Sending Secure E-Mail?
-
@JaredBusch said in Sending Secure E-Mail?:
Your client simply needs to force encryption on outbound email to the domain that these emails are sent to. End of story, everything secured. This is simple to do in O365 and not super hard with Exchange on prem. GSuite is also not hard to set this up.
Yup, simply decide to not send unencrypted and voila, done. Email is incredibly secure by default these days.
-
@scottalanmiller Try telling that to the auditors. Dealing with those folks make me want to drink.
-
What about PGP? Just did this for one of our users. Basic instructions here for PGP on Outlook.
https://www.comparitech.com/blog/information-security/pgp-encryption-with-outlook/ -
@jt1001001 said in Sending Secure E-Mail?:
What about PGP?
The only communication method is email. so the key will be in email too. SO an admin will have access.
-
@brandon220 said in Sending Secure E-Mail?:
@scottalanmiller Try telling that to the auditors. Dealing with those folks make me want to drink.
If your auditors aren't competent, they aren't auditors, they are security breaches getting paid.
-
@jt1001001 said in Sending Secure E-Mail?:
What about PGP? Just did this for one of our users. Basic instructions here for PGP on Outlook.
https://www.comparitech.com/blog/information-security/pgp-encryption-with-outlook/PGP is a great tool, but doesn't add anything beyond the existing TLS.
-
If you were allowed a one time phone call with the receiving person beforehand, you could provide the password to them. Or you could mail the password to them.
-
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
-
-
@Obsolesce said in Sending Secure E-Mail?:
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
How does this keep the admin on the system from seeing the email?
-
-
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
How does this keep the admin on the system from seeing the email?
Why would anyone other than the user have admin privileges on the system?
-
-
@Obsolesce said in Sending Secure E-Mail?:
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
How does this keep the admin on the system from seeing the email?
Why would anyone other than the user have admin privileges on the system?
the email admin.
-
-
Did I miss something.
Company A worker wants to send a file to a government mailbox - right?
We assume the email admins have access to the mailboxes.
But really, so should anyone else in the department to whom these emails are being sent so work can be done by anyone in the department, not just one guy who might be on vacation for a month. So the originally mentioned idea that just one person has access to this data just seems weird thinking. -
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
How does this keep the admin on the system from seeing the email?
Why would anyone other than the user have admin privileges on the system?
the email admin.
There is auditing, monitoring, alerting. You can know if there is non-owner email access.
-
-
@Dashrender said in Sending Secure E-Mail?:
Did I miss something.
Company A worker wants to send a file to a government mailbox - right?
We assume the email admins have access to the mailboxes.
But really, so should anyone else in the department to whom these emails are being sent so work can be done by anyone in the department, not just one guy who might be on vacation for a month. So the originally mentioned idea that just one person has access to this data just seems weird thinking.Plus aliases, secretaries, distro groups...
-
@Obsolesce said in Sending Secure E-Mail?:
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@Dashrender said in Sending Secure E-Mail?:
@Obsolesce said in Sending Secure E-Mail?:
@JasGot said in Sending Secure E-Mail?:
I have a customer that needs to send e-mail to a company.
This customer does not want ANYONE other than the intended recipient to view the contents.What are the options to do this, and what complexities do they impose?
I am aware of these methods and their problems:
-
send the info in an encrypted document that is attached
1a) Some anti virus software will block encrypted attachments.
1b) You still have to communicate the decryption password to the end user who is only available via e-mail. -
Sites that allow you to send a document into their service/system and then the recipient has to go there to retrieve it
2a) Recipient may refuse to go to a web site to retrieve an e-mail.
2b) Recipient may not have web access with a browser.
Any other options? The key elements are 1) E-mail based and 2) cannot be read by anyone other than the recipient.
Tell the recipients not to let anyone else have access to their email or their username and password. Tell recipients to enable MFA on their email. Tell recipients to secure the devices that have access to their email.
Then only they can see their email.
How does this keep the admin on the system from seeing the email?
Why would anyone other than the user have admin privileges on the system?
the email admin.
There is auditing, monitoring, alerting. You can know if there is non-owner email access.
Not as the sender, you can't.
-
-
@JaredBusch Thanks. Not much more to it beyond what I thought. I was hoping someone would know of a solution that could work.
-
@JasGot said in Sending Secure E-Mail?:
@JaredBusch Thanks. Not much more to it beyond what I thought. I was hoping someone would know of a solution that could work.
GPG/PGP works exactly like you want.
It's asymmetric encryption. If you wanted to send a secure email to me, you need my public key. Since it's public I can send it to you in an email and I could post it online. Whatever.
When you send a secure email to me you encrypt it with my public key. To be able to view the email I need two things - my private key and my passphrase. None of those are available to anyone else.
The email is stored on the email server as it was sent - fully encrypted. And so is it on my computer. So a sysadmin with access to the email server can't do anything. A sysadmin with full admin rights on my computer could get my private key. But not the passphrase. So can't do anything with the encrypted email.
Emails can also be signed. Which means that using your public key, I can verify that the email you sent me actually came from you and nobody else.
This is exactly what happens when you download software from repositories like ubuntu, debian etc. The package manager need the public key of the repository to verify that the packages are from there and not some shady individual.
-
These are some of the software and services that support encrypted mail with GPG/PGP inside the mail client.
https://www.openpgp.org/software/It's an open standard: https://tools.ietf.org/html/rfc4880
-
@Pete-S said in Sending Secure E-Mail?:
These are some of the software and services that support encrypted mail with GPG/PGP inside the mail client.
https://www.openpgp.org/software/It's an open standard: https://tools.ietf.org/html/rfc4880
The problem is, is that for GPG/PGP to work, you have to exchange keys outside of email, but the requirement in this case is to do it all within email. So that doesn't work. The system admin can always get the key out of your email and open whatever has been sent. It ends up doing nothing more than TLS already does, but with a lot more manual work.
If they could exchange keys, of course, but there is a reason that we'd already pointed out that this didn't meet the criteria right away.
-
@scottalanmiller said in Sending Secure E-Mail?:
you have to exchange keys outside of email
Sorry Scott, but that is completely incorrect. The public key is public.
