Questions tagged [email]
Related to email protocols, clients, servers, content, and message format.
1,720
questions
0
votes
0
answers
29
views
Can I email a lot of random people I don't know for no reason [closed]
I'm not going to do it, but is it legal to email a lot random people? Again, I'm just asking, not going to do it.
0
votes
2
answers
82
views
Why is it ok to send my lender an email, but not ok for them to send an email back?
My loan lender accepts emails from their customers. They share their contact details including their customer service email address on their website with the public. So, they apparently regard ...
0
votes
0
answers
48
views
Why does the majority of email spam even exist? [duplicate]
This is a serious question and I have thought about it a lot. Not a newbie question. I am unsatisfied with the common answers
they try to sell things
they try to scam you
they try to do phishing
they ...
- 111
0
votes
3
answers
98
views
Is my Hotmail compromised as many emails have been sent automatically?
There were hundreds of emails sent from my Hotmail account between 30 Aug to 1 Sept to many Hotmail and Outlook addresses with sECURED.shtml attachment of 764KB. Some emails were not delivered and ...
48
votes
4
answers
4k
views
Is URL rewriting in e-mail a sound security practice?
Our work e-mail server has started rewriting links in incoming mail through a redirecting gateway, for "security reasons": if I receive an e-mail containing a link to
https://security....
- 829
0
votes
0
answers
22
views
How could I get a spam/phishing email from microsoft.com [duplicate]
I got this email from no-reply@microsoft.com. This spam email Report The User points to mailto:Unusuaal.Signin980@googlemail.com?subject=unusual sign-in activity&body=Report The User
How can ...
- 101
0
votes
1
answer
76
views
How can I filter out phishing e-mails containing malware using Gmail?
I use gmail, and about 3 weeks ago I started getting a couple e-mails a day from random sources. All of the e-mails contain gibberish text like this:
6 5 4 8 2586 8016 70170
2 1 08 05 60 172 01 ...
- 183
2
votes
2
answers
71
views
Flattening an SPF record - drawbacks and downsides?
I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups:
SPF implementations MUST limit the total number of ...
- 508
6
votes
1
answer
714
views
Can DMARC's SPF alignment be spoofed?
IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
- 417
0
votes
1
answer
45
views
Forward messages without tracking pixels using thunderbird
Thunderbird does not load remote content by default, preventing pixel-tracking. However, if I forward an email, the links to remote content is still included in the forwarded email.
Is there an option ...
- 103
0
votes
1
answer
126
views
How to detect phishing emails in the future?
My main tactic (amongst others, see related questions) of how I detect phishing emails are through the use of the obviously wrong sender domain.
I see a trend that big companies start to use dedicated ...
- 101
0
votes
2
answers
49
views
Is this a valid use case for email 2FA?
We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their ...
0
votes
0
answers
37
views
How to encrypt an e-mail to many recipients in an effective way? [duplicate]
Let's say we have an e-mail of 10MB, and we want to distribute this to 1000 users. Before sending the e-mail, I encrypt it. And all users have my public key to decrypt it.
What encryption method can I ...
- 101
0
votes
1
answer
97
views
Abnormal Receiving of Google Verification Codes
Recently I have been receiving "Google Verification Codes" that I never requested and for password recovery of the google accounts that are not mine however are similar to mine. It might be ...
- 1
1
vote
1
answer
123
views
Why is email 2FA not common?
SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
- 115
0
votes
1
answer
60
views
Does S/MIME encryption encrypt with each recipient's key?
If I send an email through S/MIME protocol to a group of recipients, does the email client require to encrypt the same email content with each recipient's public key before sending to each recipient? ...
0
votes
0
answers
47
views
Can code be executed from copying the From field of an Outlook Email?
I received a suspicious email in Outlook and wanted to check the from email field to see if it was still a Microsoft address.
I right clicked and selected "copy address" on the From field ...
- 1
1
vote
0
answers
70
views
What's the purpose of this spam that only sends a link to a Google search query? [duplicate]
I received the following email today which got caught by my spam filters.
<My username>
https://www.google.com/search?q= <my email address>
Rock_jim
Clearly this is spam, but I have no ...
- 1,317
3
votes
1
answer
352
views
Can a plain text email contain XSS injection?
I need to send a plain text email with user-specified input.
For example, if a user is an attacker a plain text email can contain
<script>alert(1)</script>
It looks like mail clients ...
- 33
0
votes
0
answers
52
views
Best practices for GPG user ids and mail extensions / catch-all addresses
Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
- 43
0
votes
1
answer
59
views
Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?
I'm writing a mailing list manager program. For subscribing and unsubscribing, I'm considering using HMACs of email addresses with secret keys to generate unsubscribe links. This key would be ...
- 115
32
votes
5
answers
5k
views
Is there any security benefit from emailing a "secure link"?
Sometimes I receive email messages from organisations I'm involved with saying something like:
Alice at AnyCo has sent you a secure message
Along with a link to access said message. Sometimes I'm ...
- 2,017
0
votes
1
answer
68
views
How would you counter an email/honeypot mischief scenario?
I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
A rogue party (a competitor) performs sign-...
- 103
34
votes
5
answers
11k
views
Can I prove that I did not receive an email?
A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...
- 341
0
votes
2
answers
87
views
Does my receiver have a public key for email encryption?
I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
- 11
0
votes
2
answers
66
views
How can I receive a (spam) email from an unknown email address?
When you receive an email, most email programs will display the sender as a name (chosen by the sender) and hide the actual email address behind it. Spam emails often abuse this by sending mails from ...
- 123
0
votes
1
answer
57
views
Email TLS coverage for forwarded recipient email address
When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
- 103
0
votes
0
answers
32
views
Do I have to check the fingerprint of new received OpenPGP public key, if it has been sent in a signed and encrypted email from a verified source?
I asked this question before at https://askubuntu.com/questions/1404973/do-i-have-to-check-the-fingerprint-of-new-received-openpgp-public-key-if-it-has and the answer to my question was "This ...
- 101
0
votes
0
answers
34
views
Spam investigation and email reputation check
We are investigating emails which were marked as spam by Cloudmark's service Cloudmark Authority Engine (CMAE). We want to find out if they are false positives. When an user ask to investigate why a ...
- 3
0
votes
2
answers
91
views
Is the text of an email subject line a softer target for surveillance than the text in the body?
After using PGP for a long time I have trained myself to write bland email subject lines that disclose little or nothing about the contents.
Some people I correspond with unencrypted have an annoying ...
- 359
0
votes
1
answer
774
views
Is it safe to use AnonAddy or SimpleLogin for email address security?
I was intrigued with AnonAddy and SimpleLogin. They provide an email address forwarding service to prevent leakage of your real email address.
I just want to ask if they really hide my real email ...
- 27
-1
votes
2
answers
85
views
How to check the authenticity of an outlook email attachment (.msg)?
let's say that someone sends me a business email on Microsoft outlook 365.
I save the email as an attachment (email.msg)
How a third person can make sure that the email attachment is not edited (...
- 99
2
votes
2
answers
596
views
Cipher suite choice on macOS on Apple Silicon
I have a postfix mail server that accepts these cipher suites:
tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
...
- 647
0
votes
0
answers
8
views
Click on a link in a malicious email - how can i be hacked? [duplicate]
I accidentally clicked a link in a malicious email. The link has opened in my browser. I have not entered any username and password to login in.
Could I have been hacked? I'd like to know what could ...
3
votes
3
answers
697
views
Securing Email: use GPG for all emails?
I am thinking of using GPG to sign commits and particularly to secure emails, and have some questions regarding the usefulness.
Basic threat model
(I use LESP as abbreviation for large email service ...
- 39
-1
votes
1
answer
76
views
What might happen if you post a local URL?
To show something in a forum you capture a page of an email service after logging in; but using MS Paint you erase the titles of the inbox as well as your name. Only the following information is shown
...
- 1
0
votes
1
answer
90
views
Virus from Embedded Image in Mac Mail?
I'm using macOS High Sierra, and mac Mail version 11.3. I have a script that uses the Twitter API to continually fetch tweets in real-time and send the contents of each of these tweets, including any ...
- 3
0
votes
1
answer
59
views
Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)
We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
- 3
0
votes
1
answer
38
views
Authorizing 3rd Party Envelope Sender to Impersonate Header Sender
Rewriting for clarity:
This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
- 1
1
vote
0
answers
25
views
Email supposedly from the future mentioning fairly recent password [duplicate]
Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
- 11
1
vote
2
answers
69
views
Using Google Domains' Email Forwarding Service for throwaway accounts and other things
I registered my current web domain (masonbitbyte.dev) with Google Domains and one of the offered features is an email alias / forwarding service. I can create over 100 email addresses on my domain (...
- 11
1
vote
1
answer
86
views
Is authentication through mail clients safe when encryption is off?
When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below).
Is the password safely sent through the internet when ...
- 13
1
vote
1
answer
97
views
Possible rogue admin monitoring my online activities
I teleworked for a medium-sized software company. We had a network architect who offered me a firewall to install so I could securely access on-premises resources and play around with some ...
- 773
1
vote
0
answers
91
views
iOS (iPhone) S/MIME certificate with multiple addresses
On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
- 11
1
vote
0
answers
60
views
Is there a standard for fencing email domains to specific use cases?
To my knowledge, there's no common standard for sysadmins to publish trusted domains for specific use cases.
If it exists, I would presume that this might limit phishing attacks. Think of my question ...
- 195
0
votes
0
answers
45
views
How am I receiving emails addressed to an address not associated with my account?
I currently have a g-mail address (example@gmail.com). I recently received a message addressed to example@aol.com. Looking at the header I see my correct address in the Delivered-To: field but in the ...
- 61
0
votes
0
answers
67
views
Is it inappropriate at all for someone in my client organization to email their PEM file to me?
I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
0
votes
1
answer
204
views
Making a phishing link look innocent
Situation
I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading ...
-1
votes
1
answer
88
views
Automated malicious links delivered with e-mail (Reddit, LinkedIn, Package) [closed]
Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc....
- 353
1
vote
1
answer
129
views
Suspicious hyperlinks (all hex URLs) in e-mail
I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
- 115