Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account owner is responsible for some aspects (e.g. choose a strong password, partition your information by avoiding daisy-chaining), but the service provider also has responsibilities (e.g. verify identity of people calling support, provide robust authentication).

GMail offers two-factor authentication, and Yahoo has the same feature in beta (as of August 2012). Are there other aspects to consider?

UPDATE: I accepted the answer below. The discussion has reminded me to consider the people and process involved, not just the technology.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

For email security you can consider the following. These are common issues which are not well secured because of other factors, so the basics like XSS, virus scanning etc are not considered.

  • Strict SSL-only access with no known attacks like BEAST
  • Log of previous logon attempts
  • Encrypted storage
  • S/MIME, PGP support
  • TLS on SMTP and IMAP
  • High security application, which is not the case for most Webmail providers

So all of that is OK with GMAIL, Hotmail had issues with cookie handling recently (so it was enough to submit simple empty cookie for a session).

The most secure is to have email server on your own location, and protected the way, that without logging in with mailbox login / password, you cant read mail, and then simply run auto-update on the server, to make sure that the mailbox storage is not breached. Basically webmail with updates and good hardening does the effective trick good even for 100.000 mailboxes for business use.

share|improve this answer
2  
Could you go into more detail about how you're saying GMail is "OK" with S/MIME & PGP? As far as I know they don't implement anything particular to support e-mail encryption. Granted you can send PGP messages through GMail (I don't know about S/MIME) but I don't believe that's because of anything in particular that GMail itself does. –  Iszi Aug 7 '12 at 20:00
    
Heh, I use outlook for this, but via webmail it's not supported because the private key in browser is not implemented properly for s/mime or something. I have my own s/mime webmail trough no issues. –  Andrew Smith Aug 7 '12 at 21:16
    
Yes, I should have been more clear to specify that sending PGP via GMail (and, presumably S/MIME also) requires you to use an e-mail client that supports it - not the webmail interface. –  Iszi Aug 7 '12 at 21:21
add comment

Hushmail seems to be the standard for email security :

  • mail encryption is directly supported
  • you can either use it as a standard webmail with SSL
  • or install their Java applet that will encrypt your mails locally before going to their servers
  • your saved emails are strongly encrypted on their servers
  • mail headers are easily accessible (one click)
  • they only answer to Canadians court of law
  • they can't recover your password

For more : http://www.hushmail.com/about/technology/security/

share|improve this answer
    
Hi @jmn - welcome to Security Stack Exchange. Can you elaborate on why? A single line answer such as this is likely to get voted down as lacking in content. –  Rory Alsop Aug 8 '12 at 13:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.