Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

sending sensative files through email

Oct 27, 2006 5:27AM PDT

I was wondering how secure is email,and if i sent a sensative email from home to work would the contents of that file remain safe while traveling throughout the severs, and do the severs that the email travels through log and collect personal information?

thanks for your time

Discussion is locked

- Collapse -
Not secure at all.
Oct 27, 2006 5:46AM PDT

If you read the SMTP/POP3 email "spec" (or RFC) you find that such travels in PLAIN ASCII. Such is inadequate for secrets.

Email servers cache such content and if you had access to said server you can read anyone's email.

Broken? No.

Bob

- Collapse -
Reply to: Not secure at all.
Oct 27, 2006 4:22PM PDT

Hi Bob,I hope csnape 2003 doesn't mind me asking a further question regarding email privacy.Firstly, are all email servers the same, or is one better than the other?If there are privacy issues with sending copies of sensitive documents by email,then what do you think is the safest way? Not snail mail I hope.I thought emails were absolutely watertight.You have opened the eyes of a lot of email users,who like me didn't think there was even an issue regarding emails.Thanks.
Doug.

- Collapse -
Email Privacy
Nov 2, 2006 8:18PM PST

Your best bet would be to encrypt your sensitive emails before sending them from work/home or vice-versa. There are lots of programs out there, PGP (Pretty Good Privacy) being one of the better ones. It will handle the task for you almost automatically once you get it set.

- Collapse -
Email Privacy
Nov 2, 2006 8:41PM PST

Appreciate your reply Bozz5384,will check out PGP,and thanks once again for the info.
Cheers
DOUG.

- Collapse -
Encrypting emails
Nov 16, 2006 6:20PM PST

There seems to be an assumption that using strong encryption will secure the privacy of one@s emails. If you really want to protect it from the more or less casual snooper (by one's company for instance)
then a program such as Kremlin can provide a very high and almost unbreakable encryption such as "Blowfish". However, there is a downside to this in this age of terrorism and very intrusive governmental security monitorring of all forms of communication. Strongly encrypted email is an almost certain way to guarantee that you will come under close scrutiny and observation by the governmental security services.
Vic.M.

- Collapse -
reply to: Encrypting emails
Nov 16, 2006 7:00PM PST

Hi vicmohi,
When you come to think about it,I guess it would make a government intelligence authority suspicious, when a sender goes to unusual precautions to safe guard their email.
Thanks for bringing up that point.

Doug.

- Collapse -
Emails are like postcards
Nov 2, 2006 9:03PM PST

Emails travel over public networks, and are like sending postcards. Anyone with access to the network can read your email.

Like postcards, it's UNLIKELY for anyone to read your email. But, if you have a snoop (for example a company that doesn't respect your privacy, or government in most countries), you need to encrypt your emails for sensitive information.

For safest encryption, choose a good quality "public-key" encryption system (such as PGP, mentioned in another post).

Paddy

- Collapse -
Reply to: Emails are like postcards
Nov 2, 2006 9:20PM PST

Where is our privacy that we used to have.On ABC TV today, London has 4 Million cctv cameras.The future sure looks scary to me, Paddy.Looking into PGP.
Thanks
Doug.

- Collapse -
Securemail from Verizon.
Nov 3, 2006 3:03AM PST

An input here. I use Secure Mail. It provides the same as PGP, but integrates into outlook conveniently. Its a subscription service and I use the one provided by Verizon. (I'm not a Verizon customer or promoter) in any other way. It basically makes the encryption process simple and also ensures that the recipient is the only one who can read the email. Apparently lawyers use it and there are other providers than Verizon.

- Collapse -
Not secure at all
Nov 3, 2006 7:37PM PST

Even if you use codes and then tell the person on the other side the code. It can still be broken. Yes with a little bit of work but it is a simple program to make ( a program that just trys every code until one works). Do not use e-mail to transfer sensitive content, telephones are a little better but not by much.
P.S
best way: talk directly to the person

- Collapse -
(NT) (NT) Now .I am Confused!!!!!!!
Nov 3, 2006 8:45PM PST
- Collapse -
Security - Let's get this straight
Nov 4, 2006 9:17PM PST

Depending on who the "snoop" is, phone calls can be just as insecure as snail mail or email. In today's world, privacy is a luxury, not a right.

Private key encryption, where you and the other person need to share the same password, is only as secure as the weakest link in the chain. Most private key encryptions don't use strong encryption methods anyway.

Public key encryption, on the other hand, has stood the tests of both time and government. It has the advantage that it doesn't need two parties to agree on a password.

The use of high-end public key encryption is so strong that not even governments can crack it (which is why government doesn't want you to use it).

If government doesn't worry you, then you can use Verizon or one of the several equivalents. Otherwise, you must use a private program.

PGP was mentioned. There are other open-source and free programs available, too. Look around download.com and sourceforge.net, among others.

By the way, PGP provides (at a cost) a method of encrypting phone calls via VOIP over the computer, so that you can chat securely to another person on the other side of the world. I know there are other companies offering similar facilities.

Paddy

- Collapse -
private email
Nov 2, 2006 10:51PM PST

open a hushmail account. starts ouit free, best to buy an account. Mutiple levels of encrytion, once set up works like a dream and almost transparent.www.hushmail.com

Tarky

- Collapse -
Use VPN for your company
Nov 3, 2006 12:40AM PST

If you want truly secure and you send between home and company (or laptop on the road and company), use VPN. VPN is software (although HW boxes exist) which encrypts your message as it travels across the internet. Unlike using PGP, you do not have to do anything. You can use it for safe intranet browsing (of your company data) and even safe Microsoft network (//computername type access). It is generally easy enough to set up VPN and there are free versions around.
VPN uses a highly encrypted key for starting the connection and then sets up a different session key each time. This makes it very hard for someone to crack, yet keeps it lightweight enough for normal use.

As to email in general, note that few people (if any) are trying to snoop. The three bigger issues are people who send phishing emails (email cloaked to look legitimate, which gets you to go to a web page and give up sensitive info), people who get you to install spyware/malware/keyloggers, and people looking for passwords or other data through browser sessions.

The larger issue few realize is the openess of most WiFi links. Most homes and most free-Wifi links are open channel. This means that anyone can listen in. If you are sending private information that way, someone can see it. They are more likely interested in passwords and credit cards, but be aware that they can listen easily.

- Collapse -
An easy way out in this case.
Nov 3, 2006 3:20AM PST

Zip the file with a password, and mail it from your home to your own email box at work. Then unzip it again. All you've got to do is remember the password yourself, so there won't be any of the usual issues regarding password secrecy. So it can be considered 100% safe.

At the moment, I prefer using a USB-stick to transfer files between home and work. But it might be, of course, that the use of such devices is prohibited with you.

Hope this helps.


Kees

- Collapse -
Are you referring to the e-mail itself or attachments ?
Nov 4, 2006 12:09AM PST

Unless encrypted...the e-mail itself is as others have put it . . . like a post card. Same with attachments provided a reader has the right SW. But don't forget, you can password protect most files ... and provide the password in person, by phone or perhaps a separate e-mail.

Depending on the sensitivity, e-mail or e-mail attachment without good encryption may not be a viable method for transmitting such data.

VAPCMD

- Collapse -
email not hardly secure
Nov 4, 2006 3:08AM PST

In fact, all email can be read and tracked, especially by most corporations. I know of people who have lost their jobs, careers for violating the "Email policy". It can be violated, for various reasons, from stealing company secrets to discussing union organizing to setting an appointment to meet the CEO's wife for an afternoon delight tryst.. you get the point.

- Collapse -
Reply to: email not hardly secure
Nov 4, 2006 3:26AM PST

This has been a real eye opener for a lot of people,not only myself.When the next time arises,it's a toss up between Secure Mail by Verizon and PGP IMHO.
Thanks to all who posted and shared their knowledge and expertise on this subject.Much appreciated.
Doug.

- Collapse -
I'll pan "Secure Mail by Verizon" Here's why.
Nov 4, 2006 3:32AM PST

Any offering by such companies must by law have a back door for the governments to reach in and read or observe the content.

The author of PGP was dragged into court many times but they never did figure out what to charge him with so that was mostly just scare tactics.

If it is to be truly airtight then PGP gets my nod.

ZIP is next inline since they have to run it through a cracker such as http://www.lostpassword.com but if they sell it for 200 bucks the lock must be very lightwieght.

Please read articles such as http://www.gamers.org/~tony/pgp-legal.html

Here's why. It handily explains the WIFI encryption mess. And hints at why with KISMET, KISMAC your average hacker can listen in on WIFI networks.

Bob

- Collapse -
Hmmmm...I stated e-mail is NOT PRIVATE OR SECURE.
Nov 4, 2006 6:19AM PST

You're singing to the choir here.

What is it I said indicating general e-mail is secure or are you adding concurring comment ?

VAPCMD