Hot answers tagged

10

They may be able to tell that you have read it, but they shouldn't be able to get your IP address. Since 2013 Gmail has proxied images through their own servers, so "tracking pixels" will only get the IP of the Gmail server. This only applies to the web client though (and I believe Gmail's official smartphone apps do this as well, but I haven't tested). If ...


4

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed to suir such systems would probably be even more effective. The users of such networks would be used to using all kind of alternative ways to refer to urls. ...


3

DMARC fails since the sender domain according to the From field of the mail header is different to the sender domain in the SMTP envelope (SPF validation) and different to the domain given in the DKIM signature. This means there is no alignment of the From domain with a valid DKIM or SPF - but such an alignment is required for DMARC to pass.


2

This isn't a good idea. First of all, "somewhat inconvenient" is a huge understatement. Also, AviD's rule of usability applies here: instead of URLs that computers understand, you'll have instructions on how to type in a URL, which will foil the ability of email scanners to detect that the URL goes to a phishing site.


2

Using an asymmetric encryption. Create a public/private key pair. Share the public key in chat Now someone can send data to chat encrypted with your public key. Data can only be decrypted with your private key no body but you can read it.


2

When you Enable Editing or Enable Content, you enable any macros embedded in the document to run. An attacker can embed VBA (Visual Basic for Applications) macros in the document, which is really just a generic programming language. With it they can access information about your computer, access resources like the network, and get malicious code like a ...


2

To "Option (2) doesn't even ask for his current password": I don't understand how can it be. To request password change, user has to log in into his profile. For this a password is required. May be you mean that user doesn't use master password in the password manager and effectively log in without entering any password. If this is your case, then you are ...


1

You have an argument for yes as the default, but you will have to go to the ICO/court if someone wants to challenge that. As the case law for GDPR is very thin on the ground, you are potentially the test case, which is a bad place to be. If it goes to court, it will cost time and money. Even if it doesn't get to court, you will be paying lawers so it will ...


1

Compromised Email Accounts Unfortunately it is clear that your mail systems have been compromised. That's the biggest take away here. If your emails are never reaching the customer then at some point in time someone gained (and probably still have) access to at least the alice@mycompany.com email, if not your entire email system. There's an important ...


1

I don't think that there is a standard way that this type of fraud is perpetrated, but I can tell you what I have seen and what I do when this happens to us, when about once every two months we get "change my bank account" emails sent to suppliers "from" our mail systems. Our first thought is that the scenario didn't happen and that we have fraudulent staff ...


1

The problem that i see with your question is that both the threats that you talk about in option (1) & option(2) are the threats where an attacker has physical access to your system.When you are developing a web application this is not the threats you should be worried about. Always remember:- If an attacker has physical access to your device.Its not ...


Only top voted, non community-wiki answers of a minimum length are eligible