sending sensitive info by email

Posted on 2013-01-22
Last Modified: 2013-02-05
what steps can i take to send a sensitive info by email to someone, and to make the least they have to do to get the info decrypted?  (the recipient is someone who has less time and less computer savvy and needs to keep the simplistic or minimalistic way for her to be able to read what is sent over the email and no one else.
Question by:25112
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 38

Accepted Solution

Gerwin Jansen, EE MVE earned 100 total points
ID: 38807697
Hushmail is easy and can send encrypted attachments as well:
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38809030
Hushmail have an annoying habit of locking accounts for "inactivity" and only unlocking if you pay them.

As for the security, then the easiest way (if you have access to the user's machine to set it up, and they don't use other access methods - like mobile - to read their mail) is to create them an s/mime keypair (yourself, that's free), install it to their machine for them, and encrypt to that key using your mail client.  Without exception, mail clients that CAN handle s/mime (and that's near enough all of them) will decrypt automagically any message that they have the key for. (MS call this a "Digital ID" but its the same thing)

you can create your own s/mime keys using either the MS CA (comes with enterprise versions of windows), openssl (major pain!) or the free - instructions for different email clients vary, but for outlook or outlook express its just the windows keystore (so just double-clicking a PFX file to import it is usually enough)
LVL 10

Assisted Solution

simonlimon earned 100 total points
ID: 38809538
One relatively simple solution is to send info in a document that is zipped using password protected. You would then agree as to a password for the zip files.
Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38810232

  Yup, but that isn't transparent to the end user, and for security, you should not re-use the same password, so you would need an ever-changing array of passwords that way.

  S/Mime encrypts every email with a different password, automatically, and the email client will automagically decrypt it on receipt, so it will be transparent to the end user.

Author Comment

ID: 38810704
Dave, thanks.. i don't have access to the user's machine as it is geographically far away. In that case, what may be better option?

if there is no simple option in this route, i am willing to consider hushmail next..

yes, zipped file is not good, as this person is not computer smart and may write down the password right next to the computer
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38810859

  You don't need to be geographically "close" - you can use remote access solutions such as team viewer to do the work, its more if you are going to be "permitted" to access the solution or not.

  Hushmail aren't a bad solution, really. They are a webmail provider (so usually you will need to be accessing the mail via a browser, to a hushmail provided email address) and use a java applet for the actual access, but when it comes down to it, they are providing an openpgp based encrypted email solution without having the headache of managing pgp keys.

Downsides of Hushmail are:
1) Either *both* of you need to be using hushmail, or you are going to have to install and use something that can send openpgp mail.
2) Hushmail is browser/java based, so may not work on all machines
3) Hushmail's free offering has an annoying habit of timing out accounts if you don't access them for 30 days - if that happens, they will *only* re-open the account if you pay them for a non-free account "upgrade" - you lose access to all your existing mail, including any unread, until you do this.
4) Hushmail have a record of rolling over for law enforcement agents, although I believe they do require a warrant. I suspect that isn't a major consideration for most users, but its there.

Author Comment

ID: 38858184
thanks a lot!

Featured Post

Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Keystroke loggers have been around for a very long time. While the threat is old, some of the remedies are new!
Here's a look at newsworthy articles and community happenings during the last month.
Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question