Solved

sending sensitive info by email

Posted on 2013-01-22
7
271 Views
Last Modified: 2013-02-05
what steps can i take to send a sensitive info by email to someone, and to make the least they have to do to get the info decrypted?  (the recipient is someone who has less time and less computer savvy and needs to keep the simplistic or minimalistic way for her to be able to read what is sent over the email and no one else.
0
Comment
Question by:25112
7 Comments
 
LVL 37

Accepted Solution

by:
Gerwin Jansen earned 100 total points
ID: 38807697
Hushmail is easy and can send encrypted attachments as well:

http://www.hushmail.com/
0
 
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38809030
Hushmail have an annoying habit of locking accounts for "inactivity" and only unlocking if you pay them.

As for the security, then the easiest way (if you have access to the user's machine to set it up, and they don't use other access methods - like mobile - to read their mail) is to create them an s/mime keypair (yourself, that's free), install it to their machine for them, and encrypt to that key using your mail client.  Without exception, mail clients that CAN handle s/mime (and that's near enough all of them) will decrypt automagically any message that they have the key for. (MS call this a "Digital ID" but its the same thing)

you can create your own s/mime keys using either the MS CA (comes with enterprise versions of windows), openssl (major pain!) or the free http://sourceforge.net/projects/xca - instructions for different email clients vary, but for outlook or outlook express its just the windows keystore (so just double-clicking a PFX file to import it is usually enough)
0
 
LVL 10

Assisted Solution

by:simonlimon
simonlimon earned 100 total points
ID: 38809538
One relatively simple solution is to send info in a document that is zipped using password protected. You would then agree as to a password for the zip files.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38810232
@simonlimon:

  Yup, but that isn't transparent to the end user, and for security, you should not re-use the same password, so you would need an ever-changing array of passwords that way.

  S/Mime encrypts every email with a different password, automatically, and the email client will automagically decrypt it on receipt, so it will be transparent to the end user.
0
 
LVL 5

Author Comment

by:25112
ID: 38810704
Dave, thanks.. i don't have access to the user's machine as it is geographically far away. In that case, what may be better option?

if there is no simple option in this route, i am willing to consider hushmail next..

yes, zipped file is not good, as this person is not computer smart and may write down the password right next to the computer
0
 
LVL 33

Assisted Solution

by:Dave Howe
Dave Howe earned 300 total points
ID: 38810859
@25112:

  You don't need to be geographically "close" - you can use remote access solutions such as team viewer to do the work, its more if you are going to be "permitted" to access the solution or not.

  Hushmail aren't a bad solution, really. They are a webmail provider (so usually you will need to be accessing the mail via a browser, to a hushmail provided email address) and use a java applet for the actual access, but when it comes down to it, they are providing an openpgp based encrypted email solution without having the headache of managing pgp keys.

Downsides of Hushmail are:
1) Either *both* of you need to be using hushmail, or you are going to have to install and use something that can send openpgp mail.
2) Hushmail is browser/java based, so may not work on all machines
3) Hushmail's free offering has an annoying habit of timing out accounts if you don't access them for 30 days - if that happens, they will *only* re-open the account if you pay them for a non-free account "upgrade" - you lose access to all your existing mail, including any unread, until you do this.
4) Hushmail have a record of rolling over for law enforcement agents, although I believe they do require a warrant. I suspect that isn't a major consideration for most users, but its there.
0
 
LVL 5

Author Comment

by:25112
ID: 38858184
thanks a lot!
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now