Hot answers tagged

48 votes
Accepted

Is there any security benefit from emailing a "secure link"?

It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
user avatar
  • 4,096
13 votes

Is there any security benefit from emailing a "secure link"?

The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and ...
user avatar
9 votes

Is there any security benefit from emailing a "secure link"?

Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have ...
user avatar
4 votes
Accepted

Can a plain text email contain XSS injection?

No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit. (*HTML attachments opened in web browsers can trigger XSS ...
user avatar
  • 9,256
1 vote
Accepted

Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?

First, it's good to spell out the problem that you're trying to solve. Then you can determine if an authentication token is necessary and what it needs for proper security. To prevent user ...
user avatar
  • 9,256
1 vote
Accepted

How would you counter an email/honeypot mischief scenario?

This is called list bombing. If your server is facilitating a list bomb, that is indeed your fault. Put safeguards on your website to avoid abuse. For example, no single IP should be able to input too ...
user avatar
  • 9,256
1 vote

Why certain sites don't send newsletters to "anonymous" mail addresses?

This unfortunate situation isn't really infosec issue, but rather: (a) marketing issue - They want your real e-mail address to report smth like "We have N subscribers and attracted M more last ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible