Secure email

[markbot]

Anyone know what the best way to get secure email is?

Should I just trust gmail, yahoo mail, and hotmail?

I don't like the idea of my emails being saved anywhere, accessible to the email service.

There are services like hushmail out there that state of secure they are....but I still don't trust them.

Anyone setup their own email server?

[AlfonsVH]

The most secure way to send information might well be sending encrypted messages written in secret ink with a homing pigeon.

If skilled people really want to read your (unencrypted) mails, there are probably ways to intercept them, even when you use your own mail server.
If you use a third-party service, just be sure to read their privacy policy.

However, Hushmail is indeed supposed to be extremely secure, but I haven't read their privacy policy. If you're looking to send extremely sensitive information, your best bet might be to encrypt the mails beforehand with e.g. OpenPGP, paste the encrypted message in Hushmail (which you access via an anonymous proxy of course) and send it.
That way, only the recipient will be able to decrypt your mail.

[HarryT]

Given that your e-mail will be stored on the recipient's mail server, regardless of what you do at your end, this seems like a pretty pointless thing to worry about. It's best to consider anything you send by e-mail as being protentially "public" information, since you have no control over what the recipient decides to do with it.

[RWood]

Originally Posted by HarryT

Given that your e-mail will be stored on the recipient's mail server, regardless of what you do at your end, this seems like a pretty pointless thing to worry about. It's best to consider anything you send by e-mail as being protentially "public" information, since you have no control over what the recipient decides to do with it.

Plus if you are not skilled at security putting together your own email server will most likely be the least secure route. GMail is as secure as any other, perhaps more so as they can afford the firewalls to keep hackers out.

Most people are their own worst problem. Some years ago we got a copy of the password file (no associations with any accounts) and found that the following accounted for over 50% of all passwords:

• sail
• gold
• silver
• honey
• love
• password

So much for security for these folks. (Sail had over twice as many hits as the next entry.)

[pshrynk]

Originally Posted by RWood

Plus if you are not skilled at security putting together your own email server will most likely be the least secure route. GMail is as secure as any other, perhaps more so as they can afford the firewalls to keep hackers out.

Most people are their own worst problem. Some years ago we got a copy of the password file (no associations with any accounts) and found that the following accounted for over 50% of all passwords:

• sail
• gold
• silver
• honey
• love
• password

So much for security for these folks. (Sail had over twice as many hits as the next entry.)

Sail? Are there a bunch of sailors out there that don't bring it up, or something?

[slayda]

A combination of encryption and the "purloined letter method" might work. Some years ago I wrote a program that would append a file to an image file. If no one looked too closely, it looked just like an image file and in fact could be displayed just as an image would. Another program stripped out the added file for the intended recipient. If that file were encrypted, it would further add to security.

However as has been mentioned, if someone knew what to look for and had a good decryption program you'd still be SOL.

[animedude01]

Originally Posted by markbot

Anyone know what the best way to get secure email is?

Should I just trust gmail, yahoo mail, and hotmail?

I don't like the idea of my emails being saved anywhere, accessible to the email service.

There are services like hushmail out there that state of secure they are....but I still don't trust them.

Anyone setup their own email server?

It all depends on what exactly you mean by secure. There is no real security with e-mail for a number of reasons.

1) It's plain text and readable as is
2) You have no real control of your e-mail when it leaves your system

For 1, you can encrypt your e-mail with pgp or gpg and send the recipient the key offline.

For 2, you're just out of luck as that's how the Internet works. Your e-mail server looks up the recipients e-mail server and sends it there. That might sound like it's secure if you control your server and the recipient controls theirs, but what about all the routers and potential servers the mail passes through between those two points?

It all depends on how paranoid you are and what you're trying to achieve. If you read the terms of service for all the free mail providers it gives you an idea of what they do with the e-mail.

If you want true security, don't use e-mail. Use the offline methods. If you want to use e-mail, then encrypt all mail and give a copy of the key to the recipients.

Other than that, you have to accept that you have no real control of what happens to your e-mail once it leaves your system because that's all you can control.

You do have a modicum more control if you have your own server, but what if your recipient uses gmail/hotmail/yahoo etc?

Also, I remember reading somewhere that hushmail received a subpoena and gave up user names, so even that's not guaranteed.

Hope this helps.

[Trilby]

https://www.privacyharbor.com/

[acidzebra]

If you are truly paranoid I agree with the PGP/openPGP/gnuPG/pgpi suggestion; with mail encrypted before it leaves your system it doesn't matter what the provider is. In addition, while your own email server might "protect" you from peeping email service providers (unlikely as I find that) the mails will still not be protected on the various hops it makes to its destination and be vulnerable to interception.

Of course, with PGP you will have to have a receiver who is also capable/willing to decrypt.

[markbot]

Thanks for the suggestions guys. I've decided to to use google apps premium edition for my email and use a different alias for each website I frequent. this way I at least know if they r the source of spam and can shut them down. Also, I think google apps is probably more secure than anything I could put together on my own. and of course, I do have GnuPG encryption that I could use for super sensitive information.

[UncleDuke]

secure email, put a stamp on it and use the post office