New answers tagged

2

I will first describe what I have understood from your question: For meetings you are sending username password pairs to the participants - they are used to retrieve documents the username and the password are sent in different emails all the participants at a meeting share the same username password pair participants can be internal (to the organization) ...


2

It is usually a trade-off between user experience and security. How the trade-off is made depends on the actual threats. While mail can be seen as inherently insecure, it does not mean that every mail gets intercepted for sure. If the impact of a potential interception is low then it might be acceptable to prefer easy of use against security. It cannot be ...


1

General email is not secure. However if "at work" means internal email only, then potentially security is much higher, especially if all work email uses smime encryption as is fairly common in a closed community. Sending two emails is an obscurity attempt or hope that interceptors will not correlate the two messages. It's a bad practice!


0

If that attacker is suggesting a header like From: https://www.alidropstore.cоm/ is valid and usable to bypass SPF (which doesn't even look at headers!), they likely don't know what they're talking about. Either way, they don't care. This is a scare tactic and it is filled with FUD. — I highly suggest against responding to the attacker, but if you did, I'd ...


1

I'm not an expert in web servers, but I think both approaches are better than just storing the data unencrypted on the web server. An approach with immediate sending the data without even storing it looks a bit better, as the attacker will have problems even accessing the cyphertext. However, you have to remember that everything comes at a price, and in this ...


17

Existing answers are correct, but incomplete. I would like to highlight two other scenarios. First, about SMTP. Under some conditions, someone can connect directly to the final SMTP server and deliver an email. SPF for instance could be used to prevent that. If that was to happen, then the sender has full control over the email, except the possible last bit ...


7

At the SMTP level, the SMTP server receives a fully composed text consisting of the headers, a blank line, and the body. It also has what is called the enveloppe addresses and what are given in other commands of the SMTP protocol. A normal server adds some lines into the header normally a Received one and optionally others. But it neither controls a ...


33

Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: that is, trivially. This is why spammers can send mail that appears to be from your own account (or someone else's) on an arbitrary date. However, there are a ...


0

First, let's define something: change.org is a domain name. example.com is a domain name. something.example.com is a subdomain (something) under a domain name. You can think of it like an address where you say the house number, then the street, then the city, then the country. And sometimes you can omit some details from the address, so not every domain ...


Top 50 recent answers are included