Secure (encrypted) email

[©®]

Situation is this:
A friend of a friend wants to communicate to a worker (non-profit aid
worker) in a closed country via email to see how they are doing, but
doesn't want to jeopardise the sensitivity of the worker there.
Anyone care to recommend a way that the two people (or other friends if
later needed) can email each other without anything looking too suspect
in the email address e.g.
person@secure-don't-read-this-encrypted-email.com

It most definitely needs to be non-techy (PGP is out then!) as these
are senior-citizens who need to share heart-to-heart things without
prying eyes reading private email and aren't the most computer literate
but can do general PC things.
Something that is an easy add-on to Outlook or Outlook Express (or other
email app) or a standalone program that will work with Win95-WinXP.
Thanks

 

[*Vanguard*]

"©®" said in

It most definitely needs to be non-techy (PGP is out then!) ...

<snip>

If PGP is out then also out is x.509 security certificates (which are
natively supported by Outlook whereas PGP requires a plug-in for 3rd
party support). In techy solutions are out, you've pretty much
eliminated all solutions. Yeah, I suppose they could write up a
document and then use WinZip or other archival compression tool that
lets the user password-protect the file but that is a techy solution,
too, and it would have to be done for every message and somehow the
password would have to get exchanged between the two parties which
obviates any interception (i.e., not likely unless the password could be
described by shared experience or knowledge rather than simply
divulged).

Thawte has freemail certificates. Creating one is pretty damn easy.
After creating one, you just download it and its installed in Outlook.
Then the only further action required by the recipient is that they save
the certificate in a digitally signed message, and the only action
required initially by the sender is to send a digitally signed message.
After that, the sender only needs to select the option to encrypt their
message to that sender either per message or as a global option (but I
doubt they want to encrypt their e-mails sent to anyone and everyone).

Thawte freemail certificates aren't really secure in identifying the
sender since anyone with an e-mail address can get one and there is no
real method of verifying who is asking for their freemail cert. They
have their "Web of Trust" notaries that will let you put additional
personal information in the cert to better identify to the recipient
that you are someone they know or can adequately identify, but I doubt
many Thawte freemail cert users bother with the time, nuisance, and
expense of their notaries (as opposed to just buying a fully verified
cert in the first place from, say, Verisign). There are also problem is
verifying a Thawte freemail cert is still valid (i.e., has not been
revoked); see my other replies at http://snipurl.com/55qc and
http://snipurl.com/55qb.

If creating a security cert is too complicated for these elderly folks
you consider inept (they are probably smarter than you think), then YOU
create it for them. Then all they have to do is download the cert which
automatically installs itself. Just create an account for each of them
using usernames and passwords that would have you pretending to be them.
Then later they can login and manage their own freemail certs.

 

[J. McConnell]

It most definitely needs to be non-techy (PGP is out then!) as these
are senior-citizens who need to share heart-to-heart things without
prying eyes reading private email and aren't the most computer literate
but can do general PC things.

Like *Vanguard* said, there really aren't any non-techy options. I know you
said PGP is out, but I found the G-Data GnuPG-Plugin relatively easy to
install and setup. This might not be bad for them if they have your help.
You can find it at:

http://www3.gdata.de/gpg/

The site's in German (which I don't read), but it's pretty easy to find and
download the plug-in and English is an available option when you install the
plug-in, so no worries there.

HTH,

- J.

 

[Brian Tillman]

Situation is this:
A friend of a friend wants to communicate to a worker (non-profit aid
worker) in a closed country via email to see how they are doing, but
doesn't want to jeopardise the sensitivity of the worker there.
Anyone care to recommend a way that the two people (or other friends
if later needed) can email each other without anything looking too
suspect in the email address e.g.
person@secure-don't-read-this-encrypted-email.com

It most definitely needs to be non-techy (PGP is out then!) as these
are senior-citizens who need to share heart-to-heart things without
prying eyes reading private email and aren't the most computer
literate but can do general PC things.
Something that is an easy add-on to Outlook or Outlook Express (or
other email app) or a standalone program that will work with
Win95-WinXP. Thanks

The solution you seek simply doesn't exist. Email, by its nature, is not
private. At the very least, every single system through which a message
passes has access to the contents of the message. That is the very reason
why tools such as PGP were invented: to keep prying eyes away from sensitive
material. Additional steps like password-protecting the PST in Outlook can
be taken, but they can be circumvented. There is a freeware PGP plug-in for
Outlook. Encryption is the only sure method.

Moreover, it has been well-established in law that Email received by a
person working for a company belongs not the the recipient, but the the
company supplying the resources for receiving that mail.

That said, if it is the policy of the non-profit organization for which one
of the people works to not allow personal mail, why would any friend of that
person wish to jeopardize their position by sending such personal
communication? That, for sure, belies true friendship.

 

[©®]

That said, if it is the policy of the non-profit organization for
which one of the people works to not allow personal mail, why would
any friend of that person wish to jeopardize their position by
sending such personal communication? That, for sure, belies true
friendship.

Personal mail is okay ;-)