All Questions
1,860 questions
2
votes
0
answers
564
views
Active Directory and External Email Accounts
In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. [email protected]
Within the same AD we also have '...
- 129
0
votes
1
answer
1k
views
Can someone spoof its IP address to mine when sending emails?
Can someone spoof its IP address to mine when sending emails?
I know we can see the IP address of the sender in the email header. If someone had my IP, can he/she use it to show in email headers?
Even ...
- 208k
7
votes
5
answers
5k
views
Are SHA-256 hashes of user emails guaranteed to be unique?
I'm working on a website that will require users to insert a valid email address, which will work as their unique user id. This email will not be used for communicating with the user, it is only ever ...
- 12.6k
-1
votes
1
answer
394
views
checking if 2 emails were communicate with each other [closed]
Maybe with SMTP servers edited?
1
vote
1
answer
206
views
Reliable way to permanently hide primary email address [closed]
I'd like to permanently hide my primary email address by using a permanent forward email address/alias for an extra layer of security.
My plan is:
Creating a new personal email address.
Create a ...
- 1,135
3
votes
1
answer
7k
views
Is winmail.dat a malware propagation vector?
Some of my coworkers use Microsoft Outlook (I believe) and have it configured in such a way that mail attachments are encapsulated in winmail.dat files. Apart from the general annoyance and lack of ...
2
votes
1
answer
3k
views
Fake email sent through newsletter service: how to know who sent them?
Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of ...
2
votes
1
answer
355
views
Spoofed email: whose fault is it?
My relative received an email from a bill they were expecting to pay. So they paid said bill.
Only problem is: it was a spoofed email, and the real bill only came in later.
I checked the email on the ...
- 1,266
0
votes
2
answers
741
views
Does Protonmail save MAC addresses? [closed]
I received an "automated abuse detection" warning email to my Protonmail account due to bulk sign-ups. Does that mean that all the emails are associated with one another? My brother made a ...
- 132k
3
votes
2
answers
534
views
Are there any reasons to forbid employees from using desktop email clients?
Corporate email services often use web-based solutions like gmail or office365.
Is there any valid security concern in allowing third party email clients if two factor authentication
is enabled on the ...
CommunityBot
- 1
0
votes
1
answer
236
views
Does email provider scan mails for viruses?
Imagine I am on [email protected] and I send a mail to [email protected] with an eicar.txt as an attachement. Will the email be stopped because it contains the eicar.txt ?
In case there is an email ...
- 208k
1
vote
2
answers
5k
views
People using my e-mail address to sign up for mailing lists and newsletters, what to do to prevent it from happening anymore? [duplicate]
For some years now, I sometimes get e-mails, that my e-mail has been used to sign up for a mailing list or service, even though I haven’t signed up for it.
It’s not something that happens very often, ...
- 132k
2
votes
1
answer
176
views
Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information?
Does a proper Email ALG (i.e. Email-Proxy) alter/remove the local Email-Header information so the recipient does NOT get information about the locally used IP addresses?
Example:
Received: from mail....
- 132k
4
votes
2
answers
769
views
Is a ptr mechanism in an SPF record secure?
If I understand the SPF Record Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using ptr in my SPF record.
Anyone can create a ...
- 12.1k
4
votes
3
answers
650
views
What is the point of having SPF and DKIM set up, but having DMARC with policy=none?
Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
- 101
1
vote
1
answer
138
views
Is there a justification for rejecting email addresses without dots in the mailbox name?
By this, I mean rejecting [email protected] and insisting on [email protected] as a means of communicating with me (and in one case, as a login).
A few years ago, the French social security ...
- 132k
3
votes
2
answers
5k
views
What IP address is used when replying on an email while using a VPN?
If you send an email with your VPN connected I believe the recipient should see the VPN IP address in the email header, not the real IP address. But if the recipient replies to this email at a later ...
- 1
1
vote
2
answers
976
views
Risks sending emails with my servers using clients' SMTP credentials
Assuming I am creating an online service that allows my clients to send email (using their SMTP credentials), what risks should I consider and how to prevent them?
The sender of the emails will always ...
- 712
1
vote
1
answer
891
views
Why it is so widely tolerated to allow SMTP server in DMZ to initiate connection to the LAN
I was surprised to see that the French cybersecurity agency tolerates an SMTP relay server in the DMZ (which collects emails received from the Internet) to reach the Email server in the LAN.
In my ...
- 2,041
0
votes
1
answer
68
views
Can an email address be added to "Forward To" list in cPanel without accessing the cPanel?
My company is using cPanel emails, recently while reviewing email forwarders, I noticed an email in the "Forward To" list that our sales email is being forwarded to it and that was unknow to ...
- 1
10
votes
3
answers
11k
views
How to prove my Gmail has been hacked?
I believed that someone had hacked my Gmail because they were using information contained within my emails in an attempt to try to convince me that they were psychic. I told them that I didn't believe ...
CommunityBot
- 1
1
vote
1
answer
82
views
University Email (Outlook) Changed and Auto-Updated in Browser and Google Account
I recently noticed my email address for the University I work for was changed - from "[email protected]" to "[email protected]". I also noticed that the version of the ...
2
votes
1
answer
770
views
How many times need e-mail headers be signed with DKIM to mitigate DKIM header injection attacks?
Many people have written about DKIM header injection attacks. [1] The suggestion to mitigate it is to oversign headers and to rotate any DKIM keys that were previously used to sign e-mails where not ...
- 208k
1
vote
0
answers
120
views
Can an email address attached to key be traced back to me? [closed]
I used my actual protonmail email address at the start of creating my own key. Can this email address be traced to me?
So when I sign something with my key and it's decrypted, can anyone see the email ...
CommunityBot
- 1
1
vote
2
answers
324
views
Using PGP in emails - is there to find the key?
Suppose both the receiver and sender use PGP. Suppose someone send from the sender an email and sent it to the receiver. Now he gets the content of the email at the receiver. Can he know now the keys ...
- 11
1
vote
1
answer
378
views
Where is the AES key of ransomware stored (in the file header/trailer)?
Advanced types of Ransomware generate, usually, an AES 128 bit key (used to encrypt files, some types of ransomware use a unique AES key for each file). This key is generated on the fly. In addition, ...
- 19.1k
1
vote
1
answer
811
views
can my isp read my emails or see whom i send/receive emails from?
can my Isp read my emails or see whom I send emails or receive emails from? i use rediffmail.com, Gmail and outlook.com for emails. All are https and I use cloudeflare dns.
- 208k
2
votes
3
answers
214
views
Is there a reason we don't first validate the email address before continuing with the registration?
Many websites and/or web apps require you to validate the e-mail address after registration.
Why don't we first validate the email address and then continue with the registration? Is there something ...
- 2,041
68
votes
6
answers
61k
views
My email address is being used to enroll for online services. Should I be concerned?
Just before Christmas I received the following message in one of my GMail accounts:
Sign-in attempt was blocked
********@gmail.com [redacted by me]
Someone just used your password to try to ...
- 1
0
votes
1
answer
649
views
Is Google mining the content of emails I send to people who use gmail? Could they?
If I sign up for Gmail I probably agree to give Google the right to use all my content for whatever purposes they want. We know they have incredible research going on into data mining and machine ...
- 24.1k
0
votes
2
answers
299
views
Why is it ok to send my lender an email, but not ok for them to send an email back?
My loan lender accepts emails from their customers. They share their contact details including their customer service email address on their website with the public. So, they apparently regard ...
- 132k
0
votes
0
answers
252
views
Why does the majority of email spam even exist? [duplicate]
This is a serious question and I have thought about it a lot. Not a newbie question. I am unsatisfied with the common answers
they try to sell things
they try to scam you
they try to do phishing
they ...
- 132k
0
votes
1
answer
28k
views
What exactly is a "Combo List", and why is this site providing them for free?
After asking for e-mail lists the other day, I got linked to this: https://combo-list.com/
This is a very strange "blog" which appears to be regularly publishing (or linking to, rather) ...
0
votes
3
answers
1k
views
Is my Hotmail compromised as many emails have been sent automatically?
There were hundreds of emails sent from my Hotmail account between 30 Aug to 1 Sept to many Hotmail and Outlook addresses with sECURED.shtml attachment of 764KB. Some emails were not delivered and ...
- 1,025
50
votes
4
answers
7k
views
Is URL rewriting in e-mail a sound security practice?
Our work e-mail server has started rewriting links in incoming mail through a redirecting gateway, for "security reasons": if I receive an e-mail containing a link to
https://security....
- 251
0
votes
1
answer
266
views
How to detect phishing emails in the future?
My main tactic (amongst others, see related questions) of how I detect phishing emails are through the use of the obviously wrong sender domain.
I see a trend that big companies start to use dedicated ...
- 101
2
votes
2
answers
730
views
Flattening an SPF record - drawbacks and downsides?
I have an SPF record that has too many DNS lookups. Consequence is some mail servers will silently drop emails; RFC7028 says that over 10 lookups:
SPF implementations MUST limit the total number of ...
- 522
7
votes
1
answer
2k
views
Can DMARC's SPF alignment be spoofed?
IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
- 12.1k
0
votes
1
answer
285
views
Forward messages without tracking pixels using thunderbird
Thunderbird does not load remote content by default, preventing pixel-tracking. However, if I forward an email, the links to remote content is still included in the forwarded email.
Is there an option ...
- 3,501
0
votes
2
answers
125
views
Is this a valid use case for email 2FA?
We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their ...
- 16
1
vote
0
answers
41
views
How to encrypt an e-mail to many recipients in an effective way? [duplicate]
Let's say we have an e-mail of 10MB, and we want to distribute this to 1000 users. Before sending the e-mail, I encrypt it. And all users have my public key to decrypt it.
What encryption method can I ...
- 132k
-1
votes
1
answer
190
views
Email and purchase order history
I have a common email (gmail, outlook, mail, etc) provider that I use to purchase from different merchants (amazon, target, etc).
Since some of these providers have had breaches before, do there exist ...
CommunityBot
- 1
6
votes
1
answer
845
views
Why is email 2FA not common?
SMS is a quite common, albeit insecure, 2FA method. Why is email not more common? If someone is using a computer, they almost certainly have an email address, while it is less certain that they have a ...
- 535
1
vote
1
answer
456
views
What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?
I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email.
It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
CommunityBot
- 1
0
votes
0
answers
94
views
Can code be executed from copying the From field of an Outlook Email?
I received a suspicious email in Outlook and wanted to check the from email field to see if it was still a Microsoft address.
I right clicked and selected "copy address" on the From field ...
- 1
1
vote
1
answer
779
views
Does S/MIME encryption encrypt with each recipient's key?
If I send an email through S/MIME protocol to a group of recipients, does the email client require to encrypt the same email content with each recipient's public key before sending to each recipient? ...
- 52.1k
1
vote
0
answers
80
views
What's the purpose of this spam that only sends a link to a Google search query? [duplicate]
I received the following email today which got caught by my spam filters.
<My username>
https://www.google.com/search?q= <my email address>
Rock_jim
Clearly this is spam, but I have no ...
- 132k
2
votes
1
answer
1k
views
Reasons why there are no web based unified email clients (with OAuth2)?
There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
- 2,285
3
votes
1
answer
5k
views
Can a plain text email contain XSS injection?
I need to send a plain text email with user-specified input.
For example, if a user is an attacker a plain text email can contain
<script>alert(1)</script>
It looks like mail clients ...
- 33
1
vote
3
answers
226
views
How safe is it for an app to trust a click on a link in an email?
In my question and answer application, Joe signs up, logs in and adds a question.
He then shares the question via email to his trusted friends.
How safe is it to provide a link within that app ...
- 2,285