In the meantime I've been doing a little additional research on solutions specific to securing email communication...
What most people do not realise is that by default, the vast majority of email and even passwords are sent over the internet in plain text that can be rmonitored by anyone. Sit down at a computer in a library, college or internet cafe and anyone else on that network can easily read the emails you send and receive, not to mention steal your password. There are several ways to avoid this depending on how you access your mail.
Most activists tend to use web based mail these days so we'll start with those.
If you look in the address bar on your web browser you will see that most addresses start with the letters http:// but sometimes you will see https://. The 's' indicates that the connection is using SSL, a secure encrypted link between your browser and the web server. Most browsers also display a locked padlock symbol somewhere to provide a visual confirmation that the connection is secure. When you are viewing webpages over a SSL connection (such as on Indymedia), the data being transfered is no longer in plain text and can not be read by people attempting to monitor you. This protection also applies to information you submit in web forms, such as usernames and passwords when checking webmail.
In other words, the most basic and essential thing to do to secure your email is use SSL connections if you use webmail. For example, if you use riseup webmail you should go to
![](/img/extlink.gif)
![](/img/extlink.gif)
We should now breifly look at the use of POP and SMTP for those not using webmail. If you don't know what these are, don't worry, they are two of the most common protocols used for downloading and uploading messages using an email client installed on your own computer. Examples of email clients include Outlook, Eudora, Pegasus and Thunderbird. Again, the problem you need to be aware of is that these protocols are by default not secure and all emails and passwords are sent as plain text. You need to configure your account settings within your email client to use a secure authenticated connection such as SSL. It's beyond the scope of this article to explain how but the help function of your client plus the help pages for your email provider will provide specifics.
It's obviously essential to use SSL (or similar) to protect your email password. However, when you send an email it will still travel over the internet in plain text as SSL only protects the connection between your computer and the server. To protect the contents of the email for the entire trip it will need to be encrypted so that only the intended recipient can read it.
You may have heard of PGP (
![](/img/extlink.gif)
![](/img/extlink.gif)
I will not go into detail how PGP works as there is plenty of information about it on the web. More important is how to use it. The trouble with PGP has traditionally been that people not to confident using computers have been unable to use it effectively. However, over the years it has become much easier to use as it has been provided with a simply graphical point and click interface and also intergrated into email clients. Once installed and configured correctly, it's now a simple mater of click decrypt or encrypt plus typing your passphrase.
There is the saying that a little knowledge is a dangerous thing and that is certainly true of encyrption technology. PGP uses Public Key Cryptography and it is vunerable to what is known as a man in the middle attack. This vunerability exists only during the exchange of public keys required to initiate exchange of encrypted messages. Again, it is beyond the scope of this article to describe the attack and you can easily look up the information elsewhere. The important thing is that if these keys can not be exchanged in person then it is vital to confirm that the keys have not been substituted on route. This is done by comparing the keys 'fingerprint' by reading them out on the phone etc.
Finally. They say misery likes company and so, ironicaly, does privacy. The more people who routinely encrypt their communications the more secure everyone becomes. If you were the only one using encryption then it might draw attention to you and anyone you communicate with. If you only use encryption for 'dodgy' emails then this might also attract attention. Once you have the software installed and configured it makes sence to use it whenever possible regardless of the contents of the email.
Further reading:
![](/img/extlink.gif)
![](/img/extlink.gif)
![](/img/extlink.gif)
![](/img/extlink.gif)
![](/img/extlink.gif)
Software
![](/img/extlink.gif)
![](/img/extlink.gif)
![](/img/extlink.gif)
![](/img/extlink.gif)
Comments
Hide the following comment
problems with PGP
18.12.2006 12:49
adslgdhasgf