Secure Email Message Communications using Certificates

9 Apr 2008 by Chetan Shah.

With email becoming a communication tool of choice and security breaches/holes a part of digital life, it is imperative that we take appropriate security measures that will protect our emails both from content integrity and privacy perspective.

By Content integrity, I mean that the email which you write is the email which is received by the recipient. Sounds like a no-brainer? It is not. Email message once composed and sent goes through a maze of servers (machines) before it finally reaches its destination. Anywhere in this chain of servers can your email be altered, thus compromising your contents. The recipient might not get exact message you sent to her. A simple example is, using a wi-fi connection in the library. The connection between your computer to library’s wi-fi access point can easily be intercepted and the contents be altered before delivering your email message to the first machine (which is the library’s access point). And this is just a starting point of the message’s journey.

By Content privacy, I mean that the email can be read by anyone who either snoops or intercepts your email en route. Thus there is no content privacy. The requirement here is that the message sent by you should *only* be readable by the recipient/s and nobody else.

Both of the above issues can be resolved by using secure email certificates. Having a personal email certificate ensures that the recipient will be notified if the message is altered and if both you and the recipient have certificates then by encrypting your email, nobody else will be able to read it. There is one requirement however, certificates only work with Smime compatible email clients like Outlook, Outlook Express, Thunderbird etc. Most of the web mail clients are *not* s/mime email compliant, except Gmail (there is a plug in available for Firefox - gmail users which allows you to sign and encrypt your email sent from Gmail). However if you can access your yahoo mail(let’s say) from outlook then you can use this facility as outlook is smime compliant.

By attaching a certificate to the email, you are digitally signing that email so that nobody else can alter the email content. It is like when you sign your will, nobody else can alter your will because the malicious party cannot recreate your signature. With hand signatures it maybe possible to fake it but be rest assured that with digital thumb prints, there is no technology which can fake your signature.

Comodo issues certificates and I have used them without any problems at all and they are free. They are very easy to acquire and it will take less than 2 minutes for your to install it on your computer.

Posted in Technology | 1 Comment »