2 ms·

'Securely' means that only my accountant can read the message and view the files. I'm afraid I don't know what a 'thread mode' is. I expect my accountant to v

by MarkMc 14y ago

'Securely' means that only my accountant can read the message and view the files. I'm afraid I don't know what a 'thread mode' is. I expect my accountant to view the information I provide, reply to me securely and then submit my tax return on my behalf.

ColinWright 14y ago
That's "Threat" mode, not "Thread" mode. Do you want to defend against: * ... someone in their office reading the email if your accountant's computer is left unattended? * ... your ISP storing the email and reading it? * ... their ISP storing the email and reading it? * ... someone sniffing the packets through a router? * ... the NSA reading the emails? If you want your accountant not to have to do anything, then you need something like storing the emails and/or documents on an "https" only server, and then sending them a link. Given your comment about not wanting them to have to do anything, this will be one way only, and they won't be able to reply securely. Sending them an encrypted email and asking them to read it will, I believe, require them to set something up, and you seem to have ruled that out. You could use something like a password in a standard document format, and then phone and tell them the password separately. I think you can password lock Microsoft Word files, for example. Not very secure, but secure enough against idle sniffing. Probably not secure against a full on attack by someone seriously capable. So, again, against what, exactly, are you defending?
- MarkMc 14y ago
  At the risk of being too inexact: I want to defend against all those things, although I don't think it's practical to defend against someone in his office looking over his shoulder or reading his screen when he gets up to make a coffee. Using a password-protected Microsoft Word file is an option, but it's a little cumbersome because (a) I would also have to password-protect the other attachment files separately; and (b) he would have to reply with a password-protected Microsoft word file and individually password-protect any files he wants to send me. I like the idea of an https server, but why won't my accountant be able to reply? That is, accountant clicks a link to the https site, puts in password, sees message, clicks the 'reply' button on the webpage, then I get an email saying 'click here to see your accountants reply'.
  - ColinWright 14y ago
    With regards defending against the NSA - I believe you have no chance. With regards the password protected Word files, yes, you would have to protected every attachment, and your accountant would have to password protect every document in the reply. But what else would you expect? With the https server, will you implement the mail package? In other words, what "Reply" button? Even then, the document will be stored in clear on the server, so whoever owns it will be able to read them. So that had better be you.

by MarkMc 14y ago

ColinWright 14y ago

That's "Threat" mode, not "Thread" mode. Do you want to defend against: * ... someone in their office reading the email if your accountant's computer is left unattended? * ... your ISP storing the email and reading it? * ... their ISP storing the email and reading it? * ... someone sniffing the packets through a router? * ... the NSA reading the emails? If you want your accountant not to have to do anything, then you need something like storing the emails and/or documents on an "https" only server, and then sending them a link. Given your comment about not wanting them to have to do anything, this will be one way only, and they won't be able to reply securely. Sending them an encrypted email and asking them to read it will, I believe, require them to set something up, and you seem to have ruled that out. You could use something like a password in a standard document format, and then phone and tell them the password separately. I think you can password lock Microsoft Word files, for example. Not very secure, but secure enough against idle sniffing. Probably not secure against a full on attack by someone seriously capable. So, again, against what, exactly, are you defending?

MarkMc 14y ago
At the risk of being too inexact: I want to defend against all those things, although I don't think it's practical to defend against someone in his office looking over his shoulder or reading his screen when he gets up to make a coffee. Using a password-protected Microsoft Word file is an option, but it's a little cumbersome because (a) I would also have to password-protect the other attachment files separately; and (b) he would have to reply with a password-protected Microsoft word file and individually password-protect any files he wants to send me. I like the idea of an https server, but why won't my accountant be able to reply? That is, accountant clicks a link to the https site, puts in password, sees message, clicks the 'reply' button on the webpage, then I get an email saying 'click here to see your accountants reply'.
- ColinWright 14y ago
  With regards defending against the NSA - I believe you have no chance. With regards the password protected Word files, yes, you would have to protected every attachment, and your accountant would have to password protect every document in the reply. But what else would you expect? With the https server, will you implement the mail package? In other words, what "Reply" button? Even then, the document will be stored in clear on the server, so whoever owns it will be able to read them. So that had better be you.