Questions tagged [email]
Related to email protocols, clients, servers, content, and message format.
1,559
questions
0
votes
0answers
29 views
Odd storage.googleapis.com link in spam email
I have accidentally clicked on a link in a spam mail (sent to my gmail, wasn't sent to junk folder) and it opened the link in a new firefox tab. hxxps://hm_vqh3bo6.storage.googleapis.com/24476060.html ...
3
votes
1answer
81 views
Nonprofit organizations asking me to email them a photo of my driver's license
Recently I've had two nonprofit organizations ask me to email them a photo of my driver's license. No money is changing hands, and both of these are legitimate and well-known nonprofits.
Organization ...
-1
votes
0answers
26 views
Identifying the spam source on my Centos6.9 smtp sendmail server [migrated]
The server has also httpd with PHP services running
I did read the guide here: https://a1websitepro.com/find-track-filthy-spammer-block/
I did install EXIM
My client complains they never had this ...
0
votes
1answer
65 views
Is hacking email with simjacking a concern if you don't have 2FA for the email?
I've been doing some reading on simjacking lately, mainly around how one may be compromised. One common tidbit I read is that you can access your email and your other financial services if you have ...
1
vote
2answers
41 views
I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]
I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
0
votes
0answers
25 views
How to track anonymous email sender (alternatives to IP tracking) [duplicate]
Are there any ways to get information on who is sending certain emails from an anonymous email address?
Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
71
votes
8answers
9k views
Why is email often used as the ultimate verification?
In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
0
votes
0answers
55 views
Is it a good idea to use a domain based e-mail accounts to register to financial services?
I normally use my personal email (e.g. @gmail or @yahoo) to create online financial accounts such as online wallets, bank accounts, stock market, and etc. I am currently planning to create an online ...
2
votes
3answers
94 views
Reading locally-stored emails sent encrypted
As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key).
...
0
votes
1answer
54 views
Can just clicking on a malicious link lead to hacking of my device? [duplicate]
I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it.
If I just click on a malicious link it might open a new tab, or it might download something....
1
vote
1answer
87 views
SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?
We recently received an email from a self described "white hat hacker" purporting to be from our own organization.
According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
0
votes
1answer
72 views
Finding all the subdomains and registered email addresses? [closed]
Could you please explain, how to find all of the existed subdomains of a domain address and registered email addresses of these subdomains?
I found a website called snov.io but it only shows some of ...
1
vote
1answer
58 views
Can a spam email full of junk characters be dangerous?
Recently, I've been receiving emails from JP MORGAN CHASE that are blatant phishing attempts. Out of curiosity I have opened them a few times, and they're just completely full of absolute junk ...
0
votes
2answers
132 views
Is it standard practice to hide where links point in a legitimate email?
Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed ...
7
votes
0answers
120 views
PGP security with Thunderbird 78 email client
I have a query regarding best practise of using PGP to sign emails with Thunderbird 78.
Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
5
votes
1answer
3k views
How is it possible that this spam mail came from Google Forms without revealing their sender address?
I got just this typical spam email, but this one seemed odd. It came from Google Forms, which apparently can send emails too, however you have to sign in to Google Forms to use it, and it uses the ...
1
vote
0answers
45 views
Strange cyrus/imaps Logins without valid password
I found apparently successful logins from a foreign ip-address to our cyrus-imap server:
Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
2
votes
2answers
77 views
What to make of inconsistent TFA/2FA verification emails from AOL
My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
73
votes
13answers
15k views
Why is a link in an email more dangerous than a link from a web search?
Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
0
votes
1answer
60 views
Why can't mail clients verify an email was sent from the user and server it claims to be from?
Background
When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't ...
1
vote
0answers
38 views
How secure is email now? [duplicate]
When I did my degree ~20 years ago, the contents of an email were described as being "as secure as a postcard".
Since then, HTTPs has become standard for web browsing and the absence of ...
2
votes
1answer
160 views
How can Google know that a Microsoft e-mail account is “not safe”?
Recently, I was forced to log in to my Gmail account with a browser to keep using it.
Then, Gmail noted that the "alternate e-mail address", my 1999 Hotmail one, which I had long ago ...
1
vote
1answer
115 views
Using Google Docs to share passwords
Background
Often developers and clients need to exchange passwords to be able to access some services. Of course the best option would be to never use someone else's credentials to log in, and instead ...
0
votes
1answer
105 views
IP address in email header? [duplicate]
I sent an email through my normal internet provider.
Afterwards, I set up an account so I’d have VPN to hide/randomize my IP address.
If someone traces the original email (before I got vpn to change ...
3
votes
1answer
96 views
How realistic is to be 'hacked' by ONLY clicking a link [duplicate]
In the case of phishing training, most training will say "don't click the link, you can get hacked!"
If there was an exploit that could bypass the chrome sandbox on an up-to-date verison of ...
1
vote
1answer
129 views
We were hacked and have no idea how [closed]
Last Friday, 7 of our employees' office365 email accounts were hacked simultaneously. We saw successful logins from random US addresses. The virus went through emails and basically does a reply-all ...
0
votes
1answer
223 views
How to workaround Thunderbird 78's lack of support for encrypted mailing lists?
As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
1
vote
0answers
65 views
Strange account activity - how to investigate
Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story:
I have started to receive 2-factor authentication SMS messages from ...
1
vote
3answers
256 views
Can schools track what I'm doing, even though I'm on my personal Gmail account?
My school can track my browsing when I'm at home and using the Google account they gave me, the laptop is my personal one. Is there a way that they could track what I do, even though I'm on my other ...
0
votes
1answer
1k views
Is this Google mail from gaia.bounces.google.com legit?
I've received the following suspicious mail in my Gmail inbox, about my password being exposed:
As you can see, it comes from gaia.bounces.google.com and is signed by accounts.google.com. But there ...
1
vote
1answer
81 views
Font risk in unopened email in inbox
This is obviously not from PayPal, but the font in the word account displayed using odd looking font, is this a security risk to me that Outlook.com displayed this font? See below, Outlook has preview ...
0
votes
1answer
41 views
Open IMAP connection using hashed password
I make email client over IMAP protocol. To "remember" user's connection details (email, password, host, etc.) I need to store password in plain text, because otherwise I won't be able to ...
0
votes
1answer
81 views
Is it safe to automatically parse text as markdown?
I have a server, which receives text mails from students and I plan to automatically collect their message bodys and parse them as markdown so that I can generate a nicely formatted output as pdf. Is ...
0
votes
1answer
102 views
How could the content of an e-mail get leaked?
My Mother received an e-mail, from some unknown mail adress. The content of the mail, was:
"Hello you should look at this: ... " After this there was an old email correspondence with her ...
0
votes
1answer
80 views
How do spammers crawl the web for mail addresses?
I have recently started getting the occasional spam mail after not having this problem for several years. As far as I know spammers typically obtain mail addresses via data breaches or by crawling the ...
0
votes
2answers
85 views
Security risk for allowing accounts without captcha
I run a website that allows people to create accounts with an email address address and a password. Over the last month, I have had about 100 accounts created with email addresses that look like this:...
-1
votes
1answer
167 views
Where was this email sent from?
I have done the message header lookup but the problem is that the 1st result for the from field is blank, so I would like to know can someone with a bit more experience then the basic knowledge of ...
0
votes
0answers
64 views
Are user customizable HTML e-mails secure?
Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific.
Consider a service where a company can register ...
0
votes
0answers
67 views
Handling file uploads securely in phpmailer/php
I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
0
votes
1answer
62 views
How many keys do you use for signing and encrypting emails? [closed]
Situation
I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
0
votes
0answers
28 views
Received email with password in the subject - To what extent have I been hacked? [duplicate]
I was cleaning out my spam folder, when I saw one with a subject line which had a little-used password of mine. 16 hours ago. I'm fairly sure odds of guessing this password are small, so I looked.
The ...
0
votes
1answer
106 views
Is the IP address of the client present in the email headers for webmail services and for desktop clients?
When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers.
But do the email headers also contain ...
1
vote
1answer
65 views
If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?
I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.
I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message ...
0
votes
0answers
30 views
Can my school see what I'm doing on my phone? [duplicate]
I have multiple gmail accounts logged in to my gmail app on my phone. One of them is my school email because I like getting the notifications directly to my phone without having to log in to my ...
0
votes
1answer
104 views
Is it safe to send verification code in the subject of the email?
I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email.
Example: "Welcome to the Application, Your verification code is XXXXXX"
...
0
votes
2answers
68 views
Anonymized posting mechanism for members-only-post mailing lists
Suppose you are administering a mailing list where only members/subscribers can post; but you want those members to be able to occasionally post some content to the list anonymously. (*)
Now, in an ...
34
votes
4answers
8k views
Are images in the FROM name a risk in emails?
I know about images posing a risk to security. I don't open suspicious junk emails for this reason. However, occasionally I have to check my junk email folder without clicking on an email just in case ...
0
votes
1answer
179 views
It seems that someone has been trying to brute force into my hotmail (outlook) e-mail account for years now, what can I do about it?
Every time I go check my account's activity I see something very weird and worrying: multiple attempts to log in to my account, anywhere from 1 to 3 daily attempts. This has been going on for years.
...
1
vote
1answer
153 views
Is this “secure email” mechanism my bank wants me to use best practice?
So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the ...
2
votes
1answer
83 views
Protecting against spoofed email in alias/phrase field
We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with ...
