Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

9

Thankfully, you don't surrender remote admin capabilities to Microsoft. However, you do surrender them to the e-mail system's administrator or some other IT admin there. Generally this is kind of security done at a corporate level. Corporations are as a whole concerned about loss of their intellectual property or privileged information (such as customer ...


9

Intra-domain emails (emails from your domain to someone else in your domain) have a much higher trust score, so they tend not to get blocked. This is done because legitimate employee-to-employee emails can look a lot like spam ("check out these pictures of my cat! [link]") . This is an ease of use issue. The sensitivity level of this can be changed on the ...


5

TL;DR: use smart cards. To prevent distributing the key to other persons you need to prevent that the user has read access to the key in the first place. The key is used in SSH for authentication. The authentication process involves cryptographic operations (signing) which need to have read access to the key. In order to protect the users key against ...


4

I have seen several universities doing it this way: You can access your mailbox either using the Exchange protocol or using IMAP + SMTP. If you try to use the Exchange protocol with Android devices, you will get the remote access silliness that you described. However, if you use IMAP + SMTP, you can avoid this issue. (Yes, this doesn't make much sense. Yes,...


4

Yes, no, maybe. On any given day, the right answer will be one of the three. Generally the right solution to the problem is considered to be assuming that you may be vulnerable and applying mitigation (firewalls, anti-malware & backups are the essential ones).


3

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use. Twitter has a section in your profile settings that list all connected applications to your account. This can be other twitter clients, or other services that use your twitter ...


2

This does appear strange. It is something that the technical support people should know how to fix. (maybe they don't know, but they should) It is possible that it was a setting in your account with this string. If that is the case you can change it back, and that is a clue your account was hacked. It is possible this is due to a bug in their software, in ...


2

Yes, but there is a difference. While "cute-kittens.gif.exe" can raise some eyebrows, since a GIF shouldn't be executable, I wouldn't say the same about .tar.gz files. To be more clear, .tar.gz should be considered as dangerous as .zip. In fact, since any compressed archive coming from a Unix-like system is usually .tar.gz, a .tar.gz file could have a ...


2

Both approaches have their own risks: If you have your mail remote then you fully depend on the security provided by the external provider. If you host it locally it is more under your control. Which is more better depends an what you and what the provider are able and willing to do regarding security but the provider is definitely the more lucrative target ...


2

I doubt that they can actually see the content of your phone, however an exchange administrator is able to remotely wipe your device at any moment. This is usually done in case of a critical security risk coming from your device, which can also be the phone being lost. They can also turn off phone functions such as bluetooth, web browser, camera, etc.. ...


2

It was once possible to embed audio into emails (including auto-play). Here's a 2012 article describing how it was done. This does not currently work in Gmail or Outlook 2016, but it may still work in other email clients. So if the recipient is using an email client that supports this, then yes it would be possible to track email opens this way, in exactly ...


1

Is it possible that they could be authenticating over a TLS tunnel from their own server rather than the client device without sharing the credentials? No, for the server to make the connection, it has to know the credentials. And we know that the server does make the connection, not the client, because I captured all the packets coming off my Android ...


1

Encrypted E-mail requires a bit of work by somebody. You've done the work for your users. Now the question is what's going on at the other end. The person on the other end will need to create (or have created for them) an SMIME certificate and private key. Then the folks at each end will want to exchange SMIME certificates. Many mail clients can be ...


1

Broadly, yes... but it doesn't reveal a whole lot about you. Any link you click (whether from an email or elsewhere) makes an HTTP request to a remote server. The server handling the request will receive some details about what you were asking for (domain name, filename, the IP you made the request from, etc). So whatever information is in the link address,...


1

The reason for the certificate's current invalidity is not relevant. If Outlook, or any client software, presents a different conclusion regarding the validity of a signature from either type of certificate (expired, or revoked) then the software is broken and a bug report should be filed with the vendor. If the signature was made while the certificate was ...


1

Your Sent Email folder will have the original. There may also be copies on the email server itself. Ask someone from the IT department or the email admin to verify either your Sent folder or the server copies.


1

Is there anyway to ... help to prove my innocence ...? Ask your client to send an Email send the email to your employer, if you can. In the future you can confirm that the Email is unchanged by automatically signing your Emails with SSL certificate. There are a lot of providers of affordable certificates. In the popular Email clients like MS Outlook there ...


1

I believe it is fairly standard to keep secrets in memory. Why it is generally better not to store passwords themselves, but rather use tokens/keys, it is not too bad IMO. The app has to store some kind of authentication token/key anyway, so by not using password, the only gain would be that an attacker capable of obtaining said key/token would loose access ...


1

From what I experienced MS Office Outlook does not block Spam. Each time I receive a Spam email I tag it as Junk. Next time the same sender gets blocked. I found I have to create my own list. The ISP I am with has Spam filtering. It is adjustable by sensitivity, and also allows the user to filter out by server name, and or by email address. I found their ...


1

Smart Cards are one way to go. Another way would be to use ephemeral short-lived certificates instead of static keys for authentication. There are numerous open source implementations around using a certificate authority for SSH instead of static keys. One such system is called Cashier, currently maintained by an SRE from Intercom. Another that handles ...


1

Short answer, no, its not possible. The user needs permission to read the key to use it, and if they can read the key they can copy it. It is possible to restrict access to the key, e.g. if it resides on a unix box, then don't give the user permission to read the key, but allow them to run ssh via sudo. Or use a locked down mswindows jump box with remote ...


1

So, how do I know if a session to the account has expired if I can't logout from it? If you can still access resources which require your authorization then you are not logged out. Thus simply try to access new mails or similar in case of Outlook web interface. Could a failure to logout be a sign that someone else accessing my account? Probably not. But ...


1

Wow, lots in that question to try and get through. First, what might you be missing? I'd suggest two things from experience. Firstly, the client PC's should only run whitelisted applications, everything else should be blocked. This cancels out masses of malware. Second, kill off access to all known advert servers, malware sources and command and control (...


1

Frankly speaking, the best is to use combination of both which is IMAPS. With IMAPS the connection is secuie (IMAP over SSL, or rather, TLS), and the client retrieves the list of emails and when you click on email, it is downloaded. Similarly Exchange protocol works this way. So it keeps email on the server so you can browse them online and downloads the one ...


Only top voted, non community-wiki answers of a minimum length are eligible