Oh boy, a chain blog entry! Dave Walker called me out to talk about securing email; who am I to refuse?

You should secure your email. Am I done?

OK, so that’s not the best supported argument. If everyone secured their email there would be virtually no spam, but any system that doesn’t show benefits at even 10% participation is more or less doomed. However, the benefit of securing email kick in much earlier when dealing with phishers.

One thing I worry about is whether my relatives are able to tell spoofed emails from real ones, and that they don’t provide personal information to any site emailed to them. If large companies start taking security seriously, if they start signing their emails and educate their users to look for their signature, we’ll start to see a dent in phishing. If Amazon, eBay, PayPal and various banks start, they’ll influence the smaller companies to start doing it.

To help influence the influencers, you can (and should!) start signing your emails today. There are two ways to get started, and they aren’t exclusive. Many people use both signatures in their emails. Either one will take about 15 minutes, much less than getting your first email account set up probably took.

The first is to get a free S/MIME certificate from a company like thawte. I did this a while ago but I lost my certificate and had to try to retrieve my password. It was a frustrating process; I assume registering in the first place was as well since I used “Which company is pissing you off right now?” for my 5th security question. However, I still recommend this method as easier and tech support was very helpful.

There’s an amazing guide for OS X Mail, as well as instructions for Thunderbird on Windows, and these signatures work for virtually all email clients. As soon as you get your certificate installed, your emails will start showing up as secure. How cool will that make you look, when your clients see your email in their inbox highlighted as secure?

Answer: moderately to not at all cool, but they’ll still be impressed with the geek mystique.

The other way to secure your email involves creating your own signature using GPG. This involves creating a private key and a public key. You share your public key but you keep your private key, uh, private.

GPG and its predecessor PGP have been around for nearly 15 years, but have never really caught on due to the complexity. This still appears to be the case, I can’t find a guide on par with the OS X Mail guide for S/MIME. Virtually all guides tell you to go to the command line, which is unacceptable in 2005.

While these are half-assed instructions (they could benefit from screenshots and testing), they’ll get you a public and private key and have you signing your email in OS X Mail. Please post any good GPG guides you know of in the comments.

Start off by downloading Gnu Privacy Guard and GPG Keychain Access from Mac GNU Privacy Guard. Once both are installed, open up GPG Keychain Access and click the “New” button. The defaults should be correct, although you may want to make sure your name and email address are correct.

Once that’s done, download and install GPGMail. It should detect your key automatically and allow you to start signing emails as soon as you restart Mail.

If you’re using Thunderbird, try Enigmail, which I hear great things about.

I think the length of my post shows the complexity involved in securing email. However, if you do your part, you can help us reach a tipping point where the public demands secure email, and we can stop worrying about our parents accidentally giving their passwords to phishers. I think that’s worth 15 minutes of my time.

Oh yeah, and since this is a chain-letter meme, here are the people I would like to see blog about securing email:

(If I didn’t call you out by name, but want to blog about your experiences with securing email, I hereby deputize you to carry on the chain meme.


One response to “Secure Email Meme”

  1. Fair warning – I’ve encountered numerous bugs in the past (cirica 2000-2202). I believe the current generation of email clients are better, but the old ones are still around.
    My small company had a policy of signing (with S/MIME) all email messages. We required encrypted messages for long term relationships (partners or contrators). After almost two years of problems we retrenched and just encrypted selected messsages (likes ones containing source code, etc.).
    The worst problem, was that for unknown reasons the mail message would fail to verify. The recieved message looked identical to the sent message, but somehow the two signatures did not match. When you have to tell people “ignore the message saying it has been tampered with”, your signature does not have much value!
    We had a bunch of other problems too, ranging from unreadable messages (not all mail clients accepted S/MIME messages – even if there was clear text in ther somewhere), messages that could not be decrpyted, and messages that without warning were encrypted with a weaker algorithm (probably bugs left over from encryption export control days).
    Like I said, that was in days past. Things are probably better now, but don’t be surprised if people can’t read your message, and you find yourself having to say “ignore the error message”!

Leave a Reply