New answers tagged

4 votes
Accepted

Can a plain text email contain XSS injection?

No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit. (*HTML attachments opened in web browsers can trigger XSS ...
user avatar
  • 9,256
1 vote
Accepted

Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?

First, it's good to spell out the problem that you're trying to solve. Then you can determine if an authentication token is necessary and what it needs for proper security. To prevent user ...
user avatar
  • 9,256
0 votes

Is there any reason to not use my real name in my email address?

Well there is always an argument around displaying personal information in a public sphere. I would say this... It easier for threat actors to get a hold of your email since its very easy to guess, ...
user avatar
1 vote

Why certain sites don't send newsletters to "anonymous" mail addresses?

This unfortunate situation isn't really infosec issue, but rather: (a) marketing issue - They want your real e-mail address to report smth like "We have N subscribers and attracted M more last ...
user avatar
-1 votes

Is there any security benefit from emailing a "secure link"?

Another factor here--this approach greatly reduces the risk of casual discovery of the information. If my doctor sends a message saying "you have a message on the portal" someone who picks ...
user avatar
0 votes

Is there any security benefit from emailing a "secure link"?

As weak as it is, you need to consider that the intended recipients are in majority layman with little security or computer knowledge. You cannot expect them to install and use PGP or similar more ...
user avatar
  • 351
9 votes

Is there any security benefit from emailing a "secure link"?

Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have ...
user avatar
13 votes

Is there any security benefit from emailing a "secure link"?

The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and ...
user avatar
48 votes
Accepted

Is there any security benefit from emailing a "secure link"?

It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
user avatar
  • 4,096
1 vote
Accepted

How would you counter an email/honeypot mischief scenario?

This is called list bombing. If your server is facilitating a list bomb, that is indeed your fault. Put safeguards on your website to avoid abuse. For example, no single IP should be able to input too ...
user avatar
  • 9,256
0 votes

Can I prove that I did not receive an email?

It is possible if both parts can check the logs. If the sender has the QueueID provided by the destination, the problem is with the destination server. In that case, the sysadmin of the destination ...
user avatar

Top 50 recent answers are included