Question PKI Class 1 -email encription, is it really used?

[Bj]

In my classes we are learning about PKI and how encryption, data transfer, ports, protocols ext. ext. all works. anyway I was wondering how often does people really need to encrypt their email?

In a school environment, staff email are probably not all that important and I imagine the administrative emails really don't have much more 'important' email either.

The only senario I can think of is: (since the administrators for the email servers can view the emails between staff) if the staff didn't want the administrator reading their email, because of

1. Not work related
2. About the administrator themselves

So I say again, where and when would someone pay for digital IDs like from VeriSign to have encrypted mail? How often is it really used?

 

[Urwumpe]

I have rarely reason to encrypt my email, but I have my private data on my PC encrypted...Only because I am paranoid, that does not mean that nobody is spying me.

 

[Ghostrider]

Some sensitive information, especially if you're in a sensitive work area, is best encrypted. For mail, Thunderbird with GPG and the Enigmail plug-in is hard to beat for ease of use.

 

[TJohns]

And remember, PKI is also used as a digital signature system, validating the message was received from the "stated" originator.

Trev

 

[garyw]

In a school environment, staff email are probably not all that important and I imagine the administrative emails really don't have much more 'important' email either.

Not so, Schools have a lot of confidential information especially around child details. Any information being transmitted about children from one location to another would be best encrypted. Of course, that scenario probably accounts for around 1% of actual email sent/received by a school as most of it would the normal mundane goings on.

So I say again, where and when would someone pay for digital IDs like from VeriSign to have encrypted mail? How often is it really used?

As an example from where I work - We only pay for "proper" certs for anything the public will interact with and where we need a trusted third party. For anything else there is an internal company root cert authority and certs are generated from that. This saves a huge amount of money for inter-company confidential transactions.

 

[DarkWanderer]

anyway I was wondering how often does people really need to encrypt their email?

When I worked in a system integration company, I've often needed to discuss sensitive technical matters via e-mail. As there were some large client companies (e.g. air carriers or banks) - disclosure of details of thier IT-infrastructure could be quite damaging, so encryption was essential. So, at least in "big IT" it's quite common.

Buying digital certificates is usually an integral part of the company's security policy.

 

[Ghostrider]

And remember, PKI is also used as a digital signature system, validating the message was received from the "stated" originator.

GPG (which is a FOSS version of PGP) does that too.

 

[Bj]

GPG (which is a FOSS version of PGP) does that too.

Hmm interesting, does the interface have some GUI or is it all CLI?

I found this description on how to get it working with outlook.

Using this method, I wonder; does the recipiant have to have the same program/version in order to see unscrambled text?

 

[Ghostrider]

Hmm interesting, does the interface have some GUI or is it all CLI?

GPG works with a GUI through the Windows Privacy Tray. For Thunderbird, it's all managed through a plug-in that integrates into the standard T-bird interface.

 

[Bj]

GPG works with a GUI through the Windows Privacy Tray. For Thunderbird, it's all managed through a plug-in that integrates into the standard T-bird interface.

Interesting, I am willing to give anything a shot.

 

[Ghostrider]

Interesting, I am willing to give anything a shot.

Check this one then: http://www.gnupg.org/

 

[Bj]

Check this one then: http://www.gnupg.org/

Yes saw that, installed it already and I have everything working. I made my certificate and communicated with myself once or twice for testing.

Works pretty good, I took a 48KB .jpg file, encrypted & signed it and it turned into a 32KB file. Not only was it totally scrambled, but also compressed.

I am impressed with this, I think its much better than the built-in version with Outlook.

Thanks for sharing.

 

[Peskie]

Why *not* encrypt?

In my classes we are learning about PKI and how encryption, data transfer, ports, protocols ext. ext. all works. anyway I was wondering how often does people really need to encrypt their email?

How often do people need to put their letters in an envelope? Unencrypted e-mail has been compared to sending/receiving all your snail-mail (including bills, etc) written on the back of a postcard for all to see. Of course the analogy fails in that putting a letter in an envelope doesn't secure it from a snooper where-as (if used properly) encryption both ensures the contents cannot be read but also serves to authenticate the sender.

In a school environment

As mentioned in another reply, lots of issues about specific children should be private and confidential just as patient data, financial, or legal data should be secured. IMNSHO any lawyer, financial adviser, medical practitioner, etc that e-mails anything related to an individual (even if only being set to that individual) without encryption is being negligent.

Another thing to note is that the tools are trivially easy to use once configured. Therefore nearly all e-mail should be encrypted once this is done. For example, for the last 10 to 15 years every e-mail between me and a select few individuals has been encrypted. Since I have a large-ish set of outgoing and incoming encrypted e-mail it makes it harder for an attacker to determine what is worth targeting (assuming sufficient time to attack any one message; attacking the security of my secret key would yield the most).

The analogy here is that in a world where all snail-mail is written on the back of postcards, the sealed letter stands out and attracts unwanted attention.

So I say again, where and when would someone pay for digital IDs like from VeriSign to have encrypted mail? How often is it really used?

For e-mail it's pointless to use something like VeriSign IMNSHO. There are all kinds of issues with a central authority system. Take SSL for example, most browsers have a huge list of signing certificates that are automatically trusted to sign a web hosts cert. Several of these have been shown to be trivial to get to sign bogus certs.

PGP and GnuPG implement OpenPGP which uses a web-of-trust model which is much more flexible and puts the control in the hands of the end user. The downside is that this requires the end user to 'have a clue' which unfortunately seems to be too much to ask these days.

Note that one of the biggest security issues with public key encryption is managing and authentication of the public keys. Pay special attention to this area if you use something like OpenPGP.

 

[Bj]

...
Therefore nearly all e-mail should be encrypted once this is done.

...
The downside is that this requires the end user to 'have a clue' which unfortunately seems to be too much to ask these days.

Kindof hard to have all email encrypted when 95% of end users dont even know about it, let alone be able to use it.

 

[Brycesv1]

so i could download this, tell my friend to download this and we could send encrypted emails? would it work with a hotmail account?

 

[Peskie]

...
Therefore nearly all e-mail should be encrypted once this is done.
...
The downside is that this requires the end user to 'have a clue' which unfortunately seems to be too much to ask these days.

Kindof hard to have all email encrypted when 95% of end users dont even know about it, let alone be able to use it.

The parts you omitted with "..." provide qualifying context, your flippant one line response misrepresents what I was saying.

What I was implying was that once configured you should encrypt all e-mail to recipients that can en/decrypt it. The "once configured" includes key exchange and what not so it implies a correspondent that is also setup and therefore knows about encryption. I further went on to say "between me and a select few individuals." No part of that requires any mass uptake of encryption so your guess about the percentage or people that know about encryption is completely irrelevant. <rant>Don't pick numbers out of your orifices; if you don't know use a vague qualifier like "most".</rant>

Your original question was asking about specific cases and my point is that if one has a need/desire to encrypt ANYTHING to a specific correspondent then it's pretty trivially (and a good idea) to then encrypt EVERYTHING to that correspondent.

 

[Ghostrider]

so i could download this, tell my friend to download this and we could send encrypted emails? would it work with a hotmail account?

Yes, but you would need to type your message (or paste it) into the GPG "clipboard", encrypt it, then cut and paste it into the hotmail message body window.

 

[Brycesv1]

sounds easy enough. can anyone give me some more in depth instruction? i looked at the downloaded files and decided i should ask for help before i break my comp (with my luck it wouldnt surprise me at all)

 

[Bj]

sounds easy enough. can anyone give me some more in depth instruction? i looked at the downloaded files and decided i should ask for help before i break my comp (with my luck it wouldnt surprise me at all)

GnuGP Video Tutorials


Oh and yes it definitely works with web mail.

The parts you omitted with "..." provide qualifying context, your flippant one line response misrepresents what I was saying.

What I was implying was that once configured you should encrypt all e-mail to recipients that can en/decrypt it. The "once configured" includes key exchange and what not so it implies a correspondent that is also setup and therefore knows about encryption. I further went on to say "between me and a select few individuals." No part of that requires any mass uptake of encryption so your guess about the percentage or people that know about encryption is completely irrelevant. <rant>Don't pick numbers out of your orifices; if you don't know use a vague qualifier like "most".</rant>

woh simmer down there...

For one I have never really truly needed encryption at all. I have been on the internet for so long already and have never sent 'sensitive information' over the internet and I never will.* (*by email of course*)

This is a Systems Security class. Last week we learned about PKI. I know the concept behind how it works, just maybe not about the programs that implement it.

Some other 'topics' we also studied;
PKIX
PKCS
X.509
ISAKMP
XKMS
CMP
WEP

Then some application protocols;
S/mime
SSL
TLS
WTLS
IPsec
PPTP
PGP

It just so happened that PKI interested me because encrypted email was something small and fun I could play around with for a few days --NOT something I planned on using effective immediately.

<rant>Don't pick numbers out of your orifices; if you don't know use a vague qualifier like "most".</rant>

BTW where I volunteer I assist the technology staff with day to day problems. There are roughly 300 staff members. I can list by name the few people who would know the dangers of un-encrypted mail. --And even fewer that would actually need it. It will be close to exactly 95%. This will-not reflect the rest of the world obviously, but it is pretty close guesstimate on the percentile of people at work that can understand PKI.

Even if I did suggest implementing it, I know exactly what they would say, and as a matter of fact what the other IT members would say; 'We have been fine up till now, why would we need to start this now?'

I should also note; the other, well one other member of the IT dept. who holds a higher rank than me, is really anti-non-Microsoft. So if it isn't from Microsoft or Microsoft recommended, then he will absolutely not do it. Its like he is afraid that using software under GPL has some 'licensing' issues or whatever and will not use it.

I say again this was for fun, not to actually figure a way to for implementing it.

Your original question was asking about specific cases and my point is that if one has a need/desire to encrypt ANYTHING to a specific correspondent then it's pretty trivially (and a good idea) to then encrypt EVERYTHING to that correspondent.

Good idea, encrypting everything will mean that the sniffer will have to guess at which ones are worth breaking into, and sometimes to only find a 'Hi how are you doing?'. As soon as I start emailing someone , I'll start doing exactly that.

---------- Post added at 10:26 AM ---------- Previous post was at 10:11 AM ----------

Oh yeah also on the topic of authentication, when say you would share your public key with me now, how would I know it is really you?

Well for starters I dont really know you so I couldn't, obviously, I wouldn't know that that was your public key with 100% assiduity endless I saw you make it myself.

This is probably why businesses use companies like Verisign, because to sign up you probably need to provide all information down to you SSN. So with businesses with 30+ members the 30+ members don't have to stand in the same room to know that that is your actual public key.

 

[Vanguard]

Bj, I find that hard to believe. Even if you've somehow managed to never send sensitive information, the lack of security around general e-mail in this age is ridiculous.

How about received e-mail? Like getting e-mails regarding lost passwords (which open text includes your account and password, how nice), flight itineraries, your whereabouts and CC information and associated info like you address (so you can answer 5/5 of the questions your bank will ask you to make sure its you lol), or just the fact you won't be home for the next two weeks.

The only reason peeps don't use tools like PGP is because 90%+ of the peeps we e-mail have no clue what the hell that is, forcing you to, as usual, conform to the short bus method.