Why Passwords May Not Keep Your Email Safe

Two-factor Authentication using phone pin and passwordWe live in an era where the amount of valuable data businesses must store is increasing at an unprecedented pace. Consequently, the number of “bad guys” trying to gain access to that data is also increasing, and hackers have some pretty sophisticated tools at their disposal to try to force their way into your data. They use a variety of tactics, including social engineering, brute force attacks and dictionary attacks, among others.

The problem is made worse by the prevalence of weak passwords. Did you know that, even in 2017, one of the most common passwords is 12345678? In an experiment conducted in 2013, with the help of a list of hashed passwords obtained online, hackers were able to crack about 90% of a list of over 16,000 passwords.

Passwords are not just vulnerable to external threats. They must be protected from internal threats as well. Have you ever written down a password on a piece of paper, and then thrown it in the garbage? Have you ever discarded an old hard drive without destroying it? If this information gets in the wrong hands, it can lead to severe financial loss for a company, and damage to its reputation.

Passwords and usernames belong to one of three types of identification data:

  1. Something you know
  2. Something you own
  3. Something you are or do (such as a fingerprint or other biometric element)

Passwords and usernames fall within the category of “something you know.” The three items listed above are considered factors of authentication, so when only one type of data is used to log into a system (such as a username and password), you are using a single factor of authentication.

Passwords alone are often not enough to protect your data against increasingly sophisticated attacks. Requiring a second factor of authentication can drastically reduce data theft.

Two-factor authentication is not a new concept. In fact, most of us already use it in other ways besides accessing our email. Here are some examples of two-factor authentication that many of us already use daily:

  • An ATM card (something you own) and a PIN (something you know)
  • A credit card (something you own) and a zip code (something you know)
  • A phone (something you own) and a fingerprint (something you are)

MDaemon includes two-factor authentication for WorldClient, MDaemon’s webmail client. With two-factor authentication, users must provide two forms of authentication – a password and a unique verification code that is obtained via any client that supports Google Authenticator (available in the Google Play store).

Two-factor authentication has many benefits:

  • It provides an extra layer of defense when a password isn’t strong enough.
  • It reduces online identity theft, phishing, and other techniques because a victim’s password isn’t enough to gain access to his or her data.
  • It helps companies in finance, health care, and other industries comply with PCI, HIPAA and other regulations.
  • It makes working remotely safer.

In this video, we demonstrate how to enable and use two-factor authentication in MDaemon and WorldClient.

If you’re concerned about privacy and security, two-factor authentication provides extra protection for your data. Download the latest version of MDaemon to take advantage of this extra security!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •  

2016 Year in Review

2016 Year in ReviewWell, another year is almost over, but over the past year, we’ve managed to pack in lots of new features and enhancements to our products, and thanks to people like you sharing your ideas with us via the Alt-N Idea Engine, or on our community forums, our development staff can have a direct dialog with customers.  For 2016, we’ve added the following new features to MDaemon:

  • Two-factor authentication – Requires users to provide a verification code in addition to the username and password.
  • Spambot detection – When multiple messages claiming to come from the same sender are received from multiple IP addresses, a spambot is often the culprit. This feature helps keep those pesky Spambots from sending mail to your server.
  • XML API for complimentary applications – Allows third-party developers to integrate complimentary applications (such as CPanel, etc.) with MDaemon.
  • CardDAV support – Allows users to synchronize their contacts with their favorite mobile device or other mail client.
  • ActiveSync migration client – The ActiveSync migration client makes it easy to import data over from any other mail server that supports ActiveSync protocol version 14.1.
  • Third-party chat (XMPP) client – Users now have more options for chatting with their colleagues. In addition to the standard WorldClient Instant Messenger, users can now chat with their favorite XMPP client from their desktop or even their mobile device!
  • Automatic updates – With automatic updates, the administrator no longer has to manually check for new versions and install them. The automatic update feature will notify the postmaster when a new version is available. Updates can be automatically downloaded and installed at a designated time.
  • Centralized management of Outlook Connector settings – Outlook Connector settings can now be pushed out to users. All that’s needed is the email address and password. No more guessing at what to put in the other fields! We’ve updated our Outlook Connector Quick-Start guide to help you get started with this new functionality.

We also released SecurityGateway 4, which includes the following new features:

  • Enhanced anti-spoofing support with DMARC – DMARC allows domain owners to specify what actions to take for messages that don’t align with DKIM or SPF. This helps take out the guesswork on how to handle messages that may be spoofed.
  • Improved user interface for mobile devices – SecurityGateway’s web interface now scales to fit any screen size, so whether you’re using a mobile device or a PC, you’ll see a friendly, responsive interface that has been designed for the screen size you are using.
  • Send mail from each domain’s IP address – When you have more than one IP address on your server, each domain can be bound to a specific IP address. Mail from the domain will be sent from its assigned IP address.

We launched our blog over three years ago to provide another communication channel for our customers, to keep people updated on the latest email industry and security news, tips, product releases, and more. For 2016, we’ve compiled a list of the ten blog posts that generated the most interest. With email security featured prominently in the news over the last year, it comes as no surprise that the topics that generated the most interest revolve around email security and privacy.

Here are the top ten blog posts from 2016:

  1. SSL & TLS Best Practices
  2. New MDaemon Feature Helps Detect Spambots
  3. MDaemon 16.5, with Automatic Updates, WorldClient Categories, & More!
  4. Encrypting vs. Signing with OpenPGP – What’s the Difference?
  5. Encryption Options for Keeping your Private Email Messages Safe
  6. Teach Your Inbox to Recognize Spam
  7. Access your Outlook contacts from Anywhere by Importing them into WorldClient
  8. MDaemon 16 = 2016
  9. Why Passwords May Not Keep your Email Safe
  10. 10 Ways to Reduce Spam in your Inbox

Need a quick video lesson on a particular feature? This year, we also added all of our eLearning videos for MDaemon and SecurityGateway to our YouTube channel.

While 2016 is almost over, our development staff is already hard at work to bring you new & exciting features for 2017, so check back often for the latest updates!

Spread the love
  •  
  •  
  •  
  •  
  •  
  •  
  •