If you think your email is fully protected from hackers, think again. A lack of sufficient email security measures can result in data theft, unauthorized access to sensitive information and the invasion of your computer by viruses and malware. Here are some tips to secure your email account from unwanted intruders and the many troubles that come with them.
Email is the most ubiquitous method of communication on the Internet – maybe even on the planet. It’s built into almost everything, from phones and tablets to traditional computers to gaming devices – heck, even connected home appliances and cars can do email. More importantly, being “on the Internet” means having an email address (or dozens of them); they’re our IDs, how we sign up for things, how we receive notices, and sometimes even communicate with each other. Email is the original “killer app.”
But email was not designed with any privacy or security in mind. There have been many efforts to make email more secure, but the recent shutdown of highly-touted secure email services like Lavabit (reportedly used by NSA leaker Edward Snowden) and Silent Circle in the wake of government surveillance programs highlight the difficulties. Lack of email security is also having some surprising collateral damage, like the announced shutdown of the respected software and law blog GrokLaw.
Is email security hopeless? Are we looking at the end of the Internet’s killer app?
Why isn’t email secure?
Email isn’t secure because it was never meant to be the center of our digital lives. It was developed when the Internet was a much smaller place to standardize simple store-and-forward messaging between people using different kinds of computers. Email was all transferred completely in the open – everything was readable by anyone who could watch network traffic or access accounts (originally not even passwords were encrypted). Amazingly, email sent using those wide-open methods still (mostly) works.
Today, there are four basic places where most people’s email can be compromised- on your device(s), on the networks, on the server(s) and on your recipient’s device(s)
The first and last places – devices – are easy to understand. If someone can sit at your computer, grab your phone, or swipe through your tablet, odds are that your email is sitting right there for them to read – You do use a lock screen or password on your devices, right? Same thing goes for your recipients’ devices. But even passwords and lock screens sometimes aren’t much help. While a few email programs encrypt the email messages they store on the device, most don’t. That means anyone (or any program) that can access the device’s internal storage can probably also read email and get to file attachments. Sound far-fetched? It doesn’t have to be a person; rifling through email is one of the most common things malware does.
Networks are a little tougher to understand, and covers three basic links:
– Your connection to your email provider (whether that be your ISP, Google, Outlook, Yahoo, Apple, or someone else).
– Any network connections between your email provider and your recipient.
– Your recipient’s networking connection to their email provider.
If you’re sending email to someone on the same service you use (say,), you have at least the first and third potential network vulnerabilities: your connection to and your recipient’s connection to . If your recipient’s email is elsewhere (say a company or school) then you have at least one more: the connection between and your recipient’s email provider. The reality of network topography means each of those connections involves a series of routers and switches (perhaps a dozen or more), probably owned and operated by different outfits. If one connection is secure, there’s no guaranteeing any other connection in the sequence is secure. And if you’re concerned about things like the NSA’s PRISM surveillance program, indications so far are that some of it happens at these interim network points.
Read more about why email isn’t secure at digital trends.
5 tips to secure your email
Use separate email accounts
Most people use a single email account for all their personal needs. As a result, information from websites, newsletters, shopping deals, and messages from work get sent to this one inbox. But what happens when someone breaks into it? There’s a good chance they would be able to gain access to everything else.
Having multiple email accounts will not only boost your security, but also increases your productivity. You can have a personal account to communicate with your friends and family, another solely for receiving emails from work, and one recreational account for various website registrations and getting newsletters. Wise email users never put all their eggs in one basket!
Set strong passwords
Too many email accounts have predictable passwords. You might be surprised to learn that email passwords like ‘123456’, ‘qwerty’, and ‘password’ itself are still the most common around. For the sake of security, be a little more selective with your passwords. Spending a few moments on coming up with a good password will be beneficial in the long run. Mix upper and lower case letters, numbers, and special characters to form a unique password that makes sense and is memorable to you, but no-one else. Also, never use the same password for all your email accounts. This way, if someone hacks one of your accounts, all of the others are still safe.
Beware of links and attachments
When you see a link in an email, don’t click on it unless you’re expecting the link from a known source, such as from your friend or a confirmation link for your game account registration. The truth is that you never know where those links might lead you. Sometimes they can be safe, but other times they can infest your computer with viruses and malware.
Similarly, if you’re expecting a file from your friend or family, then go ahead and open the attachment. It’s always good to know the person sending the file. But be wary of attachments in emails from strangers. Even if the file name looks like a JPEG image, you should never open it. File names can be spoofed, and innocent files may be a clever virus in disguise, ready to latch itself onto your computer the moment you click on it.
Beware of email phishing
Phishing is a type of online scam when malicious users send you an email, saying that they’re representatives from high-profile websites like eBay, Facebook or Amazon. They claim that there’s a problem with your account, and that you should send them your username and password for verification. The fact is that, even if there was a genuine issue with your account, these companies would never ask for your password. You should ignore these phishing emails and sweep them into your spam box.
Encryption to the rescue!
The best way to protect communications is to encrypt them: basically, scrambling the data with complex mathematical transformations so it’s only intelligible using the correct password or other credentials. A common form of encryption is public key cryptography, where people (or ISPs or companies) give away a public key that anyone can use to scramble data intended for them, but can only be decoded using a private key that the person (or ISP or company) keeps secret.
Public key cryptography is the basis of two primary ways to protect email- Encrypting messages and Encrypting network connections.
The idea behind encrypted messages is straightforward: instead of sending plain text anyone can read, you send scrambled gobbledegook only the intended recipient can read. Common tools for encrypting email include PGP (now a commercial product from Symantec) and numerous mainstream apps and tools that support the open source OpenGPG and S/MIME. Encrypting messages is a straightforward idea, but the approach has pros and cons. On the positive side, encrypted messages are protected across both networks and servers, even if they’re compromised or store messages as plain text. (The gobbledegook could make Gmail serve up some weird ads, though!) The message is probably also encrypted on your device and your recipient’s devices (until they decode it), which offers some additional protection.
Now the downsides. Encrypting individual messages is a pain. You have to have the public key of everyone you want to communicate with securely. For one or two people, that’s not bad, but most people have dozens (or hundreds) of contacts. Getting all of them up and running with public key cryptography won’t be easy. Further, everyone who wants to send you secure email needs your public key! You can send it to them via email … but that won’t be encrypted so it’s not secure. Same with a blog post or a Facebook page or keyserver services or any other insecure channel. The only really safe way to exchange public keys is face-to-face or some other way you can be truly sure you’re getting the right key from the right person. That can be wildly impractical. Some folks who send you sensitive email – like banks, credit card companies, hospitals, schools, or the local fertility clinic – probably won’t (or won’t know how) to use your public key even if they had it. Bottom line, not many of your email messages are going to be encrypted, so encrypting messages isn’t a general solution for secure email.
But wait! There are more downsides to encrypting messages. Only the message contents (and attachments, if any) are scrambled. The header information (including your address, the recipient’s address, subject, date, and more) are all still plain text anyone can read. That information might just be metadata, but over time it can paint a surprisingly detailed picture of your online activities. (Just ask the NSA or Australian Gov !!) .
It all comes down to common sense when you’re dealing with email security issues. If you’re looking to secure your business emails, give us a call today and see how we can help. We have a wide range of security solutions to suit different budgets and a variety of scope.