New answers tagged email
4
votes
Accepted
Can a plain text email contain XSS injection?
No, plain-text email cannot contain a cross-site scripting (XSS) attack.XSS requires scripting, which even HTML email bodies* do not permit.
(*HTML attachments opened in web browsers can trigger XSS ...
- 9,256
1
vote
Accepted
Is an HMAC of an email address with a permanent secret key a good way to generate security tokens for unsubscribing from an email list?
First, it's good to spell out the problem that you're trying to solve. Then you can determine if an authentication token is necessary and what it needs for proper security.
To prevent user ...
- 9,256
0
votes
Is there any reason to not use my real name in my email address?
Well there is always an argument around displaying personal information in a public sphere. I would say this... It easier for threat actors to get a hold of your email since its very easy to guess, ...
1
vote
Why certain sites don't send newsletters to "anonymous" mail addresses?
This unfortunate situation isn't really infosec issue, but rather:
(a) marketing issue - They want your real e-mail address to report smth like "We have N subscribers and attracted M more last ...
- 138
-1
votes
Is there any security benefit from emailing a "secure link"?
Another factor here--this approach greatly reduces the risk of casual discovery of the information.
If my doctor sends a message saying "you have a message on the portal" someone who picks ...
- 763
0
votes
Is there any security benefit from emailing a "secure link"?
As weak as it is, you need to consider that the intended recipients are in majority layman with little security or computer knowledge. You cannot expect them to install and use PGP or similar more ...
- 351
9
votes
Is there any security benefit from emailing a "secure link"?
Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have ...
13
votes
Is there any security benefit from emailing a "secure link"?
The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and ...
- 25.6k
48
votes
Accepted
Is there any security benefit from emailing a "secure link"?
It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the ...
- 4,096
1
vote
Accepted
How would you counter an email/honeypot mischief scenario?
This is called list bombing. If your server is facilitating a list bomb, that is indeed your fault.
Put safeguards on your website to avoid abuse. For example, no single IP should be able to input too ...
- 9,256
0
votes
Can I prove that I did not receive an email?
It is possible if both parts can check the logs. If the sender has the QueueID provided by the destination, the problem is with the destination server. In that case, the sysadmin of the destination ...
Top 50 recent answers are included