Oh boy, a chain blog entry! Dave Walker called me out to talk about securing email; who am I to refuse?
You should secure your email. Am I done?
OK, so that’s not the best supported argument. If everyone secured their email there would be virtually no spam, but any system that doesn’t show benefits at even 10% participation is more or less doomed. However, the benefit of securing email kick in much earlier when dealing with phishers.
One thing I worry about is whether my relatives are able to tell spoofed emails from real ones, and that they don’t provide personal information to any site emailed to them. If large companies start taking security seriously, if they start signing their emails and educate their users to look for their signature, we’ll start to see a dent in phishing. If Amazon, eBay, PayPal and various banks start, they’ll influence the smaller companies to start doing it.
To help influence the influencers, you can (and should!) start signing your emails today. There are two ways to get started, and they aren’t exclusive. Many people use both signatures in their emails. Either one will take about 15 minutes, much less than getting your first email account set up probably took.
The first is to get a free S/MIME certificate from a company like thawte. I did this a while ago but I lost my certificate and had to try to retrieve my password. It was a frustrating process; I assume registering in the first place was as well since I used “Which company is pissing you off right now?” for my 5th security question. However, I still recommend this method as easier and tech support was very helpful.
There’s an amazing guide for OS X Mail, as well as instructions for Thunderbird on Windows, and these signatures work for virtually all email clients. As soon as you get your certificate installed, your emails will start showing up as secure. How cool will that make you look, when your clients see your email in their inbox highlighted as secure?
Answer: moderately to not at all cool, but they’ll still be impressed with the geek mystique.
The other way to secure your email involves creating your own signature using GPG. This involves creating a private key and a public key. You share your public key but you keep your private key, uh, private.
GPG and its predecessor PGP have been around for nearly 15 years, but have never really caught on due to the complexity. This still appears to be the case, I can’t find a guide on par with the OS X Mail guide for S/MIME. Virtually all guides tell you to go to the command line, which is unacceptable in 2005.
While these are half-assed instructions (they could benefit from screenshots and testing), they’ll get you a public and private key and have you signing your email in OS X Mail. Please post any good GPG guides you know of in the comments.
Start off by downloading Gnu Privacy Guard and GPG Keychain Access from Mac GNU Privacy Guard. Once both are installed, open up GPG Keychain Access and click the “New” button. The defaults should be correct, although you may want to make sure your name and email address are correct.
Once that’s done, download and install GPGMail. It should detect your key automatically and allow you to start signing emails as soon as you restart Mail.
If you’re using Thunderbird, try Enigmail, which I hear great things about.
I think the length of my post shows the complexity involved in securing email. However, if you do your part, you can help us reach a tipping point where the public demands secure email, and we can stop worrying about our parents accidentally giving their passwords to phishers. I think that’s worth 15 minutes of my time.
Oh yeah, and since this is a
chain-letter , here are the people I would like to see blog about securing email:
- Kenyatta Cheese
- Bri Cors
- Brian Kerr (his post about securing Entourage)
- Scott Trudeau
- Ed Vielmetti
(If I didn’t call you out by name, but want to blog about your experiences with securing email, I hereby deputize you to carry on the