Alastair’s Place

Software development, Cocoa, Objective-C, life. Stuff like that.

One of My Favourite Myths…

…is that email (even in plaintext) is in any way less secure than a telephone, a letter or a fax.

People who take this viewpoint usually haven’t actually considered the security of the other media in any way. First, let us consider telephone calls and faxes; in the U.K., there are still an awful lot of exposed telephone cables… and even if they are only exposed at the edge of your property, it only takes a few minutes to splice some wires onto your cable, at which point all of your supposedly more secure telephone calls and faxes are easily intercepted. Unless you routinely encrypt them, that is. Mobile phones are a bit safer, because they encrypt your call over the air interface. Unfortunately, the encryption isn’t really strong enough, and in any event, chances are that you’re calling a vulnerable landline—and remember, you only need to tap one end of the call to hear the entire thing.

And as for letters… well, I recently had a debit card go missing in the post, so don’t talk to me about letters! Plus there was a very good television programme recently demonstrating just how easy it currently is to get a job in the Royal Mail sorting departments and how easily that position can be abused.

The difference is that in order to intercept an e-mail, you have to be clever (or you have to have clever people helping you). At the very least, you have to persuade the Internet e-mail system to route it to you rather than to its intended recipient; now, there are a number of techniques you could use to do this (which I’m not going to go into here), but none of them are especially easy for a layman (unless you can find a program written by some irresponsible but clever individual that already does what you need). Unlike tapping a telephone line, which can be done by anybody with an easily purchased engineer’s telephone, a sharp knife and some wire and croc-clips.

On top of that, with S/MIME support in several major e-mail packages—including the very nice implementation in Mac OS X’s—it is almost trivially easy to encrypt an e-mail message. Contrast that with telephony, where you need special equipment at both ends, or letters, which would have to be tediously encrypted and decrypted at either end.

Of course, you could point-out that e-mail could be intercepted by tapping the telephone line as well, and you’d be right. It can. But it isn’t really any less secure than a telephone conversation over the same piece of wire, and it’s often more difficult to find the bit of wire associated with an Internet link than it is to locate the cable associated with a given phone number; in the latter case, .