Related to email protocols, clients, servers, content, and message format.
0
votes
0answers
16 views
Email provider that offers delayed forwarding? [on hold]
I currently use a single email account to log in to various things related to my business: hosting provider, domain name registrar and services related to hosting. It's also my personal email ...
6
votes
5answers
646 views
Is storing plaintext passwords for email accounts any less bad? [duplicate]
I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
0
votes
0answers
39 views
S/MIME vs. PGP & mail clients with PGP/MIME support
After having evaluated the potential use of S/MIME to sign and encrypt my mails (see Reading older mails signed with a certificate that has meanwhile expired) I have now also had a look at PGP as an ...
0
votes
1answer
80 views
Yahoo Account hacked, changed pw, spam still going out elsewhere?
Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts.
I changed the password, then saw (via rejected emails sent to my Yahoo ...
0
votes
3answers
51 views
Is it insecure to send an email from a PHP script to an email address on the same domain?
I have a php script that sends an email using mail(). The php script lives on domain.com, and it sends the email to info@domain.com. Is this a secure transaction? The website runs over https.
2
votes
2answers
58 views
How to find out the email host of a vanity email address?
Assuming a person gets his own domain address, say, theperson.com.
He then goes on to create a vanity email address with that domain. e.g. me@theperson.com.
me@theperson.com may be hosted by the ...
6
votes
1answer
73 views
Reading older mails signed with a certificate that has meanwhile expired
A few years ago I have used S/MIME certs to sign (and encrypt) my mails.
The reason for which I stopped signing was the following:
My (class 2) cert was issued on Jan. 1st 2008 (just a sample).
It ...
139
votes
2answers
12k views
Don't understand how my mum's Gmail account was hacked
My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
2
votes
1answer
87 views
How can I prove to a third party that I'm sending the emails I'm supposed to?
Suppose one of my duties for a small organization is to send out statements to clients by email.
Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he ...
3
votes
1answer
63 views
Keep receiving delivery failures for emails im not sending
I have my own domain, and a few email addresses on it, including a catch all address, with Google Apps. Recently, my catchall address has been receiving "delivery failure" emails from many different ...
3
votes
1answer
67 views
spam: several secret inboxes targeted at once. risk or coincidence?
I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email ...
0
votes
2answers
54 views
Is sending authorizing links through e-mail a vulnerability?
I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability?
Password-reset partly ...
2
votes
2answers
156 views
E-mail already in use exploit
I have a registration portal where user inputs his details and then a valid email account.
Currently I check the email is not used already and if it is I reply with the classic: "email already in ...
0
votes
1answer
52 views
Emails are forwarded to wrong addresses and possible hacking?
Multiple email addresses for my domain have been compromised.
My client forwarded me an old email which he sent me few days ago but I haven't received that email. That email was sent to an email ...
7
votes
3answers
335 views
How (in)secure is POP/IMAP/SMTP
I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken:
The ...
2
votes
1answer
70 views
Why would an attacker try to guess random email usernames on a small domain?
My mail server has recently come under a very bizarre attack. Every five to ten minutes, a new IP connects to SMTP, attempts to try weird usernames (like pil, bennett, netscape, msfuser, desktop, ...
2
votes
1answer
34 views
What Information is Exposed When I Send A Message From My Mobile Device
When I send a text message and/or an email, with or without location services turned on, what information is available to the recipient of that message if they know how to read the data behind the ...
0
votes
0answers
46 views
Is winmail.dat a malware propagation vector?
Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
2
votes
1answer
98 views
Someone keeps using my email address. What to do?
I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
1
vote
3answers
171 views
Sharing passwords through email can be considered insecure?
I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
4
votes
2answers
65 views
Using unique email address for online signups?
After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security.
We can only do so much too protect ourselves because at the ...
0
votes
1answer
61 views
Hack profile identification
What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my ...
-1
votes
2answers
92 views
Are there any mail services that don't store encryption keys?
According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/
Gmail doesn't store the encryption key.
But Gmail reads whole of users' email for ...
5
votes
3answers
355 views
How did the spammers get this address?
A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
0
votes
0answers
26 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
1
vote
1answer
120 views
Email Spoofing by SMTP Message-ID?
Many of my users today got email from docs#@mydomain.com (where docs# was between docs0 and docs8 or so, and mydomain.com is obviously changed from my real domain name), with the sender name of ...
0
votes
2answers
96 views
How do fake emailers work?
Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like ...
1
vote
1answer
66 views
Fake email messages via List-Unsubscribe header
List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list:
List-Unsubscribe: <mailto:list@host.com?subject=unsubscribe&body=qwe>
Free ...
3
votes
3answers
196 views
What is the most secure way to send emails using PGP?
I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server.
GPG has several features available, namely: 1) ...
0
votes
2answers
168 views
What information can be gained from an Email Header?
What information is present in an Email Header that can be used to track a sent mail? For example, are some of these present?
Web Browser used?
Operating system
Type of Network (broadband/dial up)?
...
1
vote
5answers
127 views
Is it possible for an attacker to change my sent emails content before arrival?
I have a web application that sends "change password link" to user that wants to changhe his password.
The link is something like this:
http:// ...
-1
votes
2answers
95 views
Hotmail security
Recently I've been receiving in my SPAM folder, SPAM mails sent "by me".
With "By me" I mean, that I am not sure if those are really sent from me.
It has been happening since December, at around one ...
1
vote
0answers
30 views
Needed: Reference data on the rate of adoption of secure email protocols [closed]
I am working on a security presentation in which I need to show that the incidence of unencrypted email protocols (e.g. POP, IMAP without STARTTLS) over the past 10 years has decreased and the amount ...
4
votes
2answers
125 views
Is it ok to email someone their password from a newly created account? [duplicate]
I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons.
In order to mitigate the increased risk of ...
1
vote
3answers
98 views
Question: How to plan email policy for start-ups?
I'm a part of a software start-up. I've the role of IT admin as well as requirement gathering (business analysis). Right now we're a team of seven people and we all are in the 'core team'. Now we're ...
3
votes
2answers
101 views
How to prevent email discovery in forms?
Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
3
votes
1answer
77 views
Tracking down the source of email attacks
For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
0
votes
1answer
59 views
How to pass an email address securely to a web application X embedded inside a web application Y
The scenario I'm trying to address is this:
There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain).
When X is ...
0
votes
1answer
68 views
Can one be infected just by reading an e-mail [duplicate]
I have heard several people say that you shouldn't even open e-mails that look suspicious, as you might be infected by a virus of some kind. Is there any validity to this? I suppose that some e-mails ...
0
votes
2answers
101 views
Security Certificate not from a valid authority
I have no real knowledge about this stuff so I figured I'd ask here for some answers.
So I started to get this "Security Certificate not issued by a valid authority" error when using my email client ...
1
vote
2answers
128 views
How to Check if my mail is classified as Spam
I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues.
It might be a false positive cases with the associated tools
Is there a tool or a way by ...
3
votes
6answers
178 views
Does an email signature increase security?
I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
2
votes
2answers
183 views
How to ensure an email address is not free webmail or ISP address?
I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs:
...
10
votes
3answers
532 views
Is Gmail showing images by default a good idea for privacy?
Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:
Instead of serving images directly from their original external host servers, Gmail will now ...
-1
votes
2answers
85 views
My Email Security is Low
I use Gmail to exchange confidential and important documents with my customers. The documents are read by an unauthorized person (during sending the email) that I don't know him/her. How can I solve ...
0
votes
1answer
106 views
Metadata-free Email: How can SENDER directly, anonymously, and securely ask RECIPIENT’s mail provider to deliver a metadata-free email?
If I want to send emails to friends who use Google, Yahoo, AOL, etc., how can I currently use my local email client to send a metadata-free* email to them?
E.g., is it possible to bypass my own mail ...
1
vote
2answers
54 views
Associate guest orders with account if email matches?
A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
1
vote
1answer
50 views
Getting more users to use PGP [closed]
Does anyone know of browser Plugins that make Composing, sending, and reading email basically effortless?
Mailvelope doesn't seem to be working with the floating compose boxes in Gmail currently.
...
0
votes
1answer
55 views
Certificate for Email Encryption and signing
I don't understand the flow of Digital Certificate with Email Encryption and Signing.
For Example,
There is 2 users, Sender A and Receiver B.
Is Certificate required to encryption to A or just ...
1
vote
1answer
294 views
How could someone create a Facebook account with my email address without stealing it?
Someone with the same name as my sister seems to have inadvertently created a Facebook account with her email address. The funny thing is that this person doesn't seem to have ever accessed my ...
