Don Libes National, Don Libes · 1996
This paper describes the use of email addresses as an authentication mechanism for public access servers. Intended for untrusted and low-risk environments, this mechanism provides reasonable security at very low cost to both user and server administrator. In particular, the initial and subsequent registrations are totally automated, and problem detection/resolution is highly automated. Keywords: security, authentication, email reception, email address Introduction In this paper, I describe the use of email reception as an authentication mechanism for public access servers, such as email- and Web-based servers in untrusted and low-risk environments [DoD]. Even the simplest implementation provides security that is significantly better than trust and requires significant power to crack. Despite its security limitations, this type of authentication should be attractive for a large percentage of servers that are now currently trust-based. In particular, the system administration cost...
Cited by 0
Don Libes · 1996
This paper describes the use of email addresses as an authentication mechanism for public access servers. Intended for untrusted and low-risk environments, this mechanism provides reasonable security at very low cost to both user and server administrator. In particular, the initial and subsequent registrations are totally automated, and problem detection/resolution is highly automated.
Cited by 0
Konstantinov, Andrew · TIB KMO / FLOWWORKS GmbH · 2019
Forget look-alike domains, typosquatting and homograph attacks. In this talk we will discuss ways of forging perfect email counterfeits that (as far as recipients can tell) appear to be coming from well-known domain and successfully pass all checks on their way. Prime focus of this talk will be modern anti-spoofing strategies and the ways around them. Join us as we try to figure out answers to questions such as "Isn't SPF enough?", "Do I *really* need DMARC?" and "Does ticking all three (SPF, DKIM, DMARC) provide the best protection possible?" (answers to these questions are "no", "yes", "no" by the way). Email security is poorly covered by a contemporary penetration testing curricula. In this talk I will argue that it leads to underreporting of email-related security issues during regular penetration tests or red team assignments. Getting clicks from (at least some) users is usually fairly easy, even with obviously fake domain names and email addresses, so penetration testers rarely need to do anything more fancy in order to achieve their objective. While this highlights the need for user education, it misses common misconfiguration issues that might lead to much more devastating compromises and could instill false sense of security in (rare) cases that regular phishing attacks fail. Technically inclined users (such as developers, tech support or even SIEM analysts) are less likely than others to fall for phishing email originating from fake domain, but they are actually more likely to fall for email seemingly originating from real known-good source due to overconfidence. In this talk we will see just how easy is it to send spoofed mail from arbitrary source address due to lack of protection for this scenario in original SMTP spec. We won't stop there however and our next object of focus will be contemporary anti-spoofing technologies (SPF, DKIM and DMARC). We will discuss motivation behind them, their technical limitations, weaknesses discovered in recent years as well as common misconfigurations. Attendees will gain knowledge about relevant protocols and technologies that should be applicable for identifying weaknesses in the architecture of their own email systems.
Cited by 0Open access
John Levine · 2019
SPF (RFC7208), DKIM (RFC6376), and DMARC (RFC7489) enable a domain
owner to publish e-mail authentication and policy information in the
DNS. In internationalized e-mail, domain names can occur both as
U-labels and A-labels. This specification updates the SPF, DKIM, and
DMARC specifications to clarify which form of internationalized domain
names to use in those specifications.
Cited by 2
Yijia Fang, Bingyu Li, Jiale Xiao et al. · 2024
Electronic mail, as one of the most widely used identifiers, is extensively utilized for account registration and recovery, two-factor authentication, and organizational identification. Traditional email ownership authentication is typically achieved through verification codes or links sent via email, which leads to full disclosure of a user’s email address.We propose FreeAuth, an innovative and universal email ownership authentication scheme that enhances privacy by allowing users to selectively disclose email-related information. FreeAuth distinguishes itself from precedents by eschewing verification emails, thus avoiding spam marking and online behavior tracking. It establishes an authentication interaction paradigm based on widely deployed email transmission protocols, such as SMTP, IMAP, and POP3, ensuring legacy compatibility and server obliviousness. Meanwhile, it utilizes TLS Oracle schemes to protect data privacy by disclosing only the authentication outcome of the interaction, rather than revealing the full email address. FreeAuth can be integrated as an alternative to traditional email ownership authentication schemes.We present details of FreeAuth architecture and instantiations of prototype systems, along with three tailored examples of selective email address disclosures to align with various scenario requirements. The experimental analysis indicates that FreeAuth is compatible with up to 96% of existing email providers, and it is notably efficient, requiring only 2.5 seconds of online time to complete ownership authentication in our wide area network settings.
Cited by 1
B. Sadhana, Chethan Krishna S, S. R. Chinmaya et al. · International Journal of Advanced Research in Science Communication and Technology · 2023
The emergence of the Internet has caused substantial change in many industries. The internet, as a global computer network, has made people's life easier since they can often more quickly obtain any information they want. Communication is one of the primary areas that the internet has altered. Communication has become very simple as a result of the internet's integration of communication technology. Email is frequently regarded as the most secure means of transmitting or receiving sensitive data over the Internet. Because these gadgets need visual awareness, using them may be difficult for persons with visual impairments. A visually impaired person cannot use the current email software without the aid of others who send emails on their behalf. This, however, does not secure that person's protection and confidentiality. This lead to the creation of a voice-based email that requires minimal training. It employs speech recognition as well as mouse clicks. Facial recognition is used to improve user authentication, security, and privacy. Voice-mail allows users to easily send, receive, and delete emails. Each user activity is accompanied by an interactive speech response. It might be used by both visually impaired folks and ordinary people.
Cited by 1Open access
Stephen J Nightingale · 2017
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.Such identification is not intended to imply recommendation
Cited by 7Open access
Prashant D. Chauhan, Apurva Shah · 2023
The continuous and exponentially increasing use of email as the main means of communication within two parties is also increasing risk to the involved parties due to the easily possible attacks on the email system. The core of the whole email system depends on SMTP protocol which came to actual existence only after 1980s. At the time of development of SMTP, present day highly computational security attacks couldn't have been considered which results in the security loophole in the present email system. In this paper we study the working and effectiveness of various protocols available today to countermeasure the security issues in present day email system.
Cited by 3
Rashmi Hegde · 2015
world, Electronic mail or e-mail is the one that is most prone to intrusions like phishing which acquires sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. In order to deal with security, authentication like biometrics plays an important role. Biometrics technology is simply the measurement and use of the unique characteristics of living humans to distinguish them from one another to ensure that the rendered services are accessed only by a legitimate user and it is more useful as compared to passwords as they can be lost or stolen. In this paper, a method which is based on biometric recognition which would avoid any intrusion possible to the email is proposed.
Cited by 0
Estelle Derouet · Computer Fraud & Security · 2016
Business email compromise scams (also known as ‘CEO fraud’) have cost companies $3.1bn in the past two years alone, according to the FBI. Indeed, spear-phishing is one of the biggest challenges facing enterprises today, with 84% of businesses having already suffered from an attack. Why is email fraud so effective? Too often, organisations use people, their weakest link, as their first line of defence. This presents a huge opportunity for cyber-criminals. The cost of phishing – in revenue, in data lost, in remediation and regulatory costs – is far too great to leave the email channel undefended. Estelle Derouet of Return Path explores the primary means of executing one of the most dangerous spear-phishing attacks today. And she offers some best practices for combating email fraud at the organisational level.
Cited by 13
Mark Delany, Status Of This Memo · 2007
By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. This document may not be modified, and derivative works of it may not be created, except to publish it as an RFC and to translate it into languages other than English. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at
Cited by 0
Zhe Wu, Jie Tian, Liang Li et al. · 2007
Most of secure email systems adopt PKI and IBE encryption schemes to meet security demands in communications via emails, however, both PKI and IBE encryption schemes have their own shortcomings and flaws and consequently bring security problems to email systems. This paper proposes a new secure email system based on a fingerprint authentication scheme which combines fingerprint authentication technology with IBE scheme. The system perfectly solves the existing problems encountered in email security protection implementations.
Cited by 8
Mohamad Azhar Abdul Halim, Chuah Chai Wen, Isredza Rahmi A. Hamid et al. · AIP conference proceedings · 2017
Protection of sensitive or classified data from unauthorized access, hackers and other personals is virtue. Storage of data is done in devices such as USB, external hard disk, laptops, I-Pad or at cloud. Cloud computing presents with both ups and downs. However, storing information elsewhere increases risk of being attacked by hackers. Besides, the risk of losing the device or being stolen is increased in case of storage in portable devices. There are array of mediums of communications and even emails used to send data or information but these technologies come along with severe weaknesses such as absence of confidentiality where the message sent can be altered and sent to the recipient. No proofs are shown to the recipient that the message received is altered. The recipient would not find out unless he or she checks with the sender. Without encrypted of data or message, sniffing tools and software can be used to hack and read the information since it is in plaintext. Therefore, an electronic mail authentication is proposed, namely Hybrid Encryption System (HES). The security of HES is protected using asymmetric and symmetric key algorithms. The asymmetric algorithm is RSA and symmetric algorithm is Advance Encryption Standard. With the combination for both algorithms in the HES may provide the confidentiality and authenticity to the electronic documents send from the sender to the recipient. In a nutshell, the HES will help users to protect their valuable documentation and data from illegal third party user.
Cited by 3Open access
Tahsinur Rahman, Abhijit Bhowmik · 2024
With the massive increase in the usage of user accounts, it is very important to build a strong defence mechanism for protecting the user from malicious attackers.Modern systems use different types of defence mechanisms such as password protection, two-step verification, secret question answering etc. to protect the users however these systems have their flaws which requires addressing and further work.Email verification is a very common and useful method for doing user authentication.Email can be used as a master key for all other systems.Because of that if the email address gets compromised, an attacker can compromise all other systems that are connected to the affected email address.This paper addresses this issue and proposes EmAc, an authentication system that uses traditional email verification for making the first step of the authentication, however, it will do further authentication using user activity of each individual system as well.
Cited by 0Open access
Kalyanasundaram, Sriram · TRAP@NCI (National College of Ireland) · 2023
Websites are revolutionizing today’s world as everything is getting devitalized. From Security perspective, this digitization is not only limited to a positive impact, but a negative impact as well, since the number of cyber-attacks is increasing at an alarming rate with evolving Cyberthreats, strong authentication systems are in high demand. The innovative proposal of this paper is merging ‘Persuasive Cued Click Points’ (PCCP) authentication and email-based verification authentication method. PCCP authentication method is a unique, memorable pattern for users, improving security and usability in graphical password systems. As an additional security layer, Email based OTP is introduced where random three-digit binary opt is sent to the user using SMTP protocol. Based on the OTP the user will select the points on the images and login. The proposed system prototype is assessed on the basis of user experience and security. In Summary, a strong and convincing method for improving the authentication methods for websites and application is proposed in this paper. Evaluation of the model is done based on the valuable feedback of the participants after using the web prototype
Cited by 0Open access
Migena KERI, Malvina NIKLEKAJ · Ingenious · 2025
Information security remains one of the most critical challenges in web application development, especially as users are increasingly exposed to risks such as unauthorized access and poor credential management. This paper addresses these challenges by designing and implementing a secure web application that integrates email address verification and JSON Web Token (JWT) authentication, combined with a user-friendly interface aimed at strengthening security and raising awareness of good credential management practices. The system is developed using React on the frontend and Django REST Framework on the backend, connected to a SQL database. Key functionalities include user registration with email verification via Mailtrap, role-based access control, and an administrative panel for account management. Functional testing showed that email verification reduces unauthorized logins, JWT provides consistent and secure session management, while the interface contributes to educating users on the importance of secure practices. The results of the paper prove that combining modern technologies with secure development practices provides not only data protection, but also practical education for users. The main contribution lies in providing an applicable model for strengthening authentication and improving user behavior. In the future, the system can be expanded with multi-factor authentication, password recovery mechanisms, and real-time security analysis.
Cited by 0Open access
T. Porkodi, C. Gomathi · 2024
One easy biometric approach that has shown to accurately differentiate persons is keystroke-dynamics based authentication. In this section, you will design and implement an easy-to-understand protocol that verifies the identity of computer users by tracking their keystrokes. Keystroke verification approaches might be either static or continuous. Certain parts of keystroke verification, such as the login process, are the only parts that static verification approaches look at. While static methods provide better user verification than simple passwords, they aren't able to provide continuous security as they can't detect user substitutions after the first verification. Continuous verification, in contrast, monitors the user's keystroke patterns in real time. We can build a mechanism for the mail app to store their information, including login credentials, in this project. When you type in a password, it keeps track of how long it takes to type the entire password as well as how long it takes to type each individual letter. This makes it hard for hackers to steal information. In addition, suggest using AES as an end-to-end encryption solution for email. The publicly accessible data does not need to be altered in order for these methods to work. Also, make sure that shared email accounts use one-time password authentication. Our chances of finding the responsible party and exposing leaks would be enhanced if this were to happen. There would be no use in entrusting agents with confidential information if doing so may lead to their accidental or malicious disclosure. Plus, incorporate a secret key exchange mechanism within the suggested task in case we are need to divulge sensitive information. The shared mail information will only be accessible when the key has been validated. By doing so, we can protect our email data from prying eyes.
Cited by 0
M. Delany · 2007
DomainKeys" creates a domain-level authentication framework for email by using public key technology and the DNS to prove the provenance and contents of an email. This document defines a framework for digitally signing email on a per-domain basis. The ultimate goal of this framework is to unequivocally prove and protect identity while retaining the semantics of Internet email as it is known today.
Cited by 57Open access
Itzel Vázquez Sandoval, Arash Atashpendar, Gabriele Lenzini et al. · Open Repository and Bibliography (University of Luxembourg) · 2021
Cited by 3Open access
Itzel Vázquez Sandoval, Arash Atashpendar, Gabriele Lenzini et al. · Communications in computer and information science · 2021
Cited by 1Open access