Is snail mail or HTTPS webmail safer for sensitive information?

Question

I've been curious about the safety of e-mail lately. As far as I know, the most vulnerable point of communication is the local network you send your mail from. That is unless you're trying to keep things from a government, which could use laws, lots of resources and possibly advanced SSL spoofing techniques. But snail mail is insecure as well.

That said, would it be safer to send sensitive data to an institution through snail mail or using HTTPS webmail? I realize that sending your data directly to the institution's HTTPS site is safer than both of these things, but lets restrict this question to snail mail and common HTTPS-enabled webmail services. The e-mail will have to travel over the internet; in other words it's not a Hotmail-to-Hotmail message.

I'm wondering specifically about how likely it is that your message will be intercepted and read by someone else.

Answer 1

In terms of how likely it is that your message will be intercepted, webmail is definitely more vulnerable. Not for any special reason necessarily, just that the number of potential adversaries is higher. It's difficult for a malicious person on the opposite side of the world to reach into your local post office and pluck your correspondence out, but it's not hard to spy on e-mail traffic if you know where it's originating.

In absolute terms, however, the chance of any single message being intercepted is low. I can't speak for the rest of the world, but the United States mail processes ~554 million mail pieces per day. It is unlikely that a random malicious person will randomly latch onto your message.

E-mail is rather more prolific. A 2010 estimate had world e-mail production at ~90 trillion per year. Cutting out 90 percent of that as spam still leaves ~9 trillion a year. Even allowing for a large percentage of that to be internal communication that never sees the Internet, that is a large number of messages to sift through.

In the end, you really can't be sure, however. Security is HARD, and once something is out of your physical control, it's gone.

Answer 2

E-mail is not considered a secure distribution medium by most standards. This is why when your bank or any other organization that needs to communicate sensitive information should send an e-mail that asks you to log in to their website to get the message. There are secure e-mail standards out there, but it is difficult to ensure that they are followed by mail servers handling distribution.

You can use HTTPS webmail or TLS mail server connections, but that only protects communication from your local computer to the mail server. The mail server would have to require an encrypted connection as the mail is relayed to the destination server and the servers would have to be able to agree on the security. This isn't well supported or established at this time.

Your best bet is either using some type of client side encryption on a message that you e-mail or storing the information on a SSL secured website and requiring someone to access the site to get the information.

Snail mail is likely far more secure than standard e-mail as the message would pretty much have to be compromised at an end point (again, unless you are worried about a government) and physical security can be used on the end points. If you are worried about a government entity, all bets are off for either e-mail or snail mail.

Answer 3

When sending government-classified information to another site, protocol dictates that it has to be sent via snail mail (or courier -- no email), so the USA probably has some pretty compelling evidence that this is more 'secure'.

Granted, this depends on how trustworthy your country's postal system is.

One thing that I can think of is that as soon as you put any information on a system connected to the internet, you have no real guarantee that it only goes where you want it to go. Maybe on that machine you're sending the email from is a virus that is waiting for BigSecretFile.txt to be uploaded and then secretly sends it to a waiting attacker. With snail mail, if your recipient never gets the package, or your seal is broken on it upon arrival, you at least have reasonable certainty that your information has been compromised.

However, if you simply must ensure that nobody other than your intended recipient has your plaintext secrets, probably the safest thing to do is generate and then encrypt the data (with a sufficient key that only your recipient knows) on a machine that has never been connected to a network/is convincingly secure. After that, I don't think it's any more 'secure' to snail mail it or to email it from another machine as your data is encrypted either way, but snail mail still gives you a better chance of knowing if it's been intercepted.

Answer 4

Easy: For snail mail vs common HTTPS-enabled webmail services - just send encrypted containers. A truecrypt volume attached to an email, or on a USB stick in an envelope.

If the message must be in the clear, then I think snail mail is more likely to get through.

The marginal cost of examining an additional piece of snail mail is fairly large and static - someone needs to find it, open the envelope, read it, put it back. This means it's very very expensive (even in terms of administrative costs alone) to examine large volumes of mail.

In contrast, the marginal cost of examining one additional email is very low, probably close to zero, as it's all automated keyword searches.

In summary, I think the NSA are better at intercepting emails than the CIA are at intercepting letters :)

Answer 5

actually even with https webmail, the back-end communication to the other host (or even internally between servers) can go through plain in-the-open smtp to transfer the email to the other host. Kinda like having an encrypted wifi but have an intruder plugged into the wired trunk.

essentially you don't have control over the email once it leaves you and you are then reliant on the ToS and privacy policy of both your own mail host and that of the receiver and most importantly their implementation of it. You can choose your own host but not the other's.