it.gen.nz

Writings on technology and society from Wellington, New Zealand

Thursday, July 24, 2008

Keeping your email secure

Today on Radio New Zealand National I talked about keeping your email secure. Nothing in email can be truly secure because its sent as plaintext across the Net, but there are steps you can take to make it harder for others to read your mail, and to make mail more usable if you travel.

Read on for my speaking notes or listen to the podcast.

Q: Keeping your email secure. Topical – plenty of the National Party’s email seems to have gone astray recently. How did that happen?

A: I have absolutely no idea. I wish I did know, along with most of the country, I suspect. The journalist concerned keeps saying he was given the emails by trusted sources who had a right to them. The National Party says that couldn’t possibly have happened so someone must have broken into their email system. The Police have investigated and said they have no evidence of an email break-in and have put it in the cold case file. And, although I’ve never had anything to do with Parliamentary systems security, I’d expect that to be fairly tight. So, I have no idea how those emails got into the wild, but I’m happy to give some general advice on keeping your stuff secure.

Q: Does it matter? Is email worth securing?

A: Obviously it is if you are a political party. Or a corporate – how many companies would accept their business plans ending up in the papers? Or government – we would all be outraged if emails containing our personal details were to be published or found in the street.

Q: Surely that happens?

A: Not with email – paper, sometimes, unfortunately. It’s easier to lose a paper file than it is an email, provided you are taking basic email precautions. If you aren’t taking any precautions, then losing email is very easy.

Q: What do you mean by losing? Losing it altogether or someone else getting a copy?

A: Both are possible. Let’s just talk about email works, for a minute. Email relies on what are called mail servers. These are computers out on the Internet that do two different things: they transmit email across the Internet to each other, and they hold email on your behalf until your computer collects it off them. These are two different functions, and they have different Internet protocols to support them.

Q: These servers are not my computer at home?

A: No, yours and my computer play less of a role – they are what we use to prepare email and to read it, but the actual infrastructure is out on the Internet.

Q: How do I know which mail servers I am using?

A: When you are at home you are probably using the email servers provided by your ISP, your Internet Service Provider. If you are using, say, Paradise, your mail server will be something like smtp.paradise.net.nz – I haven’t checked the exact name.

Q: And Xtra?

A: Xtra outsourced all this stuff to the Australian arm of Internet company Yahoo earlier this year, and it didn’t go well. Anyway, you can see – and change – the name of the mail server you are using in the software you use to read your mail – your mail client program, in the jargon. That program might be Thunderbird or Outlook if you are on Windows, or Apple Mail on a Mac, or perhaps Evolution or Thunderbird on an open source machine.

Q: What about Gmail or Hotmail?

A: Gmail and Hotmail are webmail systems. That means, there is no client computer – you can use any web browser on any computer. You don’t need Outlook or any of the other programs. Gmail is providing both the client program and the servers. That’s really useful because you can sign on to your email anywhere – you don’t need your own computer with you. Lots of ISPs have webmail as well, so that you can check your home email using a web browser at your office, for instance.

And that’s another useful point – mail is delivered to your client computer using something called POP – post office protocol – or IMAP – Internet Mail Access Protocol. You use one or the other. IMAP is better. It’s a good idea to check which you are using if you don’t know, and if its POP, you should see if your ISPs mail server will let you use IMAP – look on your ISPs web page under setting up email for more information.

Gmail also provides access to its servers for people who don’t want to use the one provided by their ISP. Sometimes that can be very useful.

Q: How about security?

A: For a home machine, or one you use traveling, the main risks are that someone gets access to your mail account on your mail server, or that they eavesdrop on your communications. Eavesdropping is technically quite easy – we’ve talked before about how email normally travels across the Internet as plain text, its not coded in any way. You can do something about this – and you should, especially if you use public wi-fi services to get to the Internet because anyone on those can see what everyone else is doing if they know how to look. You can give away the password to your email account without meaning to this way.

Q: How should you secure your email?

A: You need to set your mail client to use a secure connection – that means all the traffic between your computer and your mail server is encrypted. For this to work, your mail server has to support it. Some do, some don’t. I suggest you try it and see. In your email client’s menus, look for where the incoming and outgoing mail servers are set up, and see if there’s a tick box saying “use secure connection” or “use SSL” or “use TLS”. Try turning them on, and see if you can still connect. If you can, leave them on. If you can’t, and you are on a laptop that you take to public wi-fi areas, then consider using another mail server. You can set up a Gmail account if you want to use a free account, or you can use a commercial email provider like Fastmail.fm. Both of these will let you create an email account that you can get you securely, then you can change email client to only connect with secure connections.

Q: What about webmail? How can you make that secure?

A: Again, you need to be using a webmail server that allows secure connections. Then you type into your browser https:// before the server address – like when you use online banking, the https means you are getting a secure session.

Q: That’s hard to type!

A: So just store it in your bookmarks.

Q: What if I’m out and about and I don’t have a laptop?

A: You can get a mobile phone that does email, but if you are reduced to using a cybercafe – they can be very insecure. Some of the machines have spyware on which can collect your email password – or even worse, your online banking password – and send it away. Really, I try very hard to avoid using cybercafes for anything that requires me to put a password in. I’d never use on for online banking. But if I have to, I’ll enter my password piecemeal and move the cursor around with the mouse.

Q: How does that work?

A: Say my password is 123456. It should never be something as obvious as that of course, but it’s easier to explain that way. So, I’d type 45, then I’d click the mouse at the beginning and type 123, then I’d click the mouse at the end and type 6. That will confuse some kinds of spyware. It’s certainly not foolproof. The best solution is just not to. Incidentally, that’s why a lot of corporates and government departments choose not to allow their employees to collect their work email via the Web – they are worried about the passwords being given away.

Q: Can it happen that you just lose email altogether?

A: Email is unreliable by design. You can never be certain that any particular piece of email will get where it was going, and you may not get a note to say so. There are lots of things that could go wrong, such as mail servers crashing, or spam filters eating your message. But it almost always does get through. When it arrives at your computer, do you read it and delete it?

Q: Once I’ve read it, yes.

A: I keep all mine in an archive. Using an IMAP server, I set up a folder called archive and, instead of deleting email when I’ve read it, I put it into the archive. And that gives me a searchable list of everything I’ve received. That can be really useful – I don’t have to try to create a filing system, I just search. For instance, whenever I book a flight online, I just throw the emailed e-ticket into the archive, then when its time to fly I just search on Air New Zealand or whatever and print it out. And Gmail takes this approach a step further by automatically keeping all your email.

Q: Maybe I don’t want the emails I send people to be kept!

A: That’s tough, pretty much, because once you’ve sent it, the person at the other can do what they like with it. You can ask them to delete it, but you can’t make them.

Links

How email works.

Free email from Google and Fastmail.

posted by colin at 11:50 am  

4 Comments

  1. Shame on you, Colin, for not mentioning Pegasus Mail, made right here in New Zealand.

    p.s. the links to Google and Fastmail are not working.

    Comment by Peter Lynch — 24 July 2008 @ 12:37 pm

  2. Peter

    You are right, I should have mentioned Pegasus even though client software wasn’t my point today. David Harris – if you’re reading this, sorry. Colin.

    Comment by colin — 24 July 2008 @ 12:53 pm

  3. “Nothing in email can be truly secure because its sent as plaintext across the Net”.
    What about public key cryptography? I would suggest that the National Party (and any other parties that are worried) should look at using that.

    Comment by Tim McKenzie — 28 July 2008 @ 4:34 pm

  4. Decent crypto can indeed protect email contents from most eavesdroppers – but it’s generally hard to use (compared to email without crypto) and doesn’t play well with corporate email systems. Yes, you can provide smart cards with keys on to users but most people won’t use them. Crypto right to the desktop is hard to use.

    The public service has been running a crypto layer on everyday email for years. It’s completely transparent to the end users. It works through the various departments’ mail servers recognising each other and encrypting all traffic between them automatically. Crypto is only applied during the transit across the Internet; not down to the desktop. Users are barely aware of the system. This works well – but it wouldn’t have solved the National Party’s problem – even if they used this system – unless their emails were leaked as a result of eavesdropping while they were being transmitted across the open Internet.

    In the National Party case the journalist concerned has said several times that he was given the emails by someone with a right to have them. Crypto won’t fix that.

    Comment by colin — 30 July 2008 @ 7:25 am

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.

Powered by WordPress