Tag Info

New answers tagged

3

Someone may just want to fill up your inbox with annoying messages from legitimate and verified companies, but if this were the case you'd see a lot more emails. Attackers may also be trying to test you to determine how likely you are to click on links with no legitimate basis to determine potential for future phishing attacks. For instance, if they can ...


0

Small tangent - SMTP isn't secure, you're only talking about the MTA. TLS certificate validation modes (subject validation) is only a small subset, and doesn't matter if other concerns are addressed. For example, if you use SMIME or PGP, TLS might not matter. It depends on what your threats are. You say that TLS is preferred, and unencrypted if necessary. ...


2

To ensure only the user has the key for his IMAP-Account, you can save the login credentials in your session symmetrically encrypted by a key, that is stored in a cookie. So the user can unlock the login credentials with his cookie, without that the webserver can't login. Of course you have to ensure that all occurrences of the credentials are overwritten ...


3

Since the author mentions his product is like Roundcube or Squirelmail.. I know how Roundcube works. Well, Roundcube's webmail DOES NOT have it's own method for logging in users. What I mean is that there is no database which stores anything about the user. Roundcubes takes the credentials user provided and puts them straight in imap_open(). If it ...


0

ive been thinking about this for a bit due to the fact that you should never store user passwords in plaintext. so I have came up with a possible solution for you. When a user signs up for a new 'service' to their account (e.g. they add gmail or yahoo, etc. ) what you are going to have to do is: Ask the user for their site password again (and validate ...


0

Why you do not store the mail server credentials as part of the web server session data. Once the user type his mail server username and password in you webmail client application. You keep this information in the web server/user session. However, this means every time the user login to the webmail he will need to authenticate his identity at least twice ...



Top 50 recent answers are included