be Smart.
be Secure.
Phone: 800-441-6612

Can S/MIME be trusted when SSL has had so many security issues?

Published: March 26th, 2015

SSL and TLS have had a lot of security issues over the past 1-2 years.  While these have been patched quickly, they have been very bad and have changed our view of and trust of the Internet.  S/MIME is really just aspects of SSL/TLS applied to secure email messages (we looked at this previously).  So …. can S/MIME be trusted?  Does it suffer from the same vulnerabilities as SSL?  Is S/MIME a good thing to use for secure email or should it be avoided with a 10-foot pole?

As we shall see, S/MIME is impervious to the majority the issues with SSL due to the fact that there is no real-time negotiation of cryptographic algorithms and there can be no man-in-the-middle.

Lets see…

Read the rest of this post »

Did You Know? S/MIME is like SSL for Email Encryption

Published: March 24th, 2015

S/MIME is a popular technology for end-to-end email encryption and is analogous to PGP in the way that it works.  It is commonly available in most modern email programs and in many server-side email and WebMail encryption services like LuxSci SecureLine.

Folks are used to thinking about Internet security and encryption in terms of web site security. E.g. the “https://” that secures our everyday life working in our web browsers is the signal that SSL/TLS is being used to encrypt traffic between ourselves and the web server.  People are even becoming used to the fact that TLS (with SMTP) is also commonly used to secure the transport of email messages from server-to-server.

These are all good things!

S/MIME (like PGP) is different — it encrypts the email message before it is sent and the message stays encrypted until the recipient opens it.  It “doesn’t matter” how this message is transported to the recipient … its secure the whole way.[1]  But did you know that S/MIME is really just an application of the same SSL/TLS technology that secures your traffic to securing your messages?

[1] S/MIME (and PGP) do not secure your message headers (e.g. the subject, recipients, etc.), it only secures the message body and attachments.  So, the added security of SMTP over TLS does serve to protect those things that S/MIME does not protect.

Read the rest of this post »

Introducing LuxSci’s new API

Published: March 23rd, 2015

LuxSci has just released it a new API for automated access to management of users and accounts.  The new RESTful API has been re-written from the ground up with a focus on security and usefulness.

The old APIs work well, but are based on “old technology” (e.g. SOAP) which was the golden boy for API usage many years ago, but which has since been replaced by RESTful APIs as an industry standard.  We are taking this opportunity to re-tool our APIs using REST and modern API security techniques, and then to expand these APIs to provide more and more integration pathways with LuxSci.

This first release replaces the now-deprecated SOAP-based “User API” and enables the API access to:

  1. Getting and updating user profile contact information
  2. Changing user passwords
  3. Retrieving user preferences
  4. ManagingWebAides (Contacts, Calendars, Tasks, Notes, and Links):
    • Creating and deleting WebAide containers
    • Creating, retrieving, deleting, and updating individual entries
    • Creating, deleting, and updating entries in bulk
    • Retrieving lists of entries
    • Retrieving list of entries that have been added/updated/deleted since your last check (e.g. for writing synchronization programs)

Additionally, access to user-data can be had in either of the following two ways:

Read the rest of this post »

Tracing the Origin of an Email Message — and Hiding it

Published: March 17th, 2015

We are often asked by our users to help  them determine from where an email message has originated. “Where did this spam come from?”

In general, it is fairly easy to do this if you have access to the “headers” of the message.  In this post, we will show you how to determine a message’s original location yourself and also how you can protect yourself from others determining your location when you send email messages to them.

Why would you need to protect yourself — If you are traveling and do not want people to know where you are; if your messages are not going through because your ISP is blacklisted or has a poor reputation.


Read the rest of this post »

Email Identity Protection and LuxSci Email Hosting

Published: March 9th, 2015

We have just completed a long series of articles discussing how attackers forge email messages and what technologies and techniques can be used to counter these attacks.  See: Email Identity and Forged Email.

In this post, we will discuss some best practices when using LuxSci to maximize your protection against forged email messages.

Read the rest of this post »

Address Book Entry Editor Face Lift

Published: March 6th, 2015

LuxSci has just completed a full frontal facelift on its Address Book entry editor — the tool used to create new address book entries and edit existing ones.  The revised editor has been created to function somewhat like the new WebMail composer tool.

The new Address Book Editor features:

Read the rest of this post »

Stopping Forged Email 4: Your Last Resorts

Published: March 4th, 2015

In previous posts we have examined how hackers and spammers can send forged email and how it can be extremely difficult to differentiate these messages from legitimate messages.  We have looked at the various common techniques for anti-fraud such as SPFDKIM, and DMARC and seen that, while these technologies can help a lot, they all have limitations; they all require strict and proper setup by the owner of the purported sender’s domain, and they must be well supported by your own spam filtering system.

Yet even with these technologies, it’s not hard in many cases for a determined attacker to send you a forged, fraudulent email message that still looks and feels legitimate.

What else can you do to validate email messages and protect yourself from phishing or social engineering attacks?

Read the rest of this post »

Stopping Forged Email 3: DMARC to the Rescue

Published: March 2nd, 2015

We have recently looked at how hackers and spammers can send forged email and then seen how these forged messages can be almost identical to legitimate messages from the purported senders.  In fact, we learned that generally all you can trust in an inbound email message is the internet IP address of the server talking to your inbound email server — as this cannot realistically be forged in any way that would still enable you to receive the message.

In our previous two posts in this series, we examined how SPF and DKIM can be used to help limit forged email messages based on validating if a message was sent by an approved server by looking at the IP address delivering the email message to you and based on digitally signing messages.  We found that while SPF and DKIM can work, they has many significant limitations that cause them to fall or be insufficient to stop forgeries in many cases.

However, SPF and DKIM address the forgery problem in very different and, in many respects, very complementary ways. For this reason, many organizations use both technologies.

If you are using both technologies and you have a good amount of control over where your domain’s messages are coming from, then you can step up your game by using DMARC — Domain-based Message Authentication, Reporting and Conformance. 

Read the rest of this post »

WebMail Enhancements: Faster and Faster We Go

Published: February 28th, 2015

Fewer clicks and faster access to your email … isn’t that what we all want? LuxSci’s latest WebMail enhancements keep us on track toward faster and easier.

Among minor changes and bug fixes, our latest enhancements include:

Automatic Loading of New Email

When new email messages arrive, you no longer have to click on “Get Email” to see what they are — they are automatically loaded and displayed to you in the user interface.  No need to click and wait a second.

Auto-loading of new email occurs when:

  1. You are not sorting or are sorting by date, read status, or thread
  2. You are not in the middle of a search
  3. You are viewing the “page” of messages that includes the newest messages in your sorted list
  4. You are using “WebMail Acceleration” (which is on by default for everyone).

Don’t worry, if these criteria are not met, you will still be informed of new messages in the usual way and you can click on “Get Email” to load them when you are ready.

Read the rest of this post »

Stopping Forged Email 2: DKIM to the Rescue

Published: February 23rd, 2015

We have recently looked at how hackers and spammers can send forged email and then seen how these forged messages can be almost identical to legitimate messages from the purported senders.  In fact, we learned that generally all you can trust in an inbound email message is the internet IP address of the server talking to your inbound email server — as this cannot realistically be forged in any way that would still enable you to receive the message.

In our last post in this series, we examined how SPF can be used to help weed out forged email messages based on validating if a message was sent by an approved server by looking at the IP address delivering the email message to you.  We found that while SPF can work, it has many significant limitations that cause it to fall far short of being a panacea.

So — besides looking at the sending server IP address — what else can we do to determine of a message was forged?

It turns out that there is another way — through the use of encryption techniques and digital signatures — to have the sender’s servers transparently “sign” a message in a way that you can verify upon receipt.  This is called DKIM.

DKIM – Domain Keys Identified Mail: A Simple Explanation

DKIM stands for “Domain Keys Identified Mail” … or, re-writing this more verbosely, “Domain-wide validation Mail Identity through use of cryptographic Keys”.  To understand DKIM, we need to back up for a second and look at what we mean by “cryptographic keys” and how that can be used.

Read the rest of this post »

• Access Anywhere
• Fast and Robust
• Super Secure
• Tons of Features
• Customizable
• Mobile Friendly

Send and receive email from your favorite programs, including:

 Microsoft Outlook
 Mozilla Thunderbird
 Apple Mail
 Windows Mail

... Virtually any program that supports POP, IMAP, or SMTP

Keep your email, contacts, and calendars in sync:

 Apple iPhone and iPad
 Android Devices
 Windows Phone

... Any device with Exchange ActiveSync (EAS) support

Relay your server's mail through LuxSci via smarthost:

• Resolve issues with ISP sending limits and restrictions
• Improve deliverability with better IP reputation and IP masking
• Take advantage of Email Archival and HIPAA Compliance
• Even setup smarthosting from Google Apps!

Free web site hosting with any email account:

• Start with up to 10 web sites and MySQL databases
• DNS services for one domain included
• Tons of features and fully HIPAA capable

LuxSci's focus on security and privacy:

• Read The Case for Email Security
• Read Mitigating Security & Privacy Threats
• Review our Privacy Policy

The most accurate, flexible, and trusted filters in the business:

• Premium protection with Intel Security Saas
• Realtime virus database guards against the latest threats
• Seven-day quarantine lets you put eyes on every filtered email
• Supplement with our Basic Spam Filter for even more features

End-to-end secure email encryption — to anyone, from anyone:

• No setup required — encryption is automatic and easy to use
• Secure outbound email with TLS, PGP, S/MIME, or Escrow
• Free inbound encryption via our SecureSend portal
• Independent of your recipient's level of email security
• Widely compatible and fully HIPAA Compliant

Add an extra layer of security with an SSL Certificate:

• Secure your web site
• Debrand LuxSci WebMail with your own secure domain
• Access secure email services via your own secure domain

Encrypt your service traffic via secure tunnel:

• Add another layer of security to your SSL connections
• WebMail, POP, IMAP, SMTP, web/database access
• SecureForm posts, SecureLine Escrow, SecureSend access
• Restrict your account to VPN access only

Secure long-term message archival:

• Immutable, tamperproof email retention with audit trails
• No system requirements — minimal setup, even less upkeep
• Realtime archival of all inbound and outbound messages
• Works anywhere — even with non-LuxSci email hosting

Free data backups included with all email hosting accounts:

• Automatic backups of all email, WebAides, web/database data
• Seven daily backups and up to four weekly backups
• Unlimited restores included at no additional cost
• Custom backup schedules for dedicated servers

Automate your email management:

• Save messages to specific folders or to LuxSci WebAides
• Advanced text scanning with regular expressions
• Tag messages, alter subject lines, or add custom headers
• Filter by message charset, type, TLS status, DKIM status
• Chain filters together for even more complex actions

• Bulk add and edit users, aliases and more
• Control sharing and access globally or on a granular level
• Delegate user roles through permissions
• Configure account-wide taglines, sending restrictions, and more
• Remotely administer account via SOAP API

Share, collaborate, organize, synchronize:

• Calendars, Contacts, Documents, Notes, Widgets, Workspaces
• Fine-grained access control and security
• Access anywhere via secure web portal or smartphone
• Save over solutions like Microsoft Exchange

Free folder sharing for all email hosting accounts:

• Share mail folders with other users in your account
• Subscribe to only the folders you want to see
• Set read-only or read-write access control
• View all personal and shared folders via unified web interface

Color code and label your email messages:

• Define and assign multiple IMAP keywords to each message
• Filter, search, and sort by tags
• Compatible and synchronizes with any IMAP email client
• Also usable with WebAide entries