We covered phishing and other nefarious fraudulent emails in yesterday's diary. Today's entry is about preventing unauthorized access to your email and some email handling issues.
Unauthorized Access to your email can occur for a number of reasons
you picked a simple password, and someone guessed it
you picked a good password, but someone guessed the password reset question (remember Wasilla High ?)
you accessed your email account from an unsafe public terminal
you accessed your email account from a safe personal computer, but did not use SSL
Derived from this are a few steps you can take to make things harder for snoops:
Pick a good long password. And do change it every now and then. I am certainly no fan of change your password every xx days rules, but for online email, changing it on occasion actually makes good sense -- it is your only chance to lose any stalkers you might have picked up over time. Your ex, your dorm roomie, etc, might know your password, and can passively snoop your inbox without you ever noticing. Only changing the password shakes them off.
Actually go through the I forgot my password routine once. Just pretend that you don't remember the password. And then watch carefully how hard (or not) it actually is to regain access. There are still mail providers out there who require you to have a 10-character password, but at the same time force you to use The color of your first car as a password reset question. Having a password reset option is good (heck, I also forget passwords if the vacation is good and long :), but the reset option should be as hard to guess or fake as the original sign-on. If you got the choice, pick a provider that allows you to write your own question/answer pair and that includes some sort of out of band notification like SMS.
For the unsafe public terminal, well, don't log into your email there. Within a couple months, all of us will anyway carry web enabled mobile phones, and those shady airport and hotel PCs will hopefully then follow the internet cafe into merciful obscurity.
If you are already using a mobile phone or *pad or *book for email access on the go, make sure that your email client is set to use SSL/TLS. HTTP, IMAP and POP3 should all be avoided if they are not paired with SSL/TLS for encryption (HTTPS, for example). Remember, WiFi signals can be intercepted and recorded by everyone in range. Without encryption, eavesdroppers get to see your login credentials and all the email that you download and read.
Reply to all was not invented for people who click faster than they think. On occasion, these embarrassing broadcasts of a person's naivet make everyone at the office cringe. Thus, if you are using reply to all, check carefully who is on the recipient and cc: lists. And do everyone a favor and never reprimand a hapless reply-to-all person by also replying to all with an admonishment.
Unsubscribing also has its pitfalls. If you try to unsubscribe from some list that you never actually subscribed to, chances are that you just confirmed to some spammer that you actually read their email. Only use unsubscribe on things that you vaguely remember ever having signed up to, and use mark as spam for all the rest.
Last but not least, EMail is a poor medium to convey irony or sarcasm. As useful as email is, the more contentious a discussion gets, or the more back-and-forth replies pile onto replies, the better off you likely are by picking up the phone, and having an old-fashioned talk.
If you have other tips on how to keep email safe and secure, please comment below or use the contact form.
(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.