Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
147
votes
8answers
23k views

How can PayPal spoof emails so easily to say it comes from someone else?

When I receive a payment in PayPal, it sends me an email about it (pictured below). The problem is that the email is shown to be coming from the money sender's email address and not from PayPal itself,...
11
votes
2answers
3k views

How to prevent email discovery in forms?

Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like ...
102
votes
5answers
62k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
22
votes
4answers
2k views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
23
votes
4answers
29k views

Why is it even possible to forge sender header in e-mail? [duplicate]

With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the e-...
6
votes
1answer
5k views

Email Spoofed. Explain?

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
37
votes
6answers
47k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. Attached to the email is a supposed HTML file. My first hunch was that it was probably one of the following: A nasty executable file ...
44
votes
2answers
20k views

What malicious things can happen when clicking on links in email?

I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it ...
86
votes
4answers
14k views

Is using 'dot' and 'at' in email addresses in public text still useful?

When entering your email address publicly, a practice is to replace . with text dot and @ with text at. I assume that the reasoning is that this way automatic email-collector robots won't match your ...
34
votes
4answers
20k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
75
votes
12answers
13k views

Is there any definitive way to tell if an email is a phishing attempt?

Is there any definitive way to tell if an email is a phishing attempt? What cues should the "average computer" user employ to detect a phishing email?
25
votes
3answers
5k views

How does Bayesian poisoning work?

This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it. The first case, where a spammer sends a spam with a payload (link, malicious ...
23
votes
7answers
17k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
19
votes
4answers
4k views

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
12
votes
3answers
639 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
27
votes
4answers
9k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
3
votes
4answers
1k views

What to do about email threats containing leaked passwords?

A few days ago I got an email from a hacker supposedly using an email of mine (he was using the same email address TO and FROM) from my own email domain, and had a part of a password I use to purchase ...
70
votes
6answers
22k views

Is gmail-to-gmail still insecure? Why?

I have always heard that email is an insecure method of communication; I assume this has something to do with the email protocol itself. But when sending an email from one gmail account to another, ...
37
votes
4answers
70k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
7
votes
5answers
13k views

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. Is ...
5
votes
1answer
454 views

Why set up DMARC for SPF if it's already set up for DKIM?

I have SPF and DKIM. I'm planning on adding DMARC to tell receivers to expect SPF and/or DKIM. I've read that it's best to set DMARC up with both SPF and DKIM, but I don't understand exactly when ...
5
votes
1answer
535 views

De-obfuscation of malicious javascript in spoofed eMail

Two days ago, I received a suspicious email. The sender was a mailing list, that i am a member of, but it originated from a webhosters subdomain (applegate.dreamhost.com). The content was roughly ...
36
votes
5answers
131k views

How to find out the IP address of email sender in Gmail

Gmail doesn't give the IP address of the sender in its mail headers for security reasons. I'd like to know whether there is some other way of getting the IP address of the sender. Since Gmail ...
20
votes
2answers
3k views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
20
votes
5answers
4k views

What are the supposed security benefits of a “dead-drop” email strategy?

This was in the news recently. Here's what they were said to have been doing: Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email ...
6
votes
2answers
9k views

Spoofing email From address

Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
29
votes
7answers
45k views

Is it still unsafe to email credit card number nowadays?

We all know not to do it, but someone emailed my credit card number and cvv code to my gmail. I'm wondering if the risk is so low I don't have to call to cancel my card. The email is sent from a ...
8
votes
1answer
8k views

How to determine if mail was encrypted during transport using the header information?

First things first: I know about the difference between end-to-end-encryption and transport encryption. Back to topic: I already read some things about how mail server handle transport encryption, e....
7
votes
4answers
3k views

Email header IP address

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
12
votes
3answers
1k views

Is it secure to have an “email no longer available” feature on your registration form?

I was just implementing a new feature on the registration form of my site that checks if an email address is still available to register an account with. I am wondering if it is secure to show a user ...
7
votes
5answers
4k views

How to detect self destructing emails? How to prevent from self destruction?

Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine Now my ...
12
votes
2answers
589 views

Is it dangerous to delete my email account?

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email ...
1
vote
4answers
12k views

How to trace email?

Is there any tool to trace all emails? I need to trace ip address and location of sender address.I also need to identify emails from fake address.
189
votes
3answers
35k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
111
votes
10answers
30k views

Why is it dangerous to open a suspicious email?

I would like to know why is it considered to be dangerous to open an email from an unknown source? I am using Gmail and I thought it's only unsafe to download an attachment and run it. The first ...
65
votes
6answers
11k views

What should a verification email consist of?

Right now I'm generating a 25 character string stored in the database that can only have a 1 time use and expires 30 minutes after user registration. http://example.com/security/activate/...
30
votes
6answers
20k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system "...
20
votes
14answers
15k views

Sending password reset links in email

Nowadays, when everyone tries to be more secure then each other, when companies spend billions on information security, it seems a little bit odd that the password reset left behind, the place that, ...
10
votes
6answers
7k views

How can I send emails anonymously?

How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous ...
13
votes
3answers
49k views

How to Stop Email Spoofing [closed]

Apart from SPF, what else can be done to stop hackers from spoofing your company's email addresses?
4
votes
3answers
12k views

How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages?

Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this: We considered your resume to be very attractive and we thought the vacant ...
3
votes
6answers
36k views

Possible ways to track down anonymous mail senders?

In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things ...
3
votes
3answers
9k views

Security of SPF vs SPF and DKIM in email

I am looking for an email provider that I will use with custom domain, one provider is cheaper but has only SPF while the other is more expensive but uses both SPF and DKIM and I'm not sure if paying ...
7
votes
3answers
702 views

Best practices for sending tax data to and from a tax professional

I started doing business with my tax preparers when we all lived in the same city. Recently I moved to a different state. I requested that they send my "Tax Organizer" which contains some personal ...
6
votes
3answers
1k views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
7
votes
2answers
2k views

spam with my own domain

At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spam mails from our own domain. This is obviously very prejudicial for us, because many ...
26
votes
0answers
5k views

Email from a hacker with my password [duplicate]

I have received an email from a hacker saying he got my email account password. The password showed in the mail is not my account password but is a password I use sometimes. I checked haveibeenpwned ...
5
votes
2answers
655 views

How might an email do damage merely by being opened?

E.g. http://www.dailymail.co.uk/sciencetech/article-2094982/Threat-new-virus-infected-emails-PC-DONT-open-attachments.html?ito=feeds-newsxml Assuming that the user clicks no links and opens no ...
2
votes
2answers
517 views

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither DKIM or SPF passes. ...
1
vote
2answers
1k views

Issues with using a mail server that doesn't support authentication to send mail?

I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through. I understand you easily spoof sender address' in emails, but I'm ...

1 2 3 4 5