7 ms·

And this is why us financial people have our own secure messaging services that don't touch email systems other than for notification...

omgtehblackbloc 12y ago
lol i thought about explaining your folly, but then i remembered that i hate financial people. so i'm content to await the inevitable fate of your l33t financial "secure messaging service".
- yebyen 12y ago
  They (his vendor) are undoubtedly insured, if something goes wrong he will of course have someone to sue. No problem!
  - bsder 12y ago
    Exactly. This is why you outsource--"Not our fault. Throw them in jail."
  - allegory 12y ago
    Exactly this. Business is not about providing optimum security - this is financially impossible unless you have a black ops size budget. It's about protecting one's ass as best as possible and having mitigation in place for anything that may be your fault.
BillFranklin 12y ago
What made your company choose to start encrypting your email? Could you share some more info on your setup?
- allegory 12y ago
  We don't encrypt it. We don't send it anywhere. You have to come to us to read it.
  - ejr 12y ago
    "messaging" Implies that these notices travel from A to B likely in your own network, but you added "secure". This suggests the network itself is only password protected and is a compromise - or two? - away from revealing what is being sent. The purpose of encryption is to limit the damage should eavesdropping of the network occurs. Ex: Your routers, switches, RAID storage etc. are not immune to rootkits. However, if your message from A to B is encrypted and only decrypted locally by B, you've limited the exposure of this information.
    - allegory 12y ago
      Everything is only a compromise or two away from being revealed. It may be one compromise away and we don't know it (yet). Cat and mouse my friend, that is all. There are no passwords - we use our own CA system, PKI, carefully selected cipher suites, physical security, mutiple vendors' products, logical isolation, tiered architecture, an IDS system, mirrored environments, tamper detection and automatic key disposal. And I still don't sleep because there are a thousand ways around it all. Still, we have insurance.
      - ejr 12y ago
        That's a rather bleak outlook, but I don't blame you. Obviously you can't name which specific company you work in, but may I ask which sector in finance you do?
        allegory 12y ago
        It's the chains of being responsible for the security :-) Integration between various companies, nothing more. We're a hub.
        BillFranklin 12y ago
        Thanks for the info. I work in email encryption so it's useful to know what specifically makes it appealing.
- bentcorner 12y ago
  MessageLabs.com is a common one I've seen different financial institutions use. IIRC, it's ugly but functional. It's an odd UI flow but tolerable: 1. Get an email at your normal email that you have a message at secure email provider 2. Click link, get taken to a web page where you need to make an account to read the mail 3. Read mail at the link, you can reply and attach stuff to it, and that's it. No create mail functionality. So you end with up with "email conversation as a link" sort of feeling. Very odd when you're used to dealing with any other "normal" webmail site.
  - Mandatum 12y ago
    What happens when A. you click a phishing link which takes your username and password, logs into the real site and downloads all of the data, B. the site is hacked and all of the mail on the site including archived stuff is leaked, or C. someone manages it MitM your network, uses a quasi-signed cert to spoof the actual website and reads all of your mail or finally D. the hosting provider is raided, and all data is handed over to an authority? I don't think trusting a third-party with highly confidential financial data is very good practice.
wyager 12y ago
Which services do you mean?

omgtehblackbloc 12y ago

lol i thought about explaining your folly, but then i remembered that i hate financial people. so i'm content to await the inevitable fate of your l33t financial "secure messaging service".

yebyen 12y ago
They (his vendor) are undoubtedly insured, if something goes wrong he will of course have someone to sue. No problem!
- bsder 12y ago
  Exactly. This is why you outsource--"Not our fault. Throw them in jail."
- allegory 12y ago
  Exactly this. Business is not about providing optimum security - this is financially impossible unless you have a black ops size budget. It's about protecting one's ass as best as possible and having mitigation in place for anything that may be your fault.

BillFranklin 12y ago

What made your company choose to start encrypting your email? Could you share some more info on your setup?

allegory 12y ago
We don't encrypt it. We don't send it anywhere. You have to come to us to read it.
- ejr 12y ago
  "messaging" Implies that these notices travel from A to B likely in your own network, but you added "secure". This suggests the network itself is only password protected and is a compromise - or two? - away from revealing what is being sent. The purpose of encryption is to limit the damage should eavesdropping of the network occurs. Ex: Your routers, switches, RAID storage etc. are not immune to rootkits. However, if your message from A to B is encrypted and only decrypted locally by B, you've limited the exposure of this information.
  - allegory 12y ago
    Everything is only a compromise or two away from being revealed. It may be one compromise away and we don't know it (yet). Cat and mouse my friend, that is all. There are no passwords - we use our own CA system, PKI, carefully selected cipher suites, physical security, mutiple vendors' products, logical isolation, tiered architecture, an IDS system, mirrored environments, tamper detection and automatic key disposal. And I still don't sleep because there are a thousand ways around it all. Still, we have insurance.
    - ejr 12y ago
      That's a rather bleak outlook, but I don't blame you. Obviously you can't name which specific company you work in, but may I ask which sector in finance you do?
      - allegory 12y ago
        It's the chains of being responsible for the security :-) Integration between various companies, nothing more. We're a hub.
        BillFranklin 12y ago
        Thanks for the info. I work in email encryption so it's useful to know what specifically makes it appealing.
bentcorner 12y ago
MessageLabs.com is a common one I've seen different financial institutions use. IIRC, it's ugly but functional. It's an odd UI flow but tolerable: 1. Get an email at your normal email that you have a message at secure email provider 2. Click link, get taken to a web page where you need to make an account to read the mail 3. Read mail at the link, you can reply and attach stuff to it, and that's it. No create mail functionality. So you end with up with "email conversation as a link" sort of feeling. Very odd when you're used to dealing with any other "normal" webmail site.
- Mandatum 12y ago
  What happens when A. you click a phishing link which takes your username and password, logs into the real site and downloads all of the data, B. the site is hacked and all of the mail on the site including archived stuff is leaked, or C. someone manages it MitM your network, uses a quasi-signed cert to spoof the actual website and reads all of your mail or finally D. the hosting provider is raided, and all data is handed over to an authority? I don't think trusting a third-party with highly confidential financial data is very good practice.

wyager 12y ago

Which services do you mean?