Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
0
votes
0answers
53 views

How to detect a spoofed email with Outlook Web Access?

I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program. Within Outlook Web Access, is there a way to tell whether or not an email ...
0
votes
3answers
621 views

How much risk by sending id and card via email?

I sometimes have a little fun playing bingo, through an online casino. A few weeks ago I won a fairly decent sum of money (£1509). The casino is now asking for verification details (photocopy of ...
0
votes
1answer
158 views

Prove a received mail came from a company email when company is tampering on their side

X works for EvilCorp and he sends a whistleblowing email to HR. HR responds with "we will look into it". But management takes advantage of having control over X's PC and all email addresses and ...
1
vote
3answers
338 views

Why would a scammer not reply with the same email?

I was recently messaged over a website of an online marketplace regarding an advertisement of an item I was selling, whereupon the "buyer" asked me to contact them over an email they provided. After ...
0
votes
1answer
90 views

Block SMTP Connection That Doesn't Have Credentials

I am able to do the following and connect successfully without any type of credentials: telnet <IP Address> 25 When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
1
vote
1answer
489 views

caught email exploit attempt — info requested — mail to root+${…}@host [duplicate]

I received an email to the address below that is an apparent exploit attempt. Does anyone have details about the specific exploit so I can make sure I am patched/not exposed: root+${run{...
2
votes
1answer
155 views

Is there a name for using a web site email feature to harass someone or the site?

The scenario is that a website has a password recovery feature: you enter your email and if you have an account with that email, it sends you a recovery link. But then someone writes a script that ...
1
vote
1answer
47 views

Difference between local and central anti-spam

I'm attending a web security course whose slides, concerning techniques for protecting ourselves from spam, sometimes report the expressions "local anti-spam" (or "personal anti-spam") and "central ...
1
vote
1answer
40 views

Which benefits personal anti-spams bring w.r.t. e-mail provider's ones? [closed]

Assuming that an e-mail service provider is using an excellent anti-spam software, for what reason its users should employ a personal anti-spam?
1
vote
2answers
101 views

Does DKIM protect the whole body message?

From RFC6376 #page-29, it says: In hash step 1, the Signer/Verifier MUST hash the message body, canonicalized using the body canonicalization algorithm specified in the "c=" tag and then ...
0
votes
3answers
985 views

Metadata-free Email: How can SENDER directly, anonymously, and securely ask RECIPIENT’s mail provider to deliver a metadata-free email?

If I want to send emails to friends who use Google, Yahoo, AOL, etc., how can I currently use my local email client to send a metadata-free* email to them? E.g., is it possible to bypass my own mail ...
9
votes
4answers
6k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
0
votes
1answer
143 views

Spam/Phishing detection when there is no MX record

While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails? How do spam or phishing filters treat emails ...
1
vote
1answer
78 views

What are the risks of redirecting my email with Google Domains?

I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
13
votes
3answers
49k views

How to Stop Email Spoofing [closed]

Apart from SPF, what else can be done to stop hackers from spoofing your company's email addresses?
0
votes
1answer
265 views

Why is my website getting spammed? [duplicate]

Does anyone recognize this type of spam? NAME: Bagas EMAIL: dq95zxm7l@gmail.com PHONE: JCBUIR6ulwtO COMMENTS: I must express apaotcipeirn to the writer for bailing me out of this particular ...
17
votes
5answers
5k views

Hashcash, is this really used?

I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
2
votes
1answer
105 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
3
votes
2answers
156 views

How this tracking (and more) was done using an image in an email?

As reported in the NY Times, there was some type of electronic spying in a high-profile military trial. Its claimed that the prosecutors were spying on the defense: The court-martial ... has been ...
3
votes
4answers
571 views

Do mail servers follow links in emails as part of a security scan before inbox delivery?

I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
1
vote
1answer
177 views

If someone has my email address can they get my IP address?

I'm being stalked and the stalker is a hacker. If he gets my new email address can he get my IP address from it?
0
votes
1answer
78 views

Should I send login id on email?

I have a very common use case where an admin is creating an account of the user and then I need to send the login id generated by my system to the user. And the user will need to set a password on the ...
3
votes
1answer
63 views

Securing email input from users

Consider the following strawman application, which remembers your TODOs. Application has a destination email "todos@todosaver.com" Users (already registered through normal means) send emails to the ...
0
votes
1answer
183 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
1
vote
3answers
5k views

Can I spoof email?

I mean, if I would have my own SMTP (also, is it just about money or are there some limitations to running my own SMTP server?) and would just completely made up the mail (headers, spoofed IPs and ...
1
vote
1answer
83 views

Disturbing Notification

I received an E-mail notification a couple of days ago welcoming me for signing onto Stockholm Arlanda Airport's wifi network. My wife and I have never been to Stockholm. I asked my neice's husband ...
0
votes
1answer
268 views

DMARC “policy_evaluated” is “fail” for SPF, even when SPF domain alignment is “relaxed”?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
0
votes
1answer
134 views

Probable hack: email “from” names being corrupted

Something very weird and troubling started happening on my wife's Gmail account today. She received an email from G. Arnold, who is a regular correspondent, but in her inbox it showed as being from "...
1
vote
1answer
138 views

Phising test failed e-mail to my personal account, how does this scam work?

I've recently gotten a pair of "User Selkie has failed the phishing test" emails to my personal account. The email has no other information, no links or anything, and while I'm not going to respond to ...
12
votes
2answers
2k views

Cannot understand supposed ProtonMail vulnerability from wired.com article

Currently I'm reading an article about ProtonMail here and I don't understand it. Now let’s address ProtonMail’s weaknesses. One of the big issues is that it isn’t easy to know whether a message ...
0
votes
1answer
815 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
0
votes
2answers
125 views

ML approach to malicious attachments using email contents

Based on my understanding of the field, it seems like there is a lot of attention paid to spam filtering based on the contents and metadata of an email, and there is considerable attention paid to ...
21
votes
7answers
8k views

Unexpected email from Yorkshire Bank

I have started receiving unexpected emails from Yorkshire Bank. I have never been a customer. I don't recall applying for any of their products either, although maybe I did many years ago. The ...
1
vote
1answer
72 views

What accounts for file accessed immediately after including link in Gmail?

Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient. ...
-1
votes
1answer
331 views

Received ransom email containing my password. How did they get my password?

Finally, even I got the fabled ransomware emails we've all heard about so much. First, let's look at the facts before I get to my question: I use Mozilla Thunderbird as my email client. I was ...
-2
votes
1answer
281 views

Email not considered a secure form of communicate for legal / government purposes - why? [duplicate]

Ive seen the below statement on lots of legal and government documents over the years. Im based in the UK, but presume similar statements are made elsewhere. [In relation to communicating with ...
0
votes
4answers
179 views

Suspicious Entry in DMARC Report

I recently contacted a vendor of security-related development libraries to ask for a quote (I won't name them yet). The next day, Postmark sent me my weekly DMARC report - and it contained 2 failed ...
81
votes
5answers
14k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
2
votes
2answers
150 views

Website customer e-mail collection form getting spammed, why and what to do

I am the webmaster for my girlfriend's page where she advertises her services as an online tutor. The webpage has a simple PHP post form, using which the visitors can leave their e-mail addresses to ...
25
votes
3answers
16k views

Can I Retrieve Email Addresses from BCC?

How can I unmask the e-mail addresses in a Bcc field when I am just a recipient? Need very simple, step-by-step instructions for someone who doesn't code. I have received a group e-mail and would ...
1
vote
2answers
1k views

How to test if TLS is enforced for emails sent through SMTP? [closed]

We are planning to create a rule in Proofpoint to enforce TLS on all outgoing email. I need to test that the rule is working and emails are bouncing if the recipient SMTP server does not support TLS. ...
1
vote
2answers
1k views

Is it possible to fake the mail server address?

Suppose that I send an E-mail to someone. Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I ...
1
vote
1answer
52 views

Reading the MailWatch interface - 'From' address

We often get emails blocked that have confusing sender addresses. This is always the scenario: a message marked as spam says this in the actual headers: "From: "Bob Jones" some.normal.address@domain....
3
votes
2answers
136 views

Email verification by sending mail instead of receiving

I have an app whose main purpose is to help people track emails they send. In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret. ...
33
votes
4answers
36k views

Microsoft email servers “require remote control of Android device security features”

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
1
vote
2answers
106 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
1
vote
0answers
75 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
43
votes
8answers
9k views

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when ...
-5
votes
1answer
200 views

A safer way to read emails on Android devices

I've been trying to think of a safer way to check the email on an Android device. Android devices are generally very insecure, and therefore they should not be trusted for anything serious. Here are ...
1
vote
2answers
297 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...

1 2 3
4
5
30