Secure email

Secure email
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Secure email teabox 02-28-2007
---> Re: Secure email Ertugrul Soeyle...02-28-2007
---> Re: Secure email Security Freak02-28-2007
`--> Re: Secure email Ertugrul Soeyle...03-03-2007
Posted by teabox on February 28, 2007, 6:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I have been looking at neomailbox and a few other "secure" web-based
email services.

Neomailbox: https://neomailbox.com/

A concern I have is protection against key loggers, packet sniffers,
and other methods for stealing my password.

Neomailbox talks about something called an iKey. Below is an excerpt
from their web site.

"When you choose the option to "Store password on iKey" in SecureBat!,
this will activate a hardware implementation of the CRAM-HMAC
Challenge/Response (RFC-2095) authentication. A special non-replicable
hardware token, iKey by Rainbow Technologies, is used to store the
password and to produce Keyed Hashing."

The above paragraph sounds good, but I know very little about these
things. Are there any disadvantages to using this hardware key?
Apparently, if I understand things correctly, it generates a unique
and usable "digest" password each time I log in. This "digest"
password can only be used once. Are there any loopholes that would
allow attackers to duplicate my hardware token?

Does anyone have opinions on secure email and/or neomailbox?

Thanks for any input!


Posted by Ertugrul Soeylemez on February 28, 2007, 7:17 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> I have been looking at neomailbox and a few other "secure" web-based
> email services.
>
> Neomailbox: https://neomailbox.com/

Secure mail is generated locally using your private key to sign your
mails, and public keys of others to encrypt them. Things like
Neomailbox only secure the connections between you and the server.
That's it. Firstly, most email providers allow that, and secondly, it's
almost useless.

The reasons are simple: The administrators of Neomailbox are still able
to read your mails, as well as any other person potentially between
Neomailbox and the intended receiver. Even if the mail goes from a NMB
user to an NMB user, still the NMB administrators are able to read the
mails.

Use proper encryption and signature schemes. Have a look at PGP [1] or
GnuPG [2]. The latter is more difficult to use, but I trust it more
than PGP, for whatever reason. Maybe because PGP is an american
product, and because it's commercial (it's still free of charge).
However, that's a matter of taste.


Regards,
E.S.


References:
[1] http://www.pgp.com/
[2] http://www.gnupg.org/

Posted by Security Freak on February 28, 2007, 8:43 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Thu, 1 Mar 2007 01:17:18 +0100, Ertugrul Soeylemez

>
>> I have been looking at neomailbox and a few other "secure" web-based
>> email services.
>>
>> Neomailbox: https://neomailbox.com/
>
>Secure mail is generated locally using your private key to sign your
>mails, and public keys of others to encrypt them. Things like
>Neomailbox only secure the connections between you and the server.
>That's it. Firstly, most email providers allow that, and secondly, it's
>almost useless.
>
>The reasons are simple: The administrators of Neomailbox are still able
>to read your mails, as well as any other person potentially between
>Neomailbox and the intended receiver. Even if the mail goes from a NMB
>user to an NMB user, still the NMB administrators are able to read the
>mails.
>
>Use proper encryption and signature schemes. Have a look at PGP [1] or
>GnuPG [2]. The latter is more difficult to use, but I trust it more
>than PGP, for whatever reason. Maybe because PGP is an american
>product, and because it's commercial (it's still free of charge).
>However, that's a matter of taste.
>
>
>Regards,
>E.S.
>
>
>References:
>[1] http://www.pgp.com/
>[2] http://www.gnupg.org/

You could also look at IronMail from SecureComputing
http://www.securecomputing.com/index.cfm?skey=26
Gartner Leaders Quadrant for E-Mail Security Boundary

Posted by Ertugrul Soeylemez on March 3, 2007, 1:25 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> > > I have been looking at neomailbox and a few other "secure"
> > > web-based email services.
> > >
> > > Neomailbox: https://neomailbox.com/
> >
> > Secure mail is generated locally using your private key to sign your
> > mails, and public keys of others to encrypt them. Things like
> > Neomailbox only secure the connections between you and the server.
> > That's it. Firstly, most email providers allow that, and secondly,
> > it's almost useless.
> >
> > The reasons are simple: The administrators of Neomailbox are still
> > able to read your mails, as well as any other person potentially
> > between Neomailbox and the intended receiver. Even if the mail goes
> > from a NMB user to an NMB user, still the NMB administrators are
> > able to read the mails.
> >
> > Use proper encryption and signature schemes. Have a look at PGP [1]
> > or GnuPG [2]. The latter is more difficult to use, but I trust it
> > more than PGP, for whatever reason. Maybe because PGP is an
> > american product, and because it's commercial (it's still free of
> > charge). However, that's a matter of taste.
>
> You could also look at IronMail from SecureComputing
> http://www.securecomputing.com/index.cfm?skey=26
> Gartner Leaders Quadrant for E-Mail Security Boundary

Essentially the same useless crap as Neomailbox. You'll want to read
more carefully.


Regards,
E.S.

Similar ThreadsPosted
Secure email October 13, 2006, 11:37 pm
Email secure delivery March 1, 2005, 8:00 am
public email systems - who is more secure? March 20, 2007, 12:04 am
New product for secure data storage & email March 12, 2006, 12:46 pm
hijacked email June 25, 2005, 1:56 am
Re: Barcode Email August 10, 2005, 2:33 pm
Email Encryption September 17, 2005, 12:20 am
Use How to use the SAME Key for another eMail address ? September 22, 2005, 7:31 am
email privacy December 8, 2006, 2:30 am
Tracing a bagle email July 22, 2004, 12:27 pm

The site map in XML format XML site map

Contact Us | Privacy Policy