Safe E-mail Usage Sending

Sending mail is a little more care free. There are some things you can do to make sure your conversation is secure though. The first is to ensure your connection is secure. There are also methods to allow you to digitally sign your messages, which guarantees that the message is from you and has not been tampered with en route. And for maximum security, you can encrypt your messages to make sure no one reads them. Digital signatures prove who e-mail comes from, and that it has not been altered in transit. If you establish the habit of using digital signatures for important e-mail, you will have a lot of credibility if you ever need to disown forged mail that appears to be from you. They also allow you to encrypt e-mail so that no one can read it except the recipient. PGP in particular offers high levels of encryption which to break would require extreme computing power.

Digital Certificates
A digital certificate is unique to an individual, kind of passport, and is composed of two parts. These two parts are called as public and private key. The certificate is unique to one person, and typically certificates are issued by a trusted Certificate Authority, or CA. The list of Certificate Authorities you trust is distributed automatically (if you are a Microsoft Windows User) by Windows Update and the list is accessible in your browser under tools>internet options>content>certificates. You can go here to view certificates installed on your machine (yours and others), and other certificate authorities you trust. You can disable the automatic update of CAs, and choose to remove all CAs from the list, although this is not recommended. Instructions on how to do this are on Microsoft’s web site.


Digital Signatures
A digital signature is generated by your e-mail software and your private key to assure the authenticity of your e-mail. The purpose of the signature is twofold. The first is to certify it came from you. This is called non-repudiation. The second is to ensure the contents have not been altered. This is called data integrity. The way an e-mail program accomplishes this is by running the contents of your message through a one way hash function. This produces a fixed size output of your e-mail called a message digest. This is a unique value, and if the mathematical algorithm that produces it is strong, the message digest has the following attributes.

• The original message can’t be reproduced from the digest.
• Each digest is unique.

After the digest is created, it is encrypted with your private key. The encrypted digest is attached to the original message along with your public key. The recipient then opens the message, and the digest is decrypted with your public key. The digest is compared to an identical digest generated by the recipients’ mail program. If they match, then you’re done. If not, your mail client will let you know the message has been altered. There are two types of signing / encryption functions, S/MIME and PGP. S/MIME is considered to be the corporate and government choice, possibly because it uses the less labor intensive certificate authority model for authentication, and because it is more easily implemented through Microsoft's Outlook Express e-mail program. PGP is more often the choice of the computer user community, because it is based on a non-centralized web of trust for authentication, where a user's trustworthiness is validated through the 'friend of a friend' system, where you agree that, if you trust me, then you can also trust those people who I trust.

Safe E-mail Usage Receiving

Everyone uses e-mail, and to the surprise of many people, your e-mail can be used against you. E-mail should be treated as a post card, in that anyone who looks can read the contents. You should never put anything in an ordinary e-mail that you don’t want to be read. That being said there are strategies for securing your e-mail.

Spam, Phishing and Fraud
Everybody likes to get e-mail. A long time ago, in a galaxy far away it used to be you only got mail from people you knew, and it was about things you cared about. Now you get email from people you never heard of asking you to buy software, drugs, and real estate, not to mention help them get 24 million dollars out of Nigeria. This type of unsolicited advertising is called spam. It comes as a surprise to many people that e-mail they receive can provide a lot of information to a sender, such as when the mail was opened and how many times it was read, if it was forwarded, etc. This type of technology called web bugs is used by both spammers and legitimate senders. Also, replying to an e-mail or clicking on the unsubscribe link may tell the sender that they have reached a live address. Another invasion of privacy

concern is the increasingly common “phishing” attack. Have you ever gotten an e-mail asking you to login and verify your bank or E-bay account information? Beware, because it is a trick to steal your account information. To secure yourself against these types of attacks, there are some simple strategies to protect yourself outlined below.

HTML based e-Mail
One of the security concerns with HTML based e-mail is the use of web bugs. Web bugs are hidden images in your e-mail that link to the senders’ web server, and can provide them with notification that you have received or opened the mail. Another flaw with HTML e-mail is that the sender can embed links in the e-mail that identify the person who clicks on them. This can give the sender information about the status of the message. As a rule, you should use a mail client that allows you to disable the automatic downloading of attached or embedded images. Another problem is related to scripts in the e-mail that may launch an application, if your browser has not been patched for security flaws. For web based e-mail clients, you may have the option of disabling the automatic download of images, or viewing the message as text. Either is a good security practice. The best way to protect yourself against HTML e-mail based security and privacy attacks is to use text based email. If you must use HTML e-mail, beware!

Attachment Security
Another real concern related to received e-mail security is attachments. Attackers can send you malware, viruses, Trojan horses and all sorts of nasty programs. The best defense against e-mail borne malware is to not open anything from anyone you don’t know. Never open a file with the extension .exe or .scr, as these are extensions that will launch an executable file that may infect your computer with a virus. For good measure, any files you receive should be saved to your hard drive and scanned with an latest antivirus software. Beware of files that look like a well known file type, such as a zip file. Sometimes attackers can disguise a file by changing the icon or hiding the file extension so you don’t know it is an executable.

How Your e-mail Works?

When you send an e-mail from your computer, the data is sent from your computer to an SMTP server. The SMTP server then searches for the correct POP3 server and sends your e-mail to that server, where it waits until your intended recipient retrieves it.

E-mail Accounts
E-mail accounts are available through many different sources. When you get an e-mail account, you will be given a two part e-mail address, in this form: username@domain.name. The first part, username identifies you on your network, differentiating you from all the other users on the network. The second part, domain.name is used to identify your specific network. The username must be unique within your network, just as the domain name must be unique among all the other networks on the Internet. However, user names are not unique outside of their networks; it is possible for two users on two different networks to share user names. One of the first things that you will do when you are setting up your e-mail is to enter your email address into your e-mail client program. Your e-mail client is the program that you will use to send and receive e-mails.

POP and SMTP
After your e-mail client knows your e-mail address, it's going to need to know where to look for incoming e-mail and where to send outgoing e-mail. Your incoming e-mails are going to be on a computer called a POP server. The POP server usually named something like pop.smallnetwork.net or ail.smallnetwork.net has a file on it that is associated with your e-mail address and which contains e-mails that have been sent to you from someone else. POP stands for post office protocol. Your outgoing e-mails will be sent to a computer called a SMTP server. This server named smtp.smallnetwork.net will look at the domain name contained in the e-mail address of any e-mails that you send, then will perform a DNS lookup to determine which POP3 server it should send the e-mail to. SMTP stands for simple mail transfer protocol. When you start up your e-mail client, a number of things happen:

• The client opens up a network connection to the POP server
• The client sends your secret password to the POP server
• The POP server sends your incoming e-mail to your local computer
• The client sends your outgoing e-mail to the SMTP server.

The first thing to note is that you do not send a password to the SMTP server. SMTP is an old protocol, designed in the early days of e-mail, at a time when almost everyone on the Internet knew each other personally. The protocol was written with the assumption that everyone who would be using it would be trustworthy, so SMTP doesn't check to ensure that you are you. Most SMTP servers use other methods to authenticate users, but in theory anyone can use any SMTP server to send e-mail. The second thing to note is that, when you send your secret password to the POP server, you send it in a plain-text format. It may be hidden by little asterisks on your computer screen, but it is transmitted through the network in an easily readable format. Anyone who is monitoring traffic on the network using a packet sniffer, for instance will be able to clearly see your password. You may feel certain that your network is safe, but you have little control over what might be happening on any other network through which your data may pass. The third, and possibly most important thing that you need to know about your e-mails, is that they are just like your password transmitted and stored in a plain-text format. It is possible that they may be monitored any time they are transferred from the server to your computer. This all adds up to one truth that e-mail is not a secure method of transferring information.


Web Mail
A second option for e-mail is to use a web based e-mail account. This will allow you to use a web browser to check your e-mail. Since the e-mail for these accounts is normally stored on the web e-mail server not on your local computer it is very convenient to use these services from multiple computers. It is possible that your ISP (Internet Service Provider) will allow you to access your e-mail through both POP and the web. However, you must remember that web pages are cached or stored on local computers, sometimes for significant lengths of time. If you check your e-mail through a web based system on someone else's computer, there is a good chance that your e-mails will be accessible to someone else who uses that computer. Web based e-mail accounts are often free and easy to get. This means that they offer an opportunity for you to have several identities online. You can, for instance, have one e-mail address that you use only for friends and another that is only for relatives. This is usually considered acceptable, as long as you are not intentionally intending to defraud anyone.