Since the NSA affair and Edward Snowden, users have increasingly been asking how secure their emails are. This, of course, refers to email communication. The focus is on the security standards of email mailbox providers and their protection mechanisms regarding data privacy and encryption.
In this blog post, we provide you with a small list of tips and criteria. The more criteria on this checklist your email provider's mailbox fulfills, the more secure your emails and your email communication will be.
7 points by which you can assess the security of your email account
Encryption 1: End-to-end
End-to-end encryption is an important criterion for a secure email. This means that the content of the email is always transmitted encrypted across all transmission stations. Eavesdropping on the email and its content is thus useless, as only the communication partners at the respective endpoints of the chain can read the message. SSL or TLS generally provide a high standard of encryption. This gives your emails approximately the same security standard as online banking.
Encryption 2: Perfect Forward Secrecy
Some providers go even further with encryption in email communication and offer a special advantage: Perfect Forward Secrecy.
With Perfect Forward Secrecy, an email is re-encrypted with every data transfer. This significantly increases the security of the email, as data, even if it were intercepted by a state or intelligence agency, for example, can no longer be decrypted retrospectively. This is because, unlike end-to-end encryption, with Perfect Forward Secrecy, there is no one left who would have a suitable key.
Data Query: What does your email provider want to know about you?
Your email provider should not force you to disclose your real name, phone numbers, or similar when creating your account. The only mandatory fields you should provide when applying for your email are:
- The email address you wish to obtain, including a strong password for your account.
- A checkbox confirming that you have read the data protection conditions and the general terms and conditions.
Providing gender, name, address, place of birth, date of birth, contact details, account number, etc. should always be voluntary. The less your provider wants to know about you, the more anonymous you are, the better. And the fewer data your email provider has about you on its server, the less it can pass on if in doubt. This better protects your privacy.
Due to strict data protection regulations, "made in Germany" is also a good seal of quality for email providers.
Data Control: What information lies dormant on foreign servers?
The contents of all emails are stored on your provider's servers. As a rule, this data is well protected here against hacker attacks and the like. But what exactly does the email provider do with all the data?
Some providers offer the option to simply delete this data from the servers. With some providers, you can even automatically delete mailboxes and freely choose the deletion interval. Emails you want to keep can then be moved to a secure folder within your mailbox or - also possible - saved locally, for example, on a hard drive encrypted with TrueCrypt.
Ad-funded or fee-based?
While it may seem self-evident, not all users and customers have yet realized this: Email providers are companies, and they don't give away free email mailboxes out of charity. As a user, you always pay for them with your data. Sometimes this information is also resold or made available to advertisers for the most individualized purchase offers possible. Users of free email mailboxes should have no illusions about this and should rather invest a few euros per month or year. As a rule, for these euros, you also get a mailbox with significantly more GB of free storage than in the free version from the same provider.
Payment Processing
But even if you use a paid mailbox, paying is not just paying. The more anonymously you can pay monthly, the less (bank) data you disclose about yourself. If possible, you should prefer paying via PayPal to credit card, direct debit, or online transfer. There are even email providers to whom you can send the fee for a specific mailbox by post each month. While this sounds far-fetched, it is unbeatable in terms of anonymity.
Two-Factor Authentication
What is now mandatory for online banking is gradually becoming possible for email mailboxes and email addresses: Two-factor authentication. Two-factor authentication means that in addition to entering a password, you also have to provide a mobile number or install an app, for example. To access your mailbox, you then have to enter a security code that you receive via SMS or retrieve via the installed app on your smartphone. Two-factor authentication offers an additional layer of security but is still unusual for email addresses as it makes access more difficult.
Online Security 360-Degrees
As shown, the security of your emails largely depends on the business model your email provider pursues, or how good its encryption protocols and security mechanisms are.
But online security or security in email communication means more: This also includes protection against malware, spam, phishing, as well as dangerous links and email attachments. Here you can rely on Cyber Shield, a virtual sandbox, which creates a completely secure working environment for the internet. Even the most dangerous email attachments can be opened in this environment without concern.
