It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit?

Regarding plain text, hackers can easily scan emails for text that matches. Is it worth encrypting photos to be sent by email, say in an encrypted zip? Or is this overkill?

  • well, how hard can it be to scan an image? Aug 21 '13 at 19:47
  • 2
    Optical Character Recognition will only get better with time. An image file containing computer-generated (here used in the sense of "as opposed to hand-written") text is trivial to process with OCR techniques. Hand-written text is more difficult to process programmatically, but cannot by any means be considered to be secure. Aug 21 '13 at 20:03

Emails are not protected. If an attacker is specifically against you and has technical read access to your emails, then he will be able to open pictures and see their contents. Encoding text as pictures is good only to deter robots. This uses the known facts that although human brains are, as far as computing goes, remarkably feeble, they are outstandingly good at image recognition. That's the reason we write with, say, writing: our brains are easily trained to recognize contiguous ink blots as letters (or other glyphs), filtering out visual noise automatically.

CAPTCHA systems use the same principle. They try to defeat automatic scanners. In practice they don't work so well, in part because attackers have learned to hire cheap human labour to do the image recognition part.

An encrypted Zip is something really different. This is cryptography. It does not work on the hardness of recognizing letters within a picture; it works on the hardness of breaking an encryption algorithm if the key is not known. An encrypted Zip will deter attackers, and prevent even targeted, human-controlled eavesdropping; but it will do so only if the decryption key (the archive "password") can be conveyed to the intended recipient without showing it to the attacker. Do NOT write the Zip password in the email itself (don't laugh, I have seen it done -- you may cry, though; that's what I did). A Zip archive protected with a password that you give to the recipient over a phone call ought to be effective against most attackers (if the bad guy taps on your emails and on your phone, then you probably have bigger worries).

  • And don't do what my mortgage bank did and email me an encrypted document that contains personal information, and tell me in the body of the email that it's encrypted with the last 4 digits of my Social Security Number. A keyspace of 10,000 entries is barely better than no encryption at all.
    – Johnny
    Aug 21 '13 at 21:28

If you send it in an e-mail and it isn't encrypted, then it is effectively public information. If I was a hacker, I'd find attachments in e-mail messages to be FAR more interesting than any text matching.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.