Hot answers tagged

6

Should user invite links expire at all - if so, what would be a good expire time? That is a question that doesn't have a general answer: it depends on the value of the resource you're protecting, who are the people receiving your invitations, how secure is the channel you use to transmit these invitations and what are the threats you're trying to protect ...


3

Consider counting only business days If you're worried about vacations and holidays, consider excluding weekends and holidays from your counting. This might be difficult if your users are spread across different nations, but I think there's value in counting business days rather than standard days. Ten business days is three weeks, which should be pretty ...


3

Of the two main forms of email tracking, remote content has easier protections. Many email clients allow you to turn this off. You can test your email client settings here: https://www.emailprivacytester.com Click tracking is harder to avoid. There may be some trackers that allow an after-the-fact "opt out", but that's risky and is not likely to allow you ...


2

Many mailers use the mailto trick where one needs to send an email with "Unsubscribe" in the subject to unsubscribe. Create a mailto link in your newsletter. Perhaps add a body with some text telling the user that sending this email will unsubscribe them from the newsletter. <a href="mailto:newsletter@example.com?subject=unsubscribe">Unsubscribe</...


2

You need to sanitize the content before embedding it in your HTML output, otherwise you are guaranteed to have XSS vulnerabilities in there. Please do not reinvent the wheel, as there are great sanitizers out there, that you can utilize. I highly recommend using DOMPurify, which is also integrated in several widely used JS frameworks to reliably protect ...


2

The IP that the email service uses would be blacklisted, not the domain. This affects the service more than your company, which is why they tend to have very strict controls and procedures. It does mean, though, that if you depend on that service, then you will be impacted by your emails not getting out if sent through that service.


1

If there is a legitimate use case that triggers a status code 500, there is little you can do to prevent someone from doing just that. Of course you can add some logic to the website, resulting in the ban of an offender (e.g. identified via source IP address) after triggering a status code 500 too often in a defined amount of time, but finding a suitable ...


1

You are focusing too much on the From: address performing background checks against the person. While Mike Ounsworth's answer gives an example on how this could be done with legitimate mail, it doesn't explain that anyone could use any email address in the headers (unless properly protected with DMARC). It's just like a letter: you could fabricate it. ...


1

Question 1: What is the goal of such an exploit? This seems like a standard phishing attack to me. I'm sure if you reply, you'll get told some story about how you've won a grant, and they need your back details do to "deposit the money". Typical scam stuff. Question #2: How does it work? Sending an email-from-yourself-to-yourself is a common trick using ...


1

It's working as same as the normal and business emails work. But these emails are mostly used for temporary access. Fake emails generate temporary emails for us to get access to accounts like Facebook etc.


1

I know of several defenses to this issue that are typical of subscription management systems: List-Unsubscribe headers are not added to inline-forwards, so those links are safe List-Unsubscribe-Post headers (RFC 8058) specify a single-click unsubscribe, also safe mailto: links are email, so it's safe as long as you respond from a subscribed address Reply-...


1

The simplest solution (and this is the most common implementation, in my experience) is to send another email after the unsubscribe link is followed. That email might either be "click to confirm unsubscribing" or "click if you unsubscribed by mistake (or it wasn't you) and wish to undo it". However, this is only making a minor security vulnerability (...


Only top voted, non community-wiki answers of a minimum length are eligible