18
votes
6answers
989 views

What needs to happen for email encryption to go mainstream? [on hold]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
62
votes
12answers
20k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
0
votes
2answers
110 views

Best practice for sending IP Addresses

IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a ...
0
votes
1answer
60 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
4
votes
5answers
167 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
7
votes
3answers
484 views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
-1
votes
2answers
104 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
3
votes
3answers
280 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
1
vote
0answers
36 views

Needed: Reference data on the rate of adoption of secure email protocols [closed]

I am working on a security presentation in which I need to show that the incidence of unencrypted email protocols (e.g. POP, IMAP without STARTTLS) over the past 10 years has decreased and the amount ...
0
votes
1answer
136 views

Metadata-free Email: How can SENDER directly, anonymously, and securely ask RECIPIENT’s mail provider to deliver a metadata-free email?

If I want to send emails to friends who use Google, Yahoo, AOL, etc., how can I currently use my local email client to send a metadata-free* email to them? E.g., is it possible to bypass my own mail ...
3
votes
3answers
308 views

Backup personal email on VPS - privacy, security and trust risks

FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives. What I'd like to do is back up to my VPS, which ...
2
votes
1answer
72 views

Layered email encryption with multiple private keys on separate media

I'd like to encrypt e-mail messages so that multiple physically separated keys are needed to decrypt them. For example, I'd like to have three private keys stored on different media, as in: key A ...
3
votes
2answers
289 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
1
vote
3answers
150 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
1
vote
1answer
66 views

Storing opened mail attachments unencrypted in /tmp is a normal thing?

So there is an E-mail client. I can encrypt its database with a few clicks in its menu. But it's storing the opened attachments unencrypted in /tmp/foo/bla.xls. The bla.xls has 644 UNIX permission ...
-1
votes
2answers
74 views

encrypted emails and keyservers

I read that encrypted emails are secure, cause only who has your public key can decrypt it. I also read that it's a common thing to upload your public key on a keyserver. But if my encrypted email ...
-2
votes
2answers
160 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
0
votes
1answer
138 views

How do I determine S/MIME encryption used?

From what I understand it seems that S/MIME uses PKCS #7 which can handle various different types of encryption. How is the choice of encryption method made by the e-mail client and how do I know what ...
1
vote
1answer
253 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
3
votes
1answer
396 views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
1
vote
1answer
412 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
3
votes
8answers
2k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
4
votes
2answers
215 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
2
votes
1answer
244 views

Why should I pay for an email S/MIME certificate?

There are quite a few SSL certificate companies out there that offer free email S/MIME certificates. There are also paid versions as well. I need about 6 email certificates for some company email ...
5
votes
4answers
327 views

A Secure Email Host Architecture

How would one go about creating a secure email architecture? I'm thinking specifically about protecting email from routine surveillance from oppressive regimes and corporations. I had a think about ...
-2
votes
2answers
375 views

How to minimize your fingerprint, or become invisible on the web? [duplicate]

With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
-3
votes
2answers
150 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
3
votes
1answer
332 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...
-1
votes
2answers
267 views

Hiding emails from Google [closed]

From what I understand Google reads/scans all my emails so that they cab "provide" targeted ads and maybe for other reasons. If a have a group of people who want to hide their emails from Google, how ...
3
votes
2answers
4k views

is it possible to use smime in the webclient of gmail?

I could not find any options in the webinterface of Gmail. all I could find was a Firefox plugin to use SMIME with Gmail, but it seems to be outdated
8
votes
1answer
703 views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
4
votes
3answers
979 views

Can email be encrypted before it reaches the mail server? If not, is there something that would allow something like this that's being worked on?

I was thinking about hosting my own email (own email server) instead of using Gmail. But then I realized I could never host my email on a server where I'm also hosting Wordpress. That is because I ...
5
votes
5answers
482 views

HOWTO : Email encryption in a browser

I have read about encryption and I think it's a good idea for me to encrypt my email. I run ubuntu 12.10 and use Firefox for browsing. In my quest for learning how to use gmail/hotmail to send and ...
8
votes
6answers
506 views

Security of email [duplicate]

Possible Duplicate: How commonly are SSL/TLS or S/MIME used by e-mail providers? Say, Alice uses gmail and Bob uses hotmail. Alice wants to send an email to Bob. Alice goes to gmail ...
10
votes
5answers
493 views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
1
vote
2answers
1k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
50
votes
5answers
10k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
3
votes
1answer
372 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
5
votes
3answers
763 views

Is TLS flawless enough to prevent eavesdropping carried out by an ISP?

I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic. Will that prevent ISP and ...
4
votes
3answers
278 views

Why don't more services offer encryption for email notifications?

I understand that using encryption for email isn't particularly mainstream (a fraction of a percentage of users, at a guess). Is that the only reason that banks and other sensitive companies do not ...
0
votes
1answer
222 views

GoogleMail encryption

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about ...
9
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
8
votes
1answer
322 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
1
vote
1answer
2k views

What algorithm/encryption type does Gmail use for security?

In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
3
votes
3answers
172 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
14
votes
9answers
5k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
22
votes
4answers
12k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
2
votes
2answers
415 views

How secure is Goodlink for mobile phones when compared to Activesync?

Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink. One argument is the ...
7
votes
3answers
418 views

How Reliably do mail systems transmit Encrypted PDFs

We have an solution design that will be sending Encrypted PDF's to our many clients, who will all be using varied email providers. We have tested the pdf's through the usual cast of internet mail ...
22
votes
3answers
12k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...