Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit?
Regarding plain text, hackers can easily scan emails for text that matches. Is it worth encrypting photos to be sent by email, say in an encrypted zip? Or is this overkill?
Emails are not protected. If an attacker is specifically against you and has technical read access to your emails, then he will be able to open pictures and see their contents. Encoding text as pictures is good only to deter robots. This uses the known facts that although human brains are, as far as computing goes, remarkably feeble, they are outstandingly good at image recognition. That's the reason we write with, say, writing: our brains are easily trained to recognize contiguous ink blots as letters (or other glyphs), filtering out visual noise automatically.
CAPTCHA systems use the same principle. They try to defeat automatic scanners. In practice they don't work so well, in part because attackers have learned to hire cheap human labour to do the image recognition part.
An encrypted Zip is something really different. This is cryptography. It does not work on the hardness of recognizing letters within a picture; it works on the hardness of breaking an encryption algorithm if the key is not known. An encrypted Zip will deter attackers, and prevent even targeted, human-controlled eavesdropping; but it will do so only if the decryption key (the archive "password") can be conveyed to the intended recipient without showing it to the attacker. Do NOT write the Zip password in the email itself (don't laugh, I have seen it done -- you may cry, though; that's what I did). A Zip archive protected with a password that you give to the recipient over a phone call ought to be effective against most attackers (if the bad guy taps on your emails and on your phone, then you probably have bigger worries).
If you send it in an e-mail and it isn't encrypted, then it is effectively public information. If I was a hacker, I'd find attachments in e-mail messages to be FAR more interesting than any text matching.
