Questions tagged [email]
Related to email protocols, clients, servers, content, and message format.
1,537
questions
1
vote
1answer
84 views
We were hacked and have no idea how [closed]
Last Friday, 7 of our employees' office365 email accounts were hacked simultaneously. We saw successful logins from random US addresses. The virus went through emails and basically does a reply-all ...
0
votes
1answer
110 views
+50
How to workaround Thunderbird 78's lack of support for encrypted mailing lists?
As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
1
vote
0answers
63 views
Strange account activity - how to investigate
Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story:
I have started to receive 2-factor authentication SMS messages from ...
0
votes
3answers
147 views
Can schools track what I'm doing, even though I'm on my personal Gmail account?
My school can track my browsing when I'm at home and using the Google account they gave me, the laptop is my personal one. Is there a way that they could track what I do, even though I'm on my other ...
0
votes
1answer
93 views
Is this Google mail from gaia.bounces.google.com legit?
I've received the following suspicious mail in my Gmail inbox, about my password being exposed:
As you can see, it comes from gaia.bounces.google.com and is signed by accounts.google.com. But there ...
1
vote
1answer
76 views
Font risk in unopened email in inbox
This is obviously not from PayPal, but the font in the word account displayed using odd looking font, is this a security risk to me that Outlook.com displayed this font? See below, Outlook has preview ...
0
votes
1answer
30 views
Open IMAP connection using hashed password
I make email client over IMAP protocol. To "remember" user's connection details (email, password, host, etc.) I need to store password in plain text, because otherwise I won't be able to ...
0
votes
1answer
65 views
Is it safe to automatically parse text as markdown?
I have a server, which receives text mails from students and I plan to automatically collect their message bodys and parse them as markdown so that I can generate a nicely formatted output as pdf. Is ...
0
votes
1answer
96 views
How could the content of an e-mail get leaked?
My Mother received an e-mail, from some unknown mail adress. The content of the mail, was:
"Hello you should look at this: ... " After this there was an old email correspondence with her ...
0
votes
1answer
61 views
How do spammers crawl the web for mail addresses?
I have recently started getting the occasional spam mail after not having this problem for several years. As far as I know spammers typically obtain mail addresses via data breaches or by crawling the ...
0
votes
2answers
77 views
Security risk for allowing accounts without captcha
I run a website that allows people to create accounts with an email address address and a password. Over the last month, I have had about 100 accounts created with email addresses that look like this:...
-1
votes
1answer
99 views
Where was this email sent from?
I have done the message header lookup but the problem is that the 1st result for the from field is blank, so I would like to know can someone with a bit more experience then the basic knowledge of ...
0
votes
0answers
63 views
Are user customizable HTML e-mails secure?
Let me prefix this by saying I am aware of how HTML e-mails can implement trackers and other malicious content, however this question is quite specific.
Consider a service where a company can register ...
0
votes
0answers
54 views
Handling file uploads securely in phpmailer/php
I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
0
votes
1answer
54 views
How many keys do you use for signing and encrypting emails? [closed]
Situation
I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
0
votes
0answers
27 views
Received email with password in the subject - To what extent have I been hacked? [duplicate]
I was cleaning out my spam folder, when I saw one with a subject line which had a little-used password of mine. 16 hours ago. I'm fairly sure odds of guessing this password are small, so I looked.
The ...
0
votes
1answer
78 views
Is the IP address of the client present in the email headers for webmail services and for desktop clients?
When I receive an email sent by someone using a webmail service (e.g. Gmail, etc.), I can find the IP address of the sender's email server in the email headers.
But do the email headers also contain ...
1
vote
1answer
64 views
If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?
I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.
I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message ...
0
votes
0answers
30 views
Can my school see what I'm doing on my phone? [duplicate]
I have multiple gmail accounts logged in to my gmail app on my phone. One of them is my school email because I like getting the notifications directly to my phone without having to log in to my ...
0
votes
1answer
92 views
Is it safe to send verification code in the subject of the email?
I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email.
Example: "Welcome to the Application, Your verification code is XXXXXX"
...
0
votes
2answers
68 views
Anonymized posting mechanism for members-only-post mailing lists
Suppose you are administering a mailing list where only members/subscribers can post; but you want those members to be able to occasionally post some content to the list anonymously. (*)
Now, in an ...
34
votes
4answers
8k views
Are images in the FROM name a risk in emails?
I know about images posing a risk to security. I don't open suspicious junk emails for this reason. However, occasionally I have to check my junk email folder without clicking on an email just in case ...
0
votes
1answer
104 views
It seems that someone has been trying to brute force into my hotmail (outlook) e-mail account for years now, what can I do about it?
Every time I go check my account's activity I see something very weird and worrying: multiple attempts to log in to my account, anywhere from 1 to 3 daily attempts. This has been going on for years.
...
1
vote
1answer
143 views
Is this “secure email” mechanism my bank wants me to use best practice?
So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the ...
2
votes
1answer
80 views
Protecting against spoofed email in alias/phrase field
We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with ...
1
vote
2answers
162 views
IP address leaked in email header?
Can my IP address ever be included in the header of emails I send? Or do email servers never include my IP address in my emails' headers?
51
votes
5answers
8k views
New Hires get phishing emails very quickly - Reasoning and how to stop
We hired a new Sales Ops member 1 week ago. Within a week he's getting emails similar to the below:
I did some research on the sender and it is a valid email, valid person, SPF/DKIM checks come ...
1
vote
3answers
142 views
What to include in emails to make them acceptable to email servers?
I need to send some automated emails from a program I'm working on. This is a new feature. I'm generating the emails, but they get filtered by most of the email servers that I send tests to. Only one ...
0
votes
2answers
52 views
How to decide to use, then how to use an http gofile.me url in an email, explained to a five year old?
I'm terrified of clicking on links in emails, and yet a colleague insists I do.
When I receive an email in my gmail account that contains links of the form http://gofile.me/xxxxx/yyyyyyyyy along with ...
0
votes
0answers
60 views
What's the purpose behind this phishing attempt? [duplicate]
As probably all of you, I got an email that was intended as a phishing attack.
The HTML version of the email was pretending to be a Facebook email of a security warning.
The links do lead to Facebook,...
0
votes
1answer
101 views
Register an @yahoo.de email? [closed]
Years ago I created an account and put my reset email as example@yahoo.de by mistake, it should have been @yahoo.com.
Recently, I tried to access my old account but could not remember the password. ...
0
votes
0answers
20 views
How to create a “purpose-built attribute/secret” to recognize people over the phone?
Imagine you're talking to someone over the phone who needs to check something before he can call you back. In order to ensure that you will be talking to this very person later, you have to create ...
1
vote
2answers
179 views
What are the dangers of a mailto link?
I was looking through my spam folder, and there's a 100% sure spam email, that asks me to confirm that I want to unsubscribe by clicking some big unsubscribe button. That button is simply a mailto: ...
4
votes
2answers
243 views
I woke up and my email has been signed up to hundreds of online services. How can I fix this?
I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
1
vote
0answers
42 views
In the context of emails, what can be digitally signed and what should be digitally signed in the sub context of deal documents?
I was once a customer of a certain developer who sold a SaaS bookkeeping software which allowed sending deal documents (invoice, receipt, etc) to a customer, from the software's very own email server, ...
0
votes
0answers
40 views
What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?
I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email.
It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
58 views
What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?
I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do:
Parse the ...
0
votes
1answer
47 views
How email sent with S/MIME are stored?
I use Outlook to send email. In order to encrypt them, I use S/MIME with a signed certificate. I don't find the answer on how the storage of the email I send is performed.
First option as I am the ...
1
vote
1answer
109 views
Protecting a website from being kidnapped
I have a MediaWiki website in Hebrew;
As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible.
I chose to give that website a Global TLD (a non ...
0
votes
0answers
29 views
Security Risks of CID Image Embed?
I am putting together an email and have been asked to embed the images and to reference their ContentID in the HTML so that the email is self contained (no requests out to download the images from our ...
0
votes
1answer
101 views
Full disk encryption and remote unlocking a mail server in the hand of a possible attacker, what could go wrong?
Since I cannot receive email directly from my home server, I need an external device to receive messages for me and deliver them to my MTA via another port or via VPN. Instead of renting a VPS just ...
0
votes
0answers
22 views
Should I be concerned about websites emailing me my plaintext password after signing up? [duplicate]
In multiple instances lately, I have received the plaintext passwords I entered(not given to me) emailed to me after signing up. The sites in question have been legitimate small businesses, so I ...
-6
votes
1answer
150 views
How can Tutanota, ProtonMail and Hushmail all claim to provide privacy when they only allow privacy-incompatible payment options? [closed]
I'm attempting to register an e-mail account without destroying my privacy. The reason is simply that one is necessary to be able to register on a different service (web host for my new, very non-...
5
votes
1answer
130 views
Whom should I report spam emails to?
Today I received an email from a person in "critical health condition" who wants to give me about $10 million. It is clearly some kind of scam. What should I do with the email besides not ...
71
votes
8answers
10k views
What is the suggested best practice for changing a user's email address?
I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail.
During ...
7
votes
3answers
209 views
Zero Knowledge Proof of ownership of an email address
Let's say that we want to develop a blogging service where only people with an @example.com email can contribute.
Prior to post submission, the user requests that a large random token be generated by ...
0
votes
1answer
66 views
Why can I still receive email at my old domain after someone else bought it?
My domain expired years ago and was registered by another party.
I have already read Can someone read my E-Mail if I lose ownership of my domain? and see that the answer is yes.
Now if someone buys ...
0
votes
1answer
80 views
Phishing email from a contact
I received an email from what looked like a friend, it had a suspicious link I inspected the email address and saw that the username was spot on but the domain name was totally different. I also put ...
-3
votes
4answers
158 views
Can a hacker access your email address and then choose to do nothing?
I have done a bit of research on what hackers look for in an email address, and it looks like any information is valuable to them, but a friend that knows about the subject has told me that it was ...
0
votes
1answer
88 views
What exactly is a “Combo List”, and why is this site providing them for free?
After asking for e-mail lists the other day, I got linked to this: https://combo-list.com/
This is a very strange "blog" which appears to be regularly publishing (or linking to, rather) ...
