Yesterday's Washington Post has a technology article about email encryption. As with so many newspaper articles about technology, though, it's a seriously flawed article. For one thing, it just comes across as a press release from PGP Corporation, and I always object when the news media take what amounts to an advertisement for a product and present it as news. Apart from that, though, here are my issues with the article.
"Current e-mail technology does not provide any confidentiality," said Peter Hesse, president of Gemini Security Solutions, a Chantilly-based firm specializing in security audits and installations. "In fact, the e-mail standards include routing messages between mail servers . . . each transmission and each server offer opportunities to read messages."This implies that encryption is new, and not a part of "current e-mail technology"; that's silly. PGP has been around for 15 years, and S/MIME for about half that time. By the time Grandma first got an email address[1], she could well have been encrypting her secret recipes, secure from the prying eyes of the NSA and Betty Crocker.
"When you log in to get your e-mail, generally your user name and password is sent in the clear. So, if you connect to a wireless hot spot at a coffee shop and check your e-mail, there's a good chance that someone sitting there can grab your user name and password," said Hesse. "That's why it's important to use the secure versions of these protocols, which encrypt the transmissions between your computer and the server."This is true of stand-alone email clients like Outlook and Eudora, and those clients should indeed be configured to use SSL (or TLS) for their SMTP, POP, and IMAP sessions. It's worth noting, though, and the author does not, that webmail clients do not expose the user to this — all webmail clients of which I'm aware use HTTP over SSL, without making the user worry about it.
Also, it's not clear what PGP Desktop does to make (or help) the user configure the clients securely. It might be as simple as providing instructions, which one's service provider should be doing also. I'm not sure what the PGP software can do to ensure that it's done.
And apart from all that, this is an orthogonal issue from the encryption of the email messages themselves, and the article doesn't make that clear at all. It appears to conflate the two issues, though they are separate (and require entirely unrelated remedies).
The software works on the concept of "keys." Just as you'd give someone you trust a key to your home to feed the cat while you go on vacation, you give your e-mail encryption key to recipients of your sensitive e-mail. Once the keys have been exchanged, users can send encrypted messages to each other, locking (or encrypting) the mail on one end and unlocking it on the other end.Unfortunately, key management is not as simple as giving the cat-sitter a key to your house. I talk about some of the difficulties in managing keys and certificates here and here. In any case, the idea that you just give your mate a key and it all works... is misleading, or naïve.
The article doesn't point out that, while signed messages can be sent to anyone without their explicit participation, sending encrypted messages requires each recipient to have a key and send it to you. And that key has to be sent in a secure manner. The software will help you keep track of them, and will associate the keys with the recipients... so once you get my key, you can send me encrypted mail conveniently. But, of course, I also have to have PGP installed in order to read it.
Because the article is pushing PGP, it doesn't even mention S/MIME, for which support is built into the major email clients. Users of S/MIME have the same issues of certificate distribution and management, but by having S/MIME support already built in, the step of making sure that all your correspondents are using the same plug-in is eliminated. That doesn't necessarily mean that S/MIME will work better — and it quite possibly won't — but this is a newspaper, and it should be telling the reader about disadvantages and alternatives as well.
Finally, I should point out that administrators are quite reasonably concerned about widespread use of encryption by end users, particularly on a routine basis. In the event of a virus/worm/zombie infection, the zombie software can take particular advantage of a computer that's configured to encrypt mail by using it to replicate the infection using encryption. That makes it impossible for the service providers to detect that one of their subscribers is sending infected mail, and it may be harder to stop some infections from spreading.
I always recommend to people who use encryption that they only use it when it's needed. If you're telling someone about your vacation in Tuscany, you probably don't need to encrypt that. Don't configure your email program to encrypt by default, and specifically decide when you need a message encrypted.
[1] I prefer to spell it without the hyphen.
No comments:
Post a Comment