Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
0
votes
2answers
136 views

Why isn't there a protocol to exchange PGP keys?

Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters? I imagine a quite simple process like other established ...
0
votes
1answer
48 views

Does having secondary email for 2FA increase security

Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online ...
0
votes
0answers
35 views

Mailto links / Calendar ICS [closed]

I received an email in Outlook from someone I used to be in a Microsoft Team with. I am pretty sure this guy is a security geek and we fought before and we talked about hacking each other. I got this ...
1
vote
1answer
74 views

Postfix pickup daemon "from:" verification

I was surprised to notice that sending email from a local server account allows any user to send a message with: From: whatever@whateverdomain This is a security issue, because it allows identity ...
0
votes
4answers
120 views

Is exposing email delivery failure to a user a security risk?

Case 1: When user creates an account, a confirmation email is sent. Case 2: When user invites a coworker to his/her account, an invitation email is sent. Problem: If a user makes a typo in the email, ...
6
votes
4answers
7k views

Is a safelinks.protection.outlook.com link phishing?

Received an email which contain the below hyperlink https://nam02.safelinks.protection.outlook.com/?url=http*3A*2F*2Factuallysale.com*2F&data=02*7C01*7C*7C548d20ace3ec4747fe1008d7d7d8b597*...
-1
votes
1answer
50 views

Does gmail use SPF or DMARC when sending messages outside of gmail?

I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server. Does gmail use SPF or DMARC when sending messages outside of gmail?
0
votes
0answers
10 views

When sending email to Gmail address from netcat or openssl s_client, why do I get "Username and Password not accepted", despite correct credentials [migrated]

My goal was to send an email to a gmail address, like beta@gmail.com from a commandline tool such as netcat or telnet etc. WHAT I TRIED: I first tried netcat. nc -C smtp.gmail.com 587 220 smtp.gmail....
1
vote
2answers
68 views

Automatic OCR Document Capture Security Risks

We have recently implemented an automated OCR, email scanning program that connects to our exchange email service, This service will open attached invoice and insert them into our accounting software ...
0
votes
3answers
107 views

Sending Mail from Different Server SPF Record

Firstly, i'm not a mail expert! My workplace owns the domain example.com, until recently we had an application hosted on the LAN that worked fine and sent emails from info@example.com to various ...
0
votes
1answer
117 views

Is there any security risk in sending a dangerous file via email to oneself?

Most common email services don't allow to attach file like exe files, or similar files that may contain security threats to a computer. This can be bugging for users, but I can understand that, in ...
0
votes
3answers
121 views

Is it safe to open email links in a private window?

Sometimes there are links on the email you have to click because they are agrements, but they are coming from a different URL. As of now what I'm doing is opening a private window and pasting the link ...
0
votes
1answer
77 views

Is there a way to know when someone tries to guess your gmail password?

Is there a way to check if someone is trying to login to my Gmail account without knowing the password (so they keep trying to guess the password and failing repeatedly or trying to guess the answers ...
1
vote
1answer
208 views

Where can I find sample DMARC failure reports?

I want to automate ingestion of DMARC failure reports, both aggregate and forensic. Unfortunately, I don't have a mailbox set up to collect them yet. Does anyone know where I can find sample DMARC ...
0
votes
1answer
79 views

Company sent me a registration email with a clear text password [duplicate]

I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
1
vote
2answers
70 views

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
0
votes
2answers
499 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
-2
votes
0answers
46 views

Does Microsoft Authenticator for webmail login provide any security improvement? [duplicate]

Two Factor Authentication is a security scheme that requires authentication of different kinds, frequently something you know and something you have. For example, your ATM Card is something you have ...
0
votes
0answers
60 views

How many emails and accounts an organization's administrator and developer should have?

Let's say there is a small organization called "Example" with the registered domain "example.com". There is a person, Bob, who has full control over the organization's GitHub ...
3
votes
1answer
164 views

Nonprofit organizations asking me to email them a photo of my driver's license

Recently I've had two nonprofit organizations ask me to email them a photo of my driver's license. No money is changing hands, and both of these are legitimate and well-known nonprofits. Organization ...
0
votes
0answers
53 views

How to detect and prevent phishing attacks on Gmail via Logging and DLP?

We did a phishing engagement on a client both payload and credential phishing. The first was using shortened file sharing links (including Google Drive) of our payloads and the second was a duplicate ...
0
votes
0answers
54 views

Confirm User Account Without Exposing IP of Server?

Right now, when a user signs up for a new account on my site, the server sends the user a email verification link. When the user clicks the verification link, the link redirects to my server to ...
0
votes
0answers
47 views

Account enumeration on verification-less signup

Is there a way to prevent account enumeration on signup page if access to the site is not requiring you to verify your email? The scenario is as following: Sign up for a site with email+password, but ...
1
vote
2answers
102 views

Do fowarded emails retain DMARC protection?

Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
0
votes
2answers
178 views

Why are there so many special characters in this phishing link?

I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd: The link that victims are supposed to click looks very weird ...
-1
votes
2answers
137 views

Is it Safe to Rely on Gmail API to Reward Users for Placing Orders on Merchant Sites?

I have an application that rewards users for placing orders with certain merchants. In order to verify that the order was actually placed and delivered, a user is required to grant us read access to a ...
4
votes
2answers
444 views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
1
vote
2answers
74 views

Inbox filling up with "confirm your registration" emails - what kind of attack is this? [duplicate]

My google inbox is filling up with hundreds and hundreds of "please confirm your new account on our website" messages. A coworker reports he had the same thing happen to him a couple of ...
3
votes
1answer
199 views

Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?

Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
0
votes
2answers
96 views

Can you trust a VPS service not to log data?

Like the title says, can you trust a VPS service not to log any data? Is creating your own email server with a VPS service really a private solution?
5
votes
2answers
16k views

What is the point of spam mails containing nothing but random letters?

I recently started replying to spam (as proposed by James Veitch), logged into an old email account and noticed (much to my delight!) a couple of hundred spam mails. Oddly enough I stumbled upon an ...
1
vote
1answer
389 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
0
votes
1answer
81 views

Email server compromise?

My company sends around 1M emails per month through various providers (Sendgrid etc.). One of emails we send is a "sign up" email, which contains a link for a user to finish registering ...
0
votes
1answer
120 views

Is an owned domain + self hosted email the closest to owning one's online identity? Are there better alternatives?

Most online accounts identify users using email/phone & password; but since most all email/phone is handled by another service (e.g. Gmail), one's online identity only exists so long as these ...
6
votes
2answers
9k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
0
votes
0answers
43 views

How can you tell if an email is really from the address it claims it's from? [duplicate]

I am creating a basic website contact form. It requires entering a 'from' email address. I entered a dummy email address, which I do not control, yet the email is still sent, and, to the recipient, it ...
0
votes
2answers
50 views

Sending password in separate email [duplicate]

I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
0
votes
1answer
127 views

My IP Address is on 3 blacklists

I noticed my email address (my email address is through a web host where I also host my website) was being bounced from one or more professional email subscriber lists. Through MX Tools I see that my ...
0
votes
4answers
139 views

How to protect email addresses in a customer database when you and other third parties must be able to send emails?

I am wondering what methods are used by big companies to protect customer email addresses in their databases. They usually have salespeople all over the world and multiple third-parties (Salesforce, ...
1
vote
2answers
3k views

Is spam more likely to be sent to info@example.com? Would I be better off using a different address?

I think that when bots gather domain names or process a list of domain names, they create email addresses like info@example.com or support@example.com. Does selecting something different help to ...
0
votes
1answer
121 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
15
votes
3answers
2k views

How can you prevent email addresses from being harvested from a registration form?

When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages: Your email is wrong Your password is wrong Your email or password is wrong ...
0
votes
1answer
136 views

Emails being sent to strange addresses

I use Yahoo Mail from Android devices. In my Sent box over the last few weeks I see a handful of completely blank e-mails (no subject and no contents) being sent to very strange addresses such as: ...
0
votes
1answer
461 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
4
votes
1answer
1k views

What is the security purpose behind the "enable editing" of MS Word?

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default. As per my understanding, the hyperlinks used in the main document would be linked ...
0
votes
1answer
130 views

Should I use my own domain in my proton mail?

Using my own domain on Proton Mail is cool, but what if someone hack my namecheap account? What if some government orders that my domain is redirected? Should I use @protonmail instead of @mydomain? ...
1
vote
1answer
206 views

Force specific encryption cipher for S/MIME mails

I have a number of contacts who can only decrypt 3DES, when it comes to S/MIME encrypted mails. I'm aware that this is by far not ideal, but better than no encryption at all. My problem is, that I ...
2
votes
2answers
88 views

Protecting bare text / link email address published in a website

I have an all-core MediaWiki website; no addons, no forms besides a login form (not even a contact us form); the MediaWiki installation is continuously upgraded and everything is quite minimal and ...
1
vote
2answers
119 views

How to check if a mail server is Enforced-STARTLS rather than Opportunistic-STARTTLS?

This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
0
votes
1answer
321 views

Is this is phishing attempt?

I received an email, purporting to be from Microsoft Account as a Security Alert. The address looks legit (account-security-noreply@accountprotection.microsoft.com) but the problem is, the email ...

1
2 3 4 5
33