on such links. Although most such links go to a similar/identical page as each other, I am of the opinion that those links are provided in order to legally cover the spammers - because anyone sending email has a legal obligation to stop sending at the ...


0

It would be more of real time chat and not email (electronic "mail"), isn't it? with a API based json calls one could easily accomplish that but there would be adverse security violation in having this feature.


2

It depends on the email system. In general, no, this is not possible. Traditional email messages were not written on interactive websites (unlike, say, Facebook messages); there is also no central server you are expected to continuously be connected to (it's a decentralized system). So, traditionally, messages were written entirely client-side, in a program ...


2

The theory is that traffic to the DMZ must be inbound. In that case, should something bad happen to the the DMZ host, the attack is contained within the DMZ. This means that the connections from your LAN must be initiated in the LAN, which usually means some kind of push (to the DMZ) or pull (from the DMZ) operations. This is doable for mail but sometimes ...


3

If you know the sender has got your email address legitimately, as per @WernerCD's answer ('Something you signed up for - knowingly, accidentally, "opt-in" purposely, "opt-out" not clicked'), go to their website and unsubscribe there. Many companies use third party web sites as end points for the unsubscribe links ("mailbot.com/unsubscribe" as opposed to ...



Top 50 recent answers are included