Security and privacy in webmail

Your mailbox is often the key to everything else: password resets for your bank, your domain and your other services arrive there. This guide sets up two-step sign-in for webmail, explains the security markers webmail shows on messages, and lists the habits that stop most attacks.

Before you start#

• Sign in to webmail.
• For two-step sign-in, install an authenticator app on your phone: Google Authenticator, Microsoft Authenticator, Authy, 1Password or any app that supports "TOTP" codes.

Turn on two-step sign-in (two-factor authentication)#

With two-step sign-in on, signing in to webmail needs your password and a 6-digit code from your phone that changes every 30 seconds. A stolen password alone is then not enough to get into webmail.

1. Press Ctrl+K (or Cmd+K) and choose Two-factor auth.
2. Click Set up two-factor.
3. Webmail shows a setup key (a long code of capital letters and digits).
4. In your authenticator app, add an account and choose Enter a setup key (sometimes "Enter key manually"). Type or paste the key. Use your email address as the account name, and choose time-based if asked.
5. The app now shows a 6-digit code for the account. In webmail, type it under Enter the 6-digit code it shows and click Verify & enable.
6. Webmail confirms "Two-factor is on for your account".

From now on, enter the current code in Authenticator code when you sign in.

What two-step sign-in covers#

• It protects webmail sign-in, including adding the mailbox as an extra account in someone's webmail window.
• It does not apply to mail apps (Outlook, Apple Mail, Thunderbird, the Gmail app). They sign in with the mailbox password only. Keep that password secret, and if a device is lost, make a new password in the panel (Email accounts).

Turn it off#

Open Ctrl+K → Two-factor auth, enter a current code and click Turn off two-factor.

Lost your authenticator?#

Without a code you cannot sign in to webmail, but mail apps still work with the password. Write to support@finitehost.com from your FiniteHost account's email address and name the mailbox; do not include the password.

Trust markers on messages#

Webmail checks every message and shows small markers next to the sender:

Privacy protections#

• Remote images are blocked until you click Show images. Senders cannot track when or where you opened their message.
• Scripts in messages never run. Messages are displayed in a locked-down frame.
• Encrypted connections only. Webmail is served over HTTPS and talks to the mail server over encrypted connections.
• Sessions expire after 12 hours without activity.
• Repeated failed sign-ins are slowed down and can block an address for a while.

Habits that stop most attacks#

1. FiniteHost never asks for your password by email or phone. Any message asking you to "verify your mailbox", "upgrade storage" or "re-enter your password" is phishing. Delete it.
2. Check where a link goes before clicking: hover over it on a computer, or press and hold on a phone. The real address is what counts, not the text.
3. Confirm bank detail changes by phone using a number you already have, never one from the email.
4. Sign out on shared computers (avatar → Manage profile → Logout) and do not let the browser save the password there.
5. Use a different password for every service. The mailbox password is generated by the panel and unique; never reuse it elsewhere.
6. If you suspect a leak, make a new password at once in the panel, then update your devices. Turn on two-step sign-in.

Troubleshooting#

What's next#

• Multiple mailboxes in one window
• Keep your mail out of spam
• Account security