All Questions
1,860 questions
4
votes
0
answers
499
views
Best practices for GPG user ids and mail extensions / catch-all addresses
Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
- 93
0
votes
1
answer
405
views
Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?
I'm writing a mailing list manager program. For subscribing and unsubscribing, I'm considering using HMACs of email addresses with secret keys to generate unsubscribe links. This key would be ...
- 12.1k
-3
votes
2
answers
1k
views
Are these statements about encrypted emails correct? [closed]
Are the following three statements more or less correct:
To send someone an encrypted email basically entails having access to their public key (either smime or pgp). Thus for all practical purposes ...
- 132k
1
vote
2
answers
431
views
Why certain sites don't send newsletters to "anonymous" mail addresses?
I use an "anonymous" mail address (cock.li provider in my case). I have found that mainstream news sites in particular don't send their newsletters to such an addresses. It looks like the domains ...
- 173
32
votes
5
answers
7k
views
Is there any security benefit from emailing a "secure link"?
Sometimes I receive email messages from organisations I'm involved with saying something like:
Alice at AnyCo has sent you a secure message
Along with a link to access said message. Sometimes I'm ...
- 773
1
vote
1
answer
235
views
Reset password parameters to send
I'm building a web app in Node.js, Express, and Mongoose. I'm worried about security and optimization issues on what to send in the email link.
I see many of them sending: /:userId/:token, but if I ...
- 107
0
votes
1
answer
152
views
How would you counter an email/honeypot mischief scenario?
I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
A rogue party (a competitor) performs sign-...
- 12.1k
0
votes
1
answer
221
views
Email TLS coverage for forwarded recipient email address
When an email recipient server (say server-A) is configured to forward to another email addresses (on say server-B), is TLS applied all the way up to server-B, or does it end at server-A, or something ...
- 103
49
votes
8
answers
12k
views
HTTPS is widely adopted, why isn't encrypted e-mail as popular?
I don't have an education in computer science, I've just become interested in information security and encryption lately.
I'm struggling to understand why encrypted web browsing using HTTPS has been ...
- 24.1k
1
vote
2
answers
291
views
Using Google Domains' Email Forwarding Service for throwaway accounts and other things
I registered my current web domain (masonbitbyte.dev) with Google Domains and one of the offered features is an email alias / forwarding service. I can create over 100 email addresses on my domain (...
CommunityBot
- 1
2
votes
2
answers
4k
views
Can emails not actually sent by me appear in my "sent" folder?
I have an outlook account (was hotmail).
I see some suspicious emails in my sent folder, to unkown both in the Thunderbird client and in the Outlook web client, which I did not send.
I already ...
- 101
0
votes
2
answers
1k
views
Does my receiver have a public key for email encryption?
I'm using an email service with encryption option and I need to send an encrypted email. So if I need my letter to be sent encrypted, I need to take my receiver's public encryption key and apply it to ...
- 11
0
votes
2
answers
341
views
How can I receive a (spam) email from an unknown email address?
When you receive an email, most email programs will display the sender as a name (chosen by the sender) and hide the actual email address behind it. Spam emails often abuse this by sending mails from ...
- 132k
12
votes
2
answers
2k
views
Cannot understand supposed ProtonMail vulnerability from wired.com article
Currently I'm reading an article about ProtonMail here and I don't understand it.
Now let’s address ProtonMail’s weaknesses. One of the big issues is
that it isn’t easy to know whether a message ...
- 5,507
1
vote
2
answers
174
views
Automatic OCR Document Capture Security Risks
We have recently implemented an automated OCR, email scanning program that connects to our exchange email service, This service will open attached invoice and insert them into our accounting software ...
CommunityBot
- 1
25
votes
5
answers
10k
views
How could a scammer know the apps on my phone / iTunes account?
I received an email with the subject "Your invoice from Apple #xxxxx".
It then continues by: "[...] your payment from "Pokemon Go was accepted [...]". That line made me sceptical. I just downloaded ...
0
votes
1
answer
2k
views
Making a phishing link look innocent
Situation
I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading ...
- 116
4
votes
3
answers
2k
views
What is the security purpose behind the "enable editing" of MS Word?
Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default.
As per my understanding, the hyperlinks used in the main document would ...
- 1
-1
votes
1
answer
121
views
What might happen if you post a local URL?
To show something in a forum you capture a page of an email service after logging in; but using MS Paint you erase the titles of the inbox as well as your name. Only the following information is shown
...
- 151
0
votes
2
answers
939
views
Is the text of an email subject line a softer target for surveillance than the text in the body?
After using PGP for a long time I have trained myself to write bland email subject lines that disclose little or nothing about the contents.
Some people I correspond with unencrypted have an annoying ...
- 484
-1
votes
2
answers
615
views
How to check the authenticity of an outlook email attachment (.msg)?
let's say that someone sends me a business email on Microsoft outlook 365.
I save the email as an attachment (email.msg)
How a third person can make sure that the email attachment is not edited (...
- 12.1k
1
vote
1
answer
4k
views
Is it safe to use AnonAddy or SimpleLogin for email address security?
I was intrigued with AnonAddy and SimpleLogin. They provide an email address forwarding service to prevent leakage of your real email address.
I just want to ask if they really hide my real email ...
- 1,346
2
votes
3
answers
208
views
Protecting bare text / link email address published in a website
I have an all-core MediaWiki website; no addons, no forms besides a login form (not even a contact us form); the MediaWiki installation is continuously upgraded and everything is quite minimal and ...
CommunityBot
- 1
3
votes
3
answers
2k
views
Can Google Chrome read/scan my ProtonMail inbox page?
If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
- 1
2
votes
2
answers
2k
views
Cipher suite choice on macOS on Apple Silicon
I have a postfix mail server that accepts these cipher suites:
tls_high_cipherlist=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:
ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
...
- 767
6
votes
3
answers
2k
views
Better safety: Webmail or POP3/IMAP email client?
Which offers a higher level of safety: Webmail or using a POP3/IMAP client?
Assume the following for webmail:
Access via HTTPS
Rarely downloading any attachments, but in cases where it may be ...
- 111
0
votes
1
answer
377
views
Virus from Embedded Image in Mac Mail?
I'm using macOS High Sierra, and mac Mail version 11.3. I have a script that uses the Twitter API to continually fetch tweets in real-time and send the contents of each of these tweets, including any ...
- 12.1k
1
vote
1
answer
6k
views
Can you get virus from previewing email attachments in Gmail?
If an email attachment such as .docx, jpeg, .xls, .pdf, etc. contains virus/malware and if I open it for preview (not opening it in Google Docs or downloading it and opening it) then can I get ...
- 1
0
votes
1
answer
152
views
Suspicious ip address of our mail domain found on talosintelligence.com (spoofing attempt)
We have a fair amount of email traffic. Recently, we had some suspicious email spoofing attacks and a lot of users reported that outgoing emails were marked as spam and landed in junk folder (reported ...
- 12.1k
6
votes
4
answers
2k
views
What to do about email threats containing leaked passwords?
A few days ago I got an email from a hacker supposedly using an email of mine (he was using the same email address TO and FROM) from my own email domain, and had a part of a password I use to purchase ...
- 67.3k
1
vote
0
answers
25
views
Email supposedly from the future mentioning fairly recent password [duplicate]
Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
- 11
7
votes
2
answers
4k
views
Is there a way to bypass click-tracking links in emails?
Most newsletters that I receive use mass-mailing software that rewrites links to add tracking information. That is, instead of www.google.com, the email will point to something like links.somecompany....
- 173
1
vote
1
answer
248
views
Is authentication through mail clients safe when encryption is off?
When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below).
Is the password safely sent through the internet when ...
- 13
1
vote
0
answers
468
views
iOS (iPhone) S/MIME certificate with multiple addresses
On an iPhone I have a mail account in the native Mail app with two distinct e-mail addresses, and a certificate that lists both of those e-mail addresses in the SAN field. When I try to send mail with ...
- 11
1
vote
0
answers
108
views
Is there a standard for fencing email domains to specific use cases?
To my knowledge, there's no common standard for sysadmins to publish trusted domains for specific use cases.
If it exists, I would presume that this might limit phishing attacks. Think of my question ...
- 195
6
votes
1
answer
24k
views
How would google know someone has the password for my web host email?
I received a confusing email from Google today. It had the subject 'Critical security alert' and the body said in part 'Google has become aware that someone else knows your password, and we've taken ...
0
votes
3
answers
24k
views
Tracing an email's MAC address
Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried ...
- 132k
0
votes
0
answers
395
views
Is it inappropriate at all for someone in my client organization to email their PEM file to me?
I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
- 11.6k
8
votes
4
answers
9k
views
How can hackers guess passwords (using dictionary attack or brute force) without being locked out?
Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords?
I am just wondering because in case of multiple wrong ...
CommunityBot
- 1
-1
votes
1
answer
176
views
Automated malicious links delivered with e-mail (Reddit, LinkedIn, Package) [closed]
Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc....
- 383
36
votes
7
answers
15k
views
What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?
I've been learning about PGP, and I asked myself, "Why?"
For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used?
I can ...
- 111
1
vote
1
answer
195
views
Suspicious hyperlinks (all hex URLs) in e-mail
I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
- 132k
0
votes
1
answer
113
views
Who is accessing my pop3 email accounts? [closed]
Recently I started receiving "Third-party application access to your Zoho Account" warning emails from Zoho.com regarding my Zoho email accounts, saying things like:
We noticed a third-...
- 11.6k
5
votes
6
answers
137k
views
Is it possible for someone to see under the "blacked out" part of this image (see below)?
Ok, so I sent some pictures to a journalist to report something I thought was noteworthy.
However, one of the images contained my date of birth and other personal information so I blacked it out ...
- 23k
0
votes
1
answer
3k
views
How does this scam email from a seemingly legit domain work?
I received a strange email from [email protected]. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
- 11.6k
9
votes
2
answers
1k
views
Apart from the lack of native Outlook support, why should one prefer S/MIME over PGP/MIME for email?
From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
- 764
0
votes
1
answer
657
views
How did the email pass DKIM?
I am trying to figure out how this one phishing email (used our Company's domain as from) was able to bypass the O365 Spamfilter.
Looking at the Header it looks like they passed the DKIM even though ...
- 12.1k
13
votes
3
answers
3k
views
How does ProtonMail manage search?
There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and
sends it encrypted in some fashion (depending on what email service the recipient ...
- 141
0
votes
1
answer
115
views
Am I compromised if Microsoft can identify me without browser content? [closed]
I am using Windows 7 and I had to re-install Chrome recently.
In doing this, once I had deleted my browser history and used BleachBit, I told my email server (Outlook) what email address I was ...
- 101
2
votes
2
answers
1k
views
TLS downgrade attacks
I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
- 24.1k