LuxSci supports a plethora of modern email programs like Microsoft Outlook and Eudora (our blog posting "Head To Head Battle of Email Clients" discuss several of these) and works with any email program and device that properly supports POP, IMAP, or SMTP. However, we do recommend Mozilla Thunderbird in the absence of any personal preferences or specific requirements for things that may only be supported in Outlook or other specific programs. LuxSci’s staff uses Thunderbird with IMAP (or WebMail) uniformly for all email sending and receiving. We discuss the reasons why in the "Battle" blog article. Here, we will give some configuration tips and tricks and recommended add-ons.
TLS (Transport Layer Security) is the mechanism by which two email servers, when communicating, can automatically negotiate an encrypted channel between them so that the emails transmitted are secured from eavesdroppers.
It is becoming ever more important to use a company that supports TLS for email transmission as more and more banks, health care, and other organizations who have any kind of security policy are requiring their vendors and clients to use this type of encryption for emailed communications with them. Additionally, if your email provider supports TLS for email transmission, and you are communicating with people whose providers do also, then you can be sure that all of the email traffic between you and them will be encrypted.
How do you find out if someone to whom you are sending email uses a provider who’s servers support TLS-encrypted communications? We will take you through the whole process step-by-step, but first let us note some important truths about TLS connection encryption.
The short answer is "no" … unless you need to support web browsers 8+ years old on computers that cannot be patched or upgraded and which are not in the USA or Canada.
Security researches will be outlining attacks that can break the WPA wirless security protection of wireless networks this week at the PacSec conference in Tokyo. Erik Tews and Martin Beck will discuss how networks protected by TKIP (Temporal Key Integrity Protocol — originally called WEP2) are vulnerable to attackers being able to inject small amounts of traffic into the encrypted data stream. This can allow attackers to:
TLS (Transport Layer Security) and SSL (Secure Sockets Layer) are protocols that provide data encryption and authentication between applications in scenarios where that data is being sent across an insecure network, such as checking your email (How does the Secure Socket Layer work?). The terms SSL and TLS are often used interchangeably or in conjunction with each other (TLS/SSL), but one is in fact the predecessor of the other — SSL 3.0 served as the basis for TLS 1.0 which, as a result, is sometimes referred to as SSL 3.1. With this said though, is there actually a difference between the two?
LuxSci has been approached by many people asking for VPN (Virtual Private Network) services. When we ask them why, they indicate that they use wireless hotspots (like at Starbucks and other public places) that are insecure and untrusted and they want to be sure that their email is secure and encrypted there.
This is a very legitimate concern. Wireless hotspots are serious danger zones; we have seen many cases of people who have carelessly used insecure connections to email and had their login usernames and passwords stolen in such places. This can lead to identity theft, the leaking of sensitive company or personal information, and other serious problems. Anyone using public wireless hotspots or other untrusted networks for email and other activities that involve personal information need to take care that the information sent to and from their computers is protected. If the transmission of your sensitive information is protected, then you have nothing to worry about and hotspots can be great places to work.
LuxSci has had many requests from clients who have to communicate with various banks and other security-conscious organizations asking that LuxSci "enforce the encryption of email when sent to those organizations’ email servers via TLS". This is such a common request, that I wanted to explain what it means, why it is good, how LuxSci does this by default, and the extra step that LuxSci can take to lock down things even more for you.
LuxSci now supports encryption of inbound email messages during their transport to and from LuxSci and other email servers. This ensures that your messages are protected from eavesdropping during transport even if the messages themselves are not encrypted using SecureLine. Note that the messages will only be encrypted during transport when sent from an email server that supports TLS (like LuxSci’s servers do).
"Internet email, Internet instant messaging, and mobile short text messaging are related in that they enable communications by pushing messages from sender to recipient over generally insecure networks. The security issues and vulnerabilities inherent in all three modes of communication are also very similar. This talk will review standard security threats associated with electronic messaging in general, and their common remedies including symmetric and asymmetric key encryption, digital signatures, and message authentication codes. Next, a detailed exposition of the security vulnerabilities inherent in all phases of Internet email delivery will be examined and solutions such as S/MIME, Authentication, and Transport Layer Security (TLS) will be discussed. After a brief look of the serious issues involved with public Instant Messaging services such as AOL Instant Messenger, Yahoo! Messenger, and ICQ, the Short Messaging System (SMS) over the Global System for Mobile Communications (GSM) will be examined. We will review the current security protocols used by GSM and identify the vulnerabilities to SMS. Finally, several ways that GSM or SMS could be extended or modified to ensure the security and privacy of SMS messages, even in a multi-vendor mobile environment, will be proposed."
