Related to email protocols, clients, servers, content, and message format.
0
votes
2answers
19 views
Is there any mail service accepting real id?
Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address.
If there is a security breach, user may lost important information on that address. They may add phone ...
12
votes
4answers
575 views
What needs to happen for email encryption to go mainstream?
PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
1
vote
3answers
23 views
Secure Custom Registration Links
I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
0
votes
1answer
22 views
list of PKCS7 certificate file extensions
RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI.
PKCS#7 defines a ...
2
votes
1answer
42 views
Which information does a whois lookup reveal about the registrant of the domain?
A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..).
While sanitizing her account, I removed the forwarding of her emails to one email ...
-3
votes
3answers
63 views
How can get email about latest vulnerabilities [closed]
Today my friend got email for the latest vulnerablility heartbleed.
But i could not find where i can subscribe so that i can also get emails about latest vulnerabilities
Can anyone please help me ...
3
votes
0answers
73 views
Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)
The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft.
They allow to check if ...
0
votes
1answer
34 views
Email hacking/masking prevention
Can someone please explain to me how its possible that someone hacks a server and uses its email to send emails from a address thats not listed on the server and how to prevent it.
When I look at the ...
3
votes
1answer
158 views
How can an email from a Yahoo address be sent through Yahoo without authentication?
I received this bounced email, yet I have a password with 105 bits entropy, my sign in history only shows local sign ins, I do not have any linked accounts nor apps, and I have not been to ...
0
votes
2answers
299 views
Registration Password
Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
1
vote
0answers
119 views
PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?
So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so?
Assume we ...
-1
votes
0answers
12 views
Remove specific header information sent from Thunderbird to Google servers [migrated]
If I'm using the web interface of Gmail, it doesn't add my ip address to the email headers (only adds the Google ip addresses) but if I use Thunderbird, it add my ip address to it and Google mail ...
62
votes
12answers
20k views
Is Google overreaching by forcing me to use TLS?
Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts?
...
3
votes
1answer
58 views
Webpage sent me my password in clear text can it be secure? [duplicate]
I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text.
I ...
3
votes
2answers
79 views
Can viewing an email message in Outlook 2013 install malware on my computer?
I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account ...
0
votes
2answers
110 views
Best practice for sending IP Addresses
IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a ...
0
votes
1answer
59 views
Which mail clients support PGP/MIME - is there an overview? [closed]
Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME?
I wonder whether there still exist issues like "Outlook Express ...
0
votes
2answers
31 views
How likely would /var/mail be encrypted in a paid host? [closed]
I pay for a very basic web hosting plan, which includes a personal email address. Would the sysadmin of said host be able to read the content of my messages? How likely would my personal mail folder ...
1
vote
3answers
141 views
Email activation string with MD5'd random number and email secure?
For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address.
$key = ...
4
votes
5answers
163 views
Can the wifi administrator in a shared office see mail sent through outlook?
I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company.
My question is, can the wifi administrator see mail I ...
1
vote
1answer
78 views
Passwordless login over email - security considerations
I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
2
votes
3answers
64 views
Is it a good practice to include a download URL of my GPG public key in my email signature?
I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature.
Is this a good practice? If not, what's a good alternative?
1
vote
1answer
74 views
How could a third-party know the contents of an email I sent to someone?
Apparently, a third party knew the contents of an email I sent to someone within an hour after I sent it. The following possibilities come into mind:
The recipient forwarded the email to the third ...
6
votes
5answers
697 views
Is storing plaintext passwords for email accounts any less bad? [duplicate]
I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
0
votes
1answer
337 views
Yahoo Account hacked, changed pw, spam still going out elsewhere?
Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts.
I changed the password, then saw (via rejected emails sent to my Yahoo ...
0
votes
3answers
75 views
Is it insecure to send an email from a PHP script to an email address on the same domain?
I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.
2
votes
2answers
70 views
How to find out the email host of a vanity email address?
Assuming a person gets his own domain address, say, theperson.com.
He then goes on to create a vanity email address with that domain. e.g. me@theperson.com.
me@theperson.com may be hosted by the ...
6
votes
1answer
85 views
Reading older mails signed with a certificate that has meanwhile expired
A few years ago I have used S/MIME certs to sign (and encrypt) my mails.
The reason for which I stopped signing was the following:
My (class 2) cert was issued on Jan. 1st 2008 (just a sample).
It ...
140
votes
2answers
13k views
Don't understand how my mum's Gmail account was hacked
My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
2
votes
1answer
94 views
How can I prove to a third party that I'm sending the emails I'm supposed to?
Suppose one of my duties for a small organization is to send out statements to clients by email.
Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
3
votes
1answer
94 views
Keep receiving delivery failures for emails im not sending
I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
3
votes
1answer
103 views
spam: several secret inboxes targeted at once. risk or coincidence?
I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
0
votes
2answers
90 views
Is sending authorizing links through e-mail a vulnerability?
I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability?
Password-reset partly ...
2
votes
2answers
181 views
E-mail already in use exploit
I have a registration portal where user inputs his details and then a valid email account.
Currently I check the email is not used already and if it is I reply with the classic: "email already in ...
0
votes
1answer
66 views
Emails are forwarded to wrong addresses and possible hacking?
Multiple email addresses for my domain have been compromised.
My client forwarded me an old email which he sent me few days ago but I haven't received that email. That email was sent to an email ...
7
votes
3answers
456 views
How (in)secure is POP/IMAP/SMTP
I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken:
The ...
2
votes
1answer
79 views
Why would an attacker try to guess random email usernames on a small domain?
My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, ...
2
votes
1answer
44 views
What Information is Exposed When I Send A Message From My Mobile Device
When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
1
vote
0answers
61 views
Is winmail.dat a malware propagation vector?
Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
2
votes
1answer
204 views
Someone keeps using my email address. What to do?
I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
1
vote
3answers
182 views
Sharing passwords through email can be considered insecure?
I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
4
votes
2answers
79 views
Using unique email address for online signups?
After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security.
We can only do so much too protect ourselves because at the ...
0
votes
1answer
104 views
Hack profile identification
What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my ...
-1
votes
2answers
104 views
Are there any mail services that don't store encryption keys?
According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/
Gmail doesn't store the encryption key.
But Gmail reads whole of users' email for ...
5
votes
3answers
391 views
How did the spammers get this address?
A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
1
vote
0answers
29 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
1
vote
1answer
219 views
Email Spoofing by SMTP Message-ID?
Many of my users today got email from docs#@mydomain.com (where docs# was between docs0 and docs8 or so, and mydomain.com is obviously changed from my real domain name), with the sender name of ...
0
votes
2answers
117 views
How do fake emailers work?
Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
2
votes
1answer
90 views
Fake email messages via List-Unsubscribe header
List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list:
List-Unsubscribe: <mailto:list@host.com?subject=unsubscribe&body=qwe>
Free ...
3
votes
3answers
267 views
What is the most secure way to send emails using PGP?
I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server.
GPG has several features available, namely: 1) ...
