Setting up your Smartphone E-mail

Siena's e-mail system does support a connection with a smartphone like a Palm, Blackberry, or iPhone. While we can't give detailed instructions, setup is generally easy. 

Most phones have a setup utility to help with setup. They ask you for your e-mail address and password and can figure out the setting from that. 

If that doesn't work, you can do it manually.  Here are a few tips:

• If there's a "Microsoft Exchange Server" option, use that.
• If there's no "Microsoft Exchange Server" option, select "POP3" as the protocol.
• The incoming mail server is "imail.siena.edu."
• The outgoing mail server is "smtp.siena.edu."
• The connection should be using SSL security. There is generally a check box for that.
• If a log-in name is asked, don't include "@siena.edu."

It may take some fiddling with manual information to get things to work. You may have to contact your phone provider to find out what you need to do.

Don't Fall for it

We've been getting some cases of people's e-mail accounts being compromised and used for sending spam. This was generally because the user gave out his password.  Most commonly, people are tricked into it by an e-mail requesting the password.  Here is one example:

From: <Address removed>

Sent: Wednesday, April 01, 2009 7:03 PM

Subject: ATTN: EDU WEBMAIL SUBSCRIBER:

 

ATTN: EDU WEBMAIL SUBSCRIBER:

 

This mail is to inform all our {EDU WEBMAIL} users that we will be upgrading our site in a couple of days from now. So you as a Subscriber of our site you are required to send us your Email account details so as to enable us know if you are still making use of your mail box.

 

Further informed that we will be deleting all mail account that is not functioning so as to create more space for new user. so you are to send us your mail account details which are as follows:

 

*User name:

*Password:

 

Failure to do this will immediately render your email address deactivated from our database.

 

Your response should be send to the following e-mail address.

 

Your Admin Manager: <email address removed>

 

Yours In Service.

 

<name>

 

FROM THE EDU WEBMAIL SUPPORT TEAM

There are several things about this that should raise alarms.

• First of all, no I&TS department will ever ask for your password. There is absolutely no need for it. In the case above, if we were upgrading our site, we'd would use your same user settings.  If, for some reason, we couldn't use your current username and password, we would create new accounts and let you know what the new information is. We would never have to ask for your password.
• Note the phrase:  "we will be deleting all mail account that is not functioning." IT departments know the English language well enough to handle basic subject/verb agreement.
• Though I hid it, the e-mail address for the Admin Manager was not a siena.edu address (it was from the .info domain, which is not all that reputable in any case).  Even if we for some reason needed this information (as I mentioned, we don't), we would ask you to send the e-mail to a siena.edu e-mail address.  This is a given.
• At a college, it's pretty easy to know what student accounts are active and which aren't.  There is no reason at all to delete an account before you graduate. 
• If space is needed, and we can't add memory, the solution would be to set quotas, not delete accounts.
• "FROM THE EDU EMAIL SUPPORT TEAM."  Maybe it's just me, but I'm always suspicious about anything that comes from a "team."  Scammers always seem to use it.  While it can be legitimate, it's at least a warning flag.

There are many other signs of that an e-mail is fake; if you have an example, add a comment.  But the first rule is always the best: never give out personal information when replying to an e-mail.  If you have any doubts, contact the "sender" by another means -- by phone (finding the number in the phone book, not in the e-mail) or by visiting their web page (by typing the address into the address bar, not clicking on a link).

Here's a good overview of how to remain safe from phishing e-mails like this.

POP goes your e-mail.

On campus, we use Microsoft Outlook for faculty/staff e-mail.  Students can use the Outlook Web Access, or can set up any e-mail client (including things like mail on mobile devices like iPhones).

Some people want to use Outlook Express.  That's fine, except that you have to be careful of the settings.

Outlook Express defaults to using POP3 e-mail. That's not uncommon and fine to use in most cases.  But Outlook Express is a bit behind the times:  the default is to move all e-mail from the server to your hard drive.

If you're not careful, all the mail in your inbox will move to your hard drive -- and be removed from the server.  In the days before portable computing, fast connections, and cheap memory, this made sense.  It was much more convenient to store your e-mail on your hard drive.

Nowadays, people want to keep e-mail on the server so it's available from anywhere. If you use Outlook Express with its default settings, your mail will no longer be on the server, and it isn't easy to restore it.

If you do want to use Outlook Express, check in the settings so that it leaves a copy of the message on the server. I'm not sure if that's part of the usual setup, so you may have to go into the settings and change it before connecting to the Internet.

We've seen several cases of people inadvertently deleting everything from the server.  If you want, you can use Outlook Express (though there are better mail clients out there), but don't make that mistake.

Saving Word Files from E-mail

Some students have evidently been having problems with saving Word files they've opened in Outlook Web Access.

When a Word file is sent as an attachment, and you open it in Outlook Web Access, it opens Microsoft Word on your computer. But there's a problem -- the file is saved in a temporary folder. Thus, any changes to the file are saved to this temporary file and not in the copy in the e-mail.

If you open the file again from the e-mail message, you won't find your changes.

The temporary file also may be hard to find; it's in an obscure folder on your computer and may even have a completely different name.  It's possible -- though not easy -- to find this, and the folder may well be deleted by the time you go looking.

The solution is to plan ahead.  There are two things you can do to save your work.

• Save the attachment instead of opening it.  When you click on the attachment, you are given the options to Save or Open. Always choose "Save" and save the file to your hard drive.  Then click on it to open.  Now your changes will be kept.
• Use "save as" instead of "save." If you have opened the attachment, that's fine.  But don't just save the file.  Select "Save as" from the Office Button (at the top left of the screen).  Select a location and name and save the file there. Your changes are now on your hard drive.  You can do this the first time you save the file, or the last, but you must do it at some point or your work will be lost.

Remember -- unless you take either of these steps, any changes you save are only temporary.

Hoax

There is an Internet joke about the Gullibility Virus, that is based on the propensity for users to forward e-mails to everyone the know without questioning whether the message is legitimate.

Virus (and other) hoaxes are part of the Internet. They never die out completely, but mutate into new forms. The key identifier is that they tell you to send an e-mail to as many people as possible. This is often supposedly because of a terrible virus, or because of some benefit of payment. The funny thing is that these hoaxes appear every few years with slightly different wording, but when you read a new one it's perfectly obvious where it came from.

Today we got hit with one of these, an e-mail telling you that if you forward messages to everyone you know, Microsoft will track it and pay you $10,000. I would think that this would seem absurd on the face of it -- Microsoft is rich, but not that rich -- but we still had people forwarding it to people in their address book.

It would only take a moment to double check the story.  In this case the message said the offer was made on GoodMorningAmericaToday. Notwithstanding the fact that those are two different shows, you would have thought that it might be mentioned on the Good Morning America or Today Show website.  And, with the amount of money promised, it should have shown up on all news websites:  CNN, Yahoo, Fox News, etc. How much trouble would it be to check this out?

Unfortunately, too many people don't follow this elementary precaution and do as the message says and forward it to as many people as possible (always without stripping out all addresses in the body of the message).

My rule of thumb on this is simple:  never believe a forwarded message.  And the odds the message is true are inversely proportional to the number of total recipients times the number of times "FWD" appears in the subject line.

In any case, never forward these messages. And if you are tempted, double check any of the claims made in the messages (if, say, CNN supposedly announced a new, dangerous virus, then double check the CNN web page).

It's not that hard. And wouldn't it be better not to appear so gullible?

The Hidden Messages

Siena had an e-mail storage quota to reduce storage space and, occasionally, you may get a message saying your over quota. This can be fixed by deleting messages and then emptying the Deleted Messages folder.

But, sometimes, it doesn't look like you have too many messages. Your inbox is small, and you've already emptied the deleted items.

There's another place to check:  the Sent Items folder. Outlook keeps a copy of every message you send. After awhile, this can take up a lot of space.  If you delete these messages and then empty the Recycle Bin, you'll be fine.

I make the rules

All mail programs let you set up filters to manage what gets into your inbox.  I find that people don't use these nearly enough. Not every message needs immediate attention; some can be moved to different locations. In addition, creating filters means you don't have to move messages into folders manually.

For instance, I get messages from a writing group I'm taking part in. In my Eudora mail client at home, those messages are put into their own folder so I don't have to have them clogging my inbox.

Here at Siena, we use Microsoft Outlook and Outlook Web Access. Microsoft, as is all-too-often their wont, has given the filters a different name than what everyone else uses:  they call them rules.  I never could understand that thinking.  When there is a standard term for something, shouldn't everyone be using it? (Though I will give Microsoft a pass for not using the term "MAC address.")

In any case, you create these in Outlook by using the rules wizard.  In Outlook Web Access, there is a rules creation form (discussed as a part of forwarding e-mail, but the same instructions apply to other rules).

Using rules is especially useful when you subscribe to a mailing list. Some lists have hundreds of messages a day, so by creating a rule, you can keep them out of your inbox. It's also easier to manage them:  if you want to get rid of them, just highlight and delete.

With a judicious application of rules, you can save your inbox for messages that you really want to be notified about, while still keeping the others to read when you have the chance.

*The worst example was when Lotus Notes used "database" to designate what were essentially discussion boards.

Don't Panic

A couple of weeks ago, I talked a little about how spammers use your own e-mail addresses as a way to trick spam filters. And though it was implied, I forgot to talk about one more issue that this creates: the fake bounce messages.

Many years ago, when the Internet was made up of nothing but nice people, the idea of spam and viruses were never a consideration. And the network was not always reliable. E-mail addresses changed or there were problems. Someone got the idea that one solution would be the equivalent of a "return-to-sender" in postal mail. So they set up the bounce message. It would tell the sender that the message didn't reach a recipient, and give a reason (no such address, mailbox full, etc.). This was useful for troubleshooting and as general information.

But viruses and later spammers eventually learned to "spoof" an e-mail address. This means to put a fake e-mail in the "From:" field of a message. This is usually chosen at random from the list of addresses to be spammed. The result is that you can get a bounce message saying the message is undeliverable -- even when you haven't sent a message.

This doesn't mean you have a virus. It's just that your e-mail address won the (un)lucky drawing. You can safely ignore the message. You may get several of them for a few days and then not see any more.

There's no real prevention. The reduce these (and for other reasons -- spammers use the bounce messages to determine what e-mails addresses are good ones), most system administrators turn off this feature. But there are always a few who don't bother or who aren't up to date with best practices, so the messages will be with us for a long time. Just delete the message and move on.

Hoax

I got my first question about a virus hoax this year today. That's progress.

What is a virus hoax? It's an e-mail message warning you of a virus. The first sign of one, is this warning:

PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS

That's the entire point of the hoax: to get you to e-mail the message to everyone you know.

Luckily, here at Siena, most faculty know not to do this, or at least to contact I&TS first. But students sometimes get caught.

It's a nice exercise in social engineering, of course. That's the term for fooling people into doing what you want them to do. This is harmless (other than causing needless anxiety), but other forms of social engineering are used to steal passwords and other security information.

It used to be you could plan for these every October. In September, thousands of Freshmen across the US got their first e-mail accounts, and by October, they learned how to FWD:FWD:FWD:FWD mail. Now it's less predictable and can happen at any time.

The messages can take many forms, but, oddly enough, they all contain this paragraph:

This is the worst virus announced by XXXX. It has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept.

I've been seeing these for over ten years, and 85% of them have some variation of this. The name of who announces it, who classifies it, and who discovers it varies, but the "Zero Sector of the Hard Disc" is almost a constant.

But that doesn't mean it doesn't change. The subject line varies, with new variants every few months. But lately, they've been adding this line:

checked snopes.com, and it is for real!! http://www.snopes.com/computer/virus/postcard.asp

Snopes is a site that debunks urban legends and hoaxes, and is a good way to check if a message is real or not. But the link given goes to a different message, one about a real virus. If you click on it and read it, you'll see it has nothing to do with what is in the warning e-mail (No "Zero Sector on the Hard Drive"). The sender is betting that you won't click on the link, and if you do click on it, you won't read the message to see that the link has nothing to do with the warning.

Until the Gullibility Virus is eradicated, virus hoaxes are going to show up from time to time. If you get one, search for the subject line in Google and you'll usually see it's just a trick.

"You" isn't you.

We've been getting a few questions lately about our spam filters. We use Postini to filter out spam, and it does a pretty good job.

But no spam filter is perfect. The more restrictive it is, the more likely it will block a message you want to recieve. I noticed this recently with my Yahoo e-mail: it had taken it on its own to block mail from a bunch of senders I wanted to allow. Luckly, you can just specify the message as not spam and then Yahoo will let it through.

So Postini, like all spam filters, has a procedure to notify you of messages blocked by your spam filter. And each day, Siena e-mail users get an e-mail listing what has been blocked.

If you go down the list, there's a good chance you'll see an e-mail "from" your own e-mail address. We've been getting calls about people who are worried that this might mean their accont has been compromised.

Well, fear not. It is trivial to fake an e-mail address. Back when I was using Netscape mail, you could put anything you want in the "from:" field*. This has become more difficult for the average user, but if you're sending spam, it's ridiculously easy.

Think of the "From:" on an e-mail as the return address on an envelope. There's no way to prevent someone from using your real address, even if you haven't sent the letter.

So why use your e-mail address for spam? There are two general reasons:

1. Many people put their own e-mail on a whitelist, so that if they e-mail themselves (say, a copy of an e-mail or as a way to transfer files), it will bypass the spam filters. Note, "bypass the spam filters." That phrase attracts spammers like garbage attracts cockroaches. So they develop software to match the "From:" field to the "To:" field. (Postini doesn't consider the "From:" field when scanning e-mail.)
2. Some spam chooses an e-mail address at random from the list of addressees to make it harder to trace. If it's yours, then you're the lucky one (you'll also get messages that your e-mail cannot be delivered).

So, what do you do? Nothing. It would be impossible to track down who actually sent the message (at least, impossible without getting law enforcement authorities with the right to subpoena involved). The fact that your name is being used is just luck of the draw, and doesn't mean there's anything wrong with your computer or that your e-mail account has been hacked. It can be safely ignored; just delete the message and don't think about it.

*Much of the early software for the Internet was based on the idea that "We're all good people and will play nice," so security wasn't even considered.

Avoiding E-mail Overload

Microsoft has put out a very good guide to help you reduce the feeling that you're getting overloaded by e-mail. The main suggestions are:

• Slash the number of new messages by unsubscribing to e-mail lists.
• Respond appropriately by not responding to every message.
• Take advantage of subject lines so people don't have to read the message to know what it's about.
• Summarize a message when forwarding and copying*
• Be disciplined and don't check your e-mail every five minutes. It will be there for you.
• Use e-mail tools.

The last one is the most overlooked option. Your e-mail client offers some good tools that can manage messages. For instance, I subscribe to several mailing lists. I use Outlook's Rules function to sort the messages into folders as they come in. The messages don't come into my Inbox and I don't get warnings as they arrive. Instead, when I have a moment, I check the folder.

There are also things you can do to help others. For instance, don't click the "Reply to All" button. Too often, people click this automatically, so everyone who recieved the message will also get your reply. There are very few cases where that is necessary; replying to the sender is sufficient. But if you use "Reply to All," people who weren't interested in the first message will get a second message they're not interested in. If you're discussing things among a group, then "Reply to All" makes sense, but not for general messages sent to groups. Alway use "Reply" unless you can come up with a good reason to reply to everyone.

*This is a real peeve of mine. Everyone has gotten the old "Fwd:Fwd:Fwd:Fwd:Fwd:" subject line where you have to scroll down four pages of nothing in order to get to the original forwarded message. Don't send off this sort of thing -- or, at least, delete everything except the message that you want to forward in the first place.

No Forwarding Addresses

I have one general rule for any e-mail that's mass forwarded: It's a lie.

I'm sure you get these every once in awhile. A friend forwards you an e-mail. When you scroll down to the bottom (because there are forwards upon forwards upon forwards of names and little >>>>>>'s down the left side), you find some dire warning or call to action. Maybe it's the worst virus ever. Maybe Bill Gates is going to give you $1000. Maybe Congress is going to pass a law outlawing toenails. In any case, it tells you to forward the e-mail to everyone in your address book (often with the line, "I'd rather get this twenty times than not at all").

It's a lie.

Something about e-mail leads people to believe anything sent is the truth. This tendency has been noted, leading to such things as the Gullibility Virus warning (I shouldn't have to tell you that this is a joke, but one never knows). And with Google and other search engines, it's very easy to check for real viruses. If Microsoft calls a virus "the worst yet," you can bet it will be mentioned on CNN.com, yahoo.com, or other news websites. It only takes a minute to check.

But, as a general rule, if you get a message that insists you forward it to all your friends, "It's a lie" is a good rule to follow.

No thanks for all the Phish

You're probably aware of this, but I thought I'd mention it: beware of phishing.

This is when scammers pretend to be a bank or other financial institution and send you an e-mail with a link. Usually, they give a seemingly urgent reason to go to the link and log in.

The entire goal is to get your login. From that point, they can go to the real site and log in as you and do whatever they want with your accounts. And, they aren't going to deposit money into them, that's for sure.

Banks don't send e-mails to their customers for anything important. If there were an issue, you'd get a letter or phone call. And don't be fooled because the website looks authentic; any web designer could do that in his sleep.

So never trust any e-mail from a "bank" (or from "Paypal" or "eBay") that urges you to log in (especially when there are spelling and grammar errors). If you have any questions, call the bank, or type their web page directly into your browser.