Related to email protocols, clients, servers, content, and message format.
2
votes
0answers
53 views
What security precautions should we take when letting a C# application send/receive emails?
I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
3
votes
1answer
138 views
Is this “forgotten-password” procedure safe/legal?
Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
2
votes
1answer
126 views
Do real-name email adresses hurt the anonymity provided by torbirdy?
Scenario:
Someone uses thunderbird to manage her various email addresses. All of those contain her real name (work, university, ...). One day, she has need of an anonymous email account and so creates ...
0
votes
1answer
72 views
By traveling outside your home country can it be revealed, somehow, that your emails have been sent through another country? [closed]
By travelling outside your home country can it be revealed, somehow, that your emails have been sent through another country?
1
vote
4answers
169 views
why do I get an email with address of Me'.exe'
I am wondering if there is a security issue with this. I use Mozilla, and I got an email with Me, '.exe' <myemail@server.com>. I have never seen this. What is it? Is it a way to send mass email? ...
3
votes
2answers
46 views
When is an email rejected?
Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
0
votes
1answer
78 views
Reuse an email address with a leaked password
I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
0
votes
3answers
41 views
Sending email from my provider back to my provider with data from user input secure?
My boss wants me to create the following functionality:
A user fills out a form on our website with some data. He can also upload some files, which have personal information.
After the form is ...
0
votes
0answers
16 views
Was RocketMail part of Yahoo's data breach?
Since Yahoo's massive 2013 data breach we have refused to accept Yahoo/Ymail email addresses as personal recovery accounts for GSuite.
I'd like to know if:
RocketMail accounts were included in that ...
0
votes
0answers
8 views
Mail gateway on top of Tobit.David mail server
I am looking for an email gateway for automatic en-/decrytion based on the mail content.
I thought about trying a hardware gateway.
Can I just put the gateway in between the mail server and the ...
1
vote
0answers
62 views
Email login bug, is it a security concern for email users?
(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing)
Scenario:...
0
votes
0answers
14 views
Selection Criteria for PGP Generator
My original question's responses indicated that I need to have my small team generate their own public \ private keys for securing email.
So the question now shifts to selection criteria for a PGP ...
0
votes
0answers
21 views
Can an email man-in-the-middle attack from your own host be prevented? [duplicate]
This week some of the emails from my server started being dropped with the message "550 Action not taken (in reply to end of DATA command)". It seems to be caused by spam software on my dedicated ...
1
vote
1answer
164 views
I would like to get scammed [closed]
I would like to get scammed via email to have some fun. How can I achieve this? (I have looked online and have found no answers only how to not get scammed.)
-1
votes
1answer
167 views
People using my email address (and only that) for booking hotels. What kind of scam is this?
I have faced the same issue twice: 2 people, whose names are definitely not the same as mine, used my email address to book hotels through a well-known hotel company and a lesser-known hotel booking ...
0
votes
4answers
104 views
Travel information and passport
I travel a lot and I am looking a good way to send my travel information, like hostel, passports etc. to send to my family before leaving.
This information is confidential. Actually, I am using a Zip ...
6
votes
2answers
155 views
What are the circumstances in which it's not foolhardy to have access to your primary email address through your smartphone?
Most web sites I use allow a password reset through email; a few require two-factor authentication with a phone call or SMS. It would perhaps only be banking or major commerce sites that would require ...
2
votes
1answer
79 views
Is this phishing? How can I be sure? And what can be gained?
Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
0
votes
1answer
56 views
Login key in email
I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails:
...
0
votes
1answer
41 views
idea to detect data breaches by letting users create single-click single-use email aliases
My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at ...
15
votes
2answers
3k views
How did this email list a fake recipient? [duplicate]
My friend recently received a suspicious email for an iTunes gift card purchase from "Apple Store" with a header that displayed a fake "To:" address for orders@apple-store.com.
Unsurprisingly, this ...
0
votes
0answers
29 views
Can your Outlook email (Outlook Web Access or OWA) get compromised just by receiving an email?
Assume I have a clean system, network, and up-to-date browser.
Let's say someone sends a malicious email to my Outlook inbox. I do not open it, preview it, or download and run any attachments.
My ...
0
votes
1answer
40 views
SSL with shared webmail URL
I have an account with a shared email hosting service (e.g mailcheap) and the the webmail URL is hence https://xxx.mailcheap.co. This webmail has HTTPS.
Now I created CNAME records on my domain to ...
1
vote
3answers
103 views
Receiving a response that is PGP encrypted
I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had.
Lately, I ...
1
vote
0answers
30 views
Can deleting an email in Outlook (Outlook Web Access or OWA) trigger an exploit?
Assume I have a clean system, network, and up-to-date browser.
Let's say someone sends a malicious email to my Outlook inbox. I know not to open it, preview it, or download and run any attachments.
...
2
votes
2answers
120 views
Revealing IP of an email recipient using remote PHP script or pixel tracking
I read through the search items and similar threads but my query is rather specific.
I know it's possible to reveal IP of an email recipient if we can get the person to click on an attached image or ...
1
vote
1answer
49 views
How difficult is it to direct an email into a gmail recipient's spam folder? [closed]
I assume gmail recognizes patterns somehow, but I have no idea how it's done.
What is the easiest way to have an email flagged as spam and directed to the recipient's spam folder? And how confident ...
1
vote
2answers
78 views
Can my company see the contents on my iPhone if I used my work email on it?
I'm temporarily employed at a company and I needed to send a quick email to one of my coworkers yesterday explaining that I was going to be late for my shift.
I couldn't reach them by phone and didn’...
1
vote
1answer
94 views
Should I reply to an email saying that I requested online access to a website?
I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
0
votes
1answer
47 views
Can a secure invitation link be sent client-side only?
One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with ...
1
vote
2answers
94 views
Who can read our customers email and try to hack our mailserver
To ease tracking replies and bounces, we send automated emails such as - order confirmations, password recovery, etc with a unique sender address typically like this FROM sup-[custno]-[invno]-[hash]@...
0
votes
0answers
44 views
emails not going as spamhaus has us on their blacklist [duplicate]
since last 2 days most of our mails are being rejected as we are being blacklisted by spamhaus.
Now the ip is blacklisted but the website itself shows clean. ( and spamhaus report says EiTest ...
1
vote
2answers
129 views
Close Port 587 - Ramifications?
Our recent PCI scan failed because "Plaintext authentication is allowed over unencrypted channel on SMTP." As such, our tech support suggested to close port 587.
What are the effects of closing port ...
0
votes
1answer
39 views
Whitelist outbound mail [closed]
Is there a way to limit the list of mailadresses a user can send mail to, to a small whitelist of approved addresses?
The only option I can think of right now is a customized contact form, but I'm ...
2
votes
2answers
150 views
Downloaded “DHL” fraud email to Linux, action needed?
Yesterday I ordered a package and today received an email from "DHL". I downloaded an attachment from the email and clicked it. It opened a htm page. (I did not fill out any information.)
I now ...
0
votes
1answer
27 views
E-Mail Web Client: How to handle credentials
I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side.
Multiple Accounts should be able to ...
0
votes
0answers
14 views
Understanding transit flow through email header [duplicate]
I am trying to analyse the flow of email by email header. I have added snippet of one my email header I am trying to understand. I have concluded some points using that. Are the below conlcluded ...
1
vote
1answer
23 views
Is it bad to use DKIM DNS without signing mails?
Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that.
Now, if I send an email to a domain/server with DMARC ...
4
votes
2answers
113 views
How to securely store user-specific mail server credentials at the server side of a web application
I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to ...
1
vote
0answers
40 views
Phishing email linking to sharepoint address [duplicate]
Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
2
votes
2answers
6k views
Is 'account-security-noreply@accountprotection.microsoft.com' a legitimate sender of security alerts?
I have been getting emails from "account-security-noreply@accountprotection.microsoft.com" (as verified in metadata) about unusual activity. The internet has very conflicting information about if ...
3
votes
0answers
43 views
Check if mail was encrypted between servers using the header? [duplicate]
I am trying to read the email header and see if the emails is encrypted during transit.
By looking at the lines from email header Received: by 2002:a6b:e40f:0:0:0:0:0 with SMTP and Received: by mx....
0
votes
0answers
355 views
How to handle a Google security warning to a non Google email address?
I just received two emails from Google. The first one tells me that my password was changed, the second one tells me, that a windows device logged in to my account.
All the links in the emails point ...
-1
votes
1answer
29 views
Is the following date stamp at the bottom of a series of emails valid?
My boss supposedly received an email, as well as a follow-up, complaining about my work. The content leads me to believe it is actually a setup. The 2nd email from the client has my bosses reply at ...
2
votes
1answer
139 views
Is is safe to use PGP again?
The EFF has issued some instructions enitiled "How To Turn PGP Back On As Safely As Possible".
The emphasis there is mine, and that qualifier worries me. Realistically, what risks do I run if I ...
0
votes
0answers
112 views
Fake Wordpress reset password email with an external X-Google-Original-From header
My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site.
These emails appear to ...
0
votes
1answer
465 views
Accidently opened a phishing email, is my computer infected by malware?
I was looking through my unread emails when I accidently opened a Paypal phishing one. I thought it was legit because I saw in the preview it was from "Service-Intl@Paypal.com", but I got some doubt ...
0
votes
3answers
421 views
Security of emails from ProtonMail to Gmail
I understand that Gmail to Gmail is not very secure. On the other hand, ProtonMail is a very good option with great features. But there is one thing I don't quite understand:
Why should I use ...
1
vote
0answers
37 views
How to Force STARTTLS on Outlook and other clients
I am currently writing an essay about securing E-Mails. Now I'm at the point where I want to know if it´s possible to force STARTTLS in connections via SMTP or POP3/IMAP from the clients' side. I know ...
1
vote
1answer
201 views
Why do scammers use emails like yahoo?
I was doing a Cyber Security and IT audit for a company.
I was told that they had very little in terms of fraud protection, one of the only ways that they detected potential fraudsters was by ...
