emails

[whiskeryron]

Hi all, in the past I have received messages from postmaster telling me that my email could not be sent due to some error,which I corrected. This leads me to ask the question :- How secure are our emails when we send them, are they able to be read by a third party & if so is there a way of sending mail that can only be read by the person I am sending it to ?

[ChuckFickens]

"how secure are emails"

Not at all secure, they were never intended to be a secure means of communication.

Only way to send secure emails is to encrypt them

http://office.microso...ages-HP001230536.aspx

But obviously you need to make sure the recipient has the key to decrypt the mail when they receive it.

[squarebear]

Emails are about as secure as shouting your message across a crowded room. NEVER use a plain email to send any important information.

[babe115522]

hello ,
well i get the same too but i think they are secure :)
and you will be fine but i just think they dont accept bad launage thats why they say its an error :)

[ChuckFickens]

^ Eh?

[KaiHallarn111]

babe - They are not secure. I'm studying forensic computing and one of the things we did in the labs was to send an email using a fake email address. Couple that with the fact that government security people can read emails being sent across the internet and you have a method of communication which is no way near as secure as you think it is

[KaiHallarn111]

Only way to send secure emails is to encrypt them - Not quite as secure as you would think. As I said before, if the government take an interest in what your sending via email, then they will be able to read them, no matter what encryption they have. Also the ISP can read them

[squarebear]

Anyone can send an email that appears to come form anyone else. It is as unsecure as you can get.

[marval]

I get e-mails supposedly from myself, how secure is that. E-mails are not secure, never send anything you don't want other people to see.

[ChuckFickens]

"Also the ISP can read them"

I'd doubt that as long as they are encrypted with decent encryption then the body off the message is encrypted before it leaves your local computer and is not decrypted until it reaches the receiving computer so at all points while it's passing through the ISPs networks it will be encrypted, And I seriously doubt ISPs have the means to crack 256bit encryption cyphers.

Of course if you are referring to web mail services then they probably could read them, but anyone who sends an encrypted email using a webmail service and expects it to be fully secure deserves everything they get.

[KaiHallarn111]

"And I seriously doubt ISPs have the means to crack 256bit encryption cyphers."

They would not need to crack them at all. They would have the relevant keys and if not, as an ISP, they would be able to obtain them.

[ChuckFickens]

How would they have the private key? or access to it?

For example, if I was to encrypt an email using PGP version 6 (one of the versions before it was sold out so from when the source code will still publicly available and checkable for backdoors ) and made sure the private key was sent to the receiver in a secure manner I can't see how my ISP cold get their hands on anything that would enable them to read my mail.

[babe115522]

ohh rightt well my teacher tells me they are :P so im not really sure but from now on im goi9ng make sure i dont right nothin stupid on it :)

[ummmm]

Anything...

Or you will be writing something stupid.!

[KaiHallarn111]

I'm presuming that if the ISP see a security risk in a particular user, they will request said key from the company that created it.

[ChuckFickens]

But I will have generated the keys, so who could they ask to supply them?

(I'm not being argumentative here BTW, as you are studying forensic computing I expect you do have a greater knowledge than me of these things, I am genuinely interested though)

[whiskeryron]

Thanks to all of you who answered my query, as always I received good genuine answers, so now I know, don't commit anything to the internet that I don't wish to share.

[squarebear]

"don't commit anything to the internet that I don't wish to share"

Exactly right. This also appiles to things like facebook as many employers will put the names of job applicants into google and see what comes up about them.