New answers tagged email
-1
Your concerns are reasonable if the server you/they are using isn't using an encrypted channel to communicate.
However, if your concerns are your private information, the security risk of an employee that takes a picture of your license and save it to his, hypothetically, backdoored computer isn't much different from using an unencrypted connection. You are ...
1
If an SMS alone was sufficient for login, that would make it 1FA instead of a component of 2FA/MFA, wouldn't it? There's probably a password, too, protecting the account. In this case, an attacker must both steal the password and simjack the mobile subscription for the SMS.
However, a real problem is that some services use SMS based authentication both for ...
2
Only using SPF, DKIM and DMARC does not protect you from spoofing addresses.
SPF supports "fail" and "soft fail". Some mail providers are using "soft fail" because it is like a debugging flag, which means "the sender is not valid, but i will accept it"
If you want to stop spoofing, you should use "fail" in ...
0
SPF (RFC 7208) only protects the envelope sender used in SMTP MAIL FROM command. It doesn't prevent spoofing the From header, which is part of the message. DMARC (RFC 7489) is designed to protect that: it tells what the receiver should do if the domain used in the From header doesn't align i.e. match with the envelope sender passing SPF or a valid DKIM (RFC ...
0
As Adam mentioned, SPF policy discovery works differently than DMARC when it comes to subdomains: if no SPF record is found on a subdomain, no attempt is made to use the SPF record on the organizational domain; SPF will return none as the check result.
A subdomain typically represents a separate department within an organization, e.g., sales.company.com for ...
0
Email is a ubiquitous common denominator that most people online have access to and it allows a secondary method of verification to decrease the likelihood of spam, scams, and transient accounts. It's not fool proof by any means, and can certainly be circumvented but it increases the barrier to entry.
In addition, for verification purposes it can serve as a ...
0
As highlighted in many of these answers and comments, trust relations always depend in the end of some 'person' to 'person' relationship of trust. That is, you must trust facebook can manage your account securely, you must trust blockchain miners and algorithm designers, or you must trust that your email provider is secure. These issues are generic in ...
13
Email is the least worst option.
It's not just the ubiquity of email. Email is federated, standard protocol. No one entity controls email. Email is a marketplace. You choose your email provider. Don't trust them? Take your business elsewhere. There's thousands and, from an authentication perspective, they are all equivalent. You can even run your own service,...
2
The notion is that you have an alternate channel. Most of the time a web account was created then verified by email.
You registered originally giving your email address. Now what does it take for a Black Hat to steal your account:
He has to know your login and your email address. (Often the same.) With these he can send a request to change your password.
...
2
Everyone has an E-mail address and is willing to use it to register on some website. And you can easily create disposable addresses. So it is convenient for users - and cheap.
On the other hand not everyone is willing to share a phone number and even SMS is not considered secure these days.
Not long ago, I had to register for an auction and the credentials ...
71
This seems like a very wrong medium to send such information via.
Email is used for the same reasons Social Security Numbers get re-used as account identifiers in the US: Ubiquity.
Not everyone has a Facebook account. Not everyone has a Twitter account. But almost certainly, anyone with Internet access has an email account. It is a reasonable expectation ...
25
While you correctly identified problems with e-mail, a mail based verification is still considered sufficiently secure for many cases. While there are alternatives like SMS based verification, automated phone call or even snail mail, these are not as easy and cheap to use as e-mail.
The optimal security measures are usually a balance between usability (i.e. ...
5
It is a simple method for low(/medium) security services with no obvious better alternative. IMHO it may be in many cases a reasonable compromise between usability and security without advertising identity of your "tracking device" (cellular phone number).
0
This question was asked in 2013. At that time, DKIM was not nearly as widely deployed as it is now in 2020. Nowadays, most major email service providers (e.g. gmail, yahoo mail, etc.) DKIM-sign messages sent through their service.
DKIM was designed as a solution to combat spam and spoofing, but a side effect of DKIM (which can be seen either as a benefit ...
2
Thunderbird prior to the completely re-written version 78 provided encrypted GPG/PGP email support via the Enigmail plugin.
Sending encrypted email used both your public key and the recipient(s) public key(s). This was easy to see simply by selecting the sent email. You would be prompted to enter your own Private Key to decrypt the sent mail, or you could ...
1
You need to look at the basics of PGP:
an encryption key is created
the message is encrypted with this key
the key is encrypted with the receiver's public key
both encrypted encryption key and encrypted message is sent to receiver
So, A) there may be no need to encrypt the locally stored email (why would it?), and B) the message isn't encrypted with the ...
-1
The email is encrypted with your PGP key and with the recipients PGP key.
2
I can't figure out how to massage your redacted headers into something Google's Messageheader tool can read, but that'd be a good first step. Google will walk you through what it did with a little more authority than I have (especially given your redactions).
Manually reading through your headers (and assuming none are forged), this comes through inbox.eu ...
0
Yes, you can get hacked by just clicking a link.
Consider what happens when you install an extension in your browser? That's a link. Also, who said that your browser cache and history is completely secure? Most of us have our bank account details and other sensitive information stored there. You click a link and foreign code is downloaded and run on your ...
Top 50 recent answers are included
