Email Policy and Philosophy

What is the deal with that strange (invalid) looking email address?

Why you should use Pretty Good Privacy (PGP).

Software every computer should have installed, updated and used regularly.

What is the deal with that strange (invalid) looking email address?

The SPAM problem has gotten out of control. It is beginning to affect the people's productivity, enjoyment, and even usability of the Internet. To that end, I will no longer put "regular" email addresses for myself or others on any email/news posting I send or webpage I make/fill-out. This is because every time you post a form or a newsgroup message on the Internet (or someone posts a copy of one of your emails to a form or a newsgroup) SPAMmers use automated software (known as "robots" or "spiders") to search every newsgroup, webpage, form, etc. and extract out the email addresses in the messages. SPAMmers then use these email addresses to compile huge databases that they use to hawk their wares (usually pornography) or (even worse) sell to others so that they can hawk their wares.

You may see SPAM referred to by one of its many technical names:
UCE - unsolicited commercial email
UBE - unsolicited bulk email
UCBE - unsolicited commercial bulk email
UEMS - unsolicited electronic mail solicitations

People have been trying to thwart SPAM for years. Recently, people have taken to adding the text string "nospam." to their email addresses with the notation to remove it before replying to the message. For example: george.bush@whitehouse.gov becomes george.bush@nospam.whitehouse.gov. This worked for a while, since the robots only looked for the "@" and the domain (i.e., .com, .net, .gov, .mil, etc.) at the end of a text string to determine if the text string was an email address. SPAMmers have wised-up and now have their robots remove "spam.", "nospam.", and "UCE." from text strings it defines as email before adding the email address to its database. So SPAMmers still get your email address.

So here is what I'm going to do (and I suggest you do the same): Change george.bush@whitehouse.gov to george.bush(at)delete.spam.now.whitehouse.g o v. How has this change made life more difficult for SPAMmers? First, with "(at)" replacing "@" and ".gov" changed to ".g o v" (note the spaces after the "g" and "o" in ".gov"), a robot may not even recognize the text string as an email address. Second, if a robot does recognize the text string as an email address, the added "delete.spam.now." won't prevent the robot from adding that text string to its database of scanned email addresses, but the "delete.spam.now." text string makes the email address invalid. If a robot is programmed (as some are) to remove the text string "spam." from email addresses it finds, there are still the "delete." and "now." text strings present, still leaving the email address invalid. What is to prevent SPAMmers from manually removing the "delete.spam.now." or the "delete." and "now." text strings out of your email address in their database? Nothing. However, these SPAMmers use robots for a reason: Time and numbers. SPAMmers don't have the time to manually search millions web pages, newsgroup postings, and forms for email addresses or to sift through a database containing millions of email addresses to check them for validity. To SPAMmers it is strictly a numbers game. If, out of the six million email addresses in their database, one percent is invalid, SPAMmers can live with that, and you don't get your email address compromised. Below is an example of my email address in the format it will be in my email from now on:

childers(at)delete.spam.now.geckoco.c o m

To thwart SPAM, the above email address has been altered. Please reformat the email address and remove the obvious invalid text string to reply.

That wasn't so bad now was it? The only downside, is that you will have to manually enter an email address malformed in this manner to your address book as your email client probably won't see it as an email address (and if it did, would be an invalid one). Or, if replying to this email in your email client, your "reply" button might not work correctly. You may have to create a "new" email message to me and (if you wanted to include the text of the email you were replying to) "copy and paste" my email message into your "new" email message. "Clicking" on this malformed email address would have the same effect as "clicking" on a string of ordinary text, it would not "open" a "new" email message to me. I know that this is an additional administrative burden on us all. However, the long term benefits of thwarting SPAM are worth it.

It won't be this way forever: The day is coming when all email will be "opt-in." This will require a complete change in email systems, but the technology does exist. "What is an "opt-in" email scheme?", you ask. Anytime someone not in your address book or other list of "approved" email addresses sends you an email, your email server (or client) automatically emails them back to verify that it is a monitored, working email address. The original sender must reply to the automated message from your email server (or client) in some way that only a human being can (e.g.: reply with the text of a word embedded in a small graphic [e.g.: *.jpeg] file that is displayed in the email message that a person can easily distinguish from other deliberately inserted "noise" in the graphic, but software cannot). Once this is done, the original email actually gets presented to you, the recipient. You can then decide whether or not to "block," "reply," or "ignore" the message/sender. For automated messages such as order receipts from a company you just transacted business with via their website, the company could ask for your "passphrase" to include in the subject line of the email message that bypasses the automated verification process. Alternatively, the business could provide you with the email address that the automated receipt will be sent from and you could "add" that name to your "approved" list. By the way, the approved list is more than just a list of people who get to bypass automated verification; you can decide how long email addresses stay on the list, etc.

Why you should use Pretty Good Privacy (PGP).

Did you know that every email you send on the Internet can be read by anyone? That's right, and I don't mean anyone with an IQ over 150, who has a Computer Science degree, and/or is a sophisticated (and talented) hacker/cracker. Anyone can download an automated tool (probably created by one of the aforementioned persons), read the directions, and activate it on an unsecured public router (a kind of direction service for Internet traffic), and presto! can read all the traffic (including email) that goes through that router. Why would someone bother with this? Hackers can set the software they're using to look for specific text strings...like 16 digit numbers (credit card numbers). When the software comes across such a number, it saves the entire email message (which probably includes your credit card expiration date, billing address, etc. if you were ordering something) and sends it back the hacker. To enhance productivity, the software can be set to look for 16 digit numbers that begin with specific number sequences (such as 4432 for some Visa Check [Debit] Cards). Next thing you know, your credit card is maxed out with purchases of computer hardware/software sent to an address in Russia. This scenario has happened to others...it is not an isolated incident. Hackers even have forums where they trade massive amounts of stolen credit card numbers. How do you thwart these ne'er-do-wells? You use Pretty Good Privacy. Pretty Good Privacy (PGP) is encryption software that is (relatively) easy to use and is industrial strength. Your email is encrypted on your computer and then sent out over the Internet to it's recipient. Any software "spying" on router traffic will only find unintelligible, meaningless text in your message (versus easily readable text in non-encrypted messages) and move on to the next email message concluding there is no desired information in your email message. Your PGP encrypted email messages are labeled as PGP encrypted email messages. You should not worry about your PGP email message being singled out for scrutiny because of this since PGP's encryption can't be cracked (yet, anyway). The prevailing scientific opinion is that based on current technology (and predicted future technology) PGP's encryption algorithms will not be broken in your lifetime. A completely new, theoretical, and unproven technology (quantum computing) may hold some promise at cracking a PGP encrypted message, however the technology is still in its infancy and is very expensive. It is unlikely hackers will have access to this technology (which the US Government [USG] wants to keep secret) anytime in the next century. Research in quantum computing is being conducted at the Massachusetts Institute of Technology (MIT) under contract to the National Security Agency (NSA). Before anyone gets too upset, there is a difference between sending an email with your credit card number in it and making a secured transaction on a website. If your browser (e.g.: Internet Explorer) has a "https://" at the beginning of a Uniform Resource Locator (URL) in the address bar, your transaction is encrypted (probably at 128-bits). This is an acceptable level of security for an online transaction. Unfortunately, just because the connection and information exchange you have with a website is secure doesn't mean that once they (the website) has your information that it remains secure. Hackers routinely compromise the corporate network security of these businesses to access databases of customer credit card information the business has from past transactions with you. The hackers either steal the information outright for credit card fraud, or they extort money from the business not to use their customers information for credit card fraud and expose the company to bad publicity. If extorted, the businesses usually pay to avoid the bad publicity, so you never find out that your information was compromised. Fortunately, businesses seem to be taking network security much more seriously recently after seeing the price other businesses have paid for not taking network security seriously. Today, your transactions with businesses via secure websites are probably as safe as any other.

For another reason as to why you should use PGP, let me make an analogy to the United States Postal Service (USPS): If you have nothing to hide, why don't you write all of your postal correspondence on post cards (versus stuffing them in envelopes)? It would be easier and less expensive. You don't write all of your correspondence on post cards, not because you have anything to hide, but because the details of your communications with others is no one's business except yours and the person you are corresponding with. For this reason (one of principle) you should encrypt all of your email messages using PGP.

Even if you were unconcerned with the privacy of your correspondence via email messages and never sent confidential information (e.g.: credit card numbers) via email messages you should use PGP to help the rest of us who are concerned. Why? Because the USG has been trying to outlaw/restrict the use of encryption by the public for years. This is not a joke: The US Department of Commerce (USDOC) classifies encryption as munitions (the same as nuclear weapons). The USG thinks that encryption poses that great a threat to the US. Enough of a threat they the USG wants to limit your access to encryption (thus limiting your constitutional right to privacy as found by the US Supreme Court [USSC]). I'm a patriot and I love the US, but that is BS! Encryption enhances our freedom in our personal/business affairs and helps prevent USG tyranny. I am familiar with all of the arguments about why encryption technology should be limited/outlawed and I soundly reject them (including the "terrorists use encryption" argument). When we limit our freedom because of terrorism, the terrorists have already won.

Now for a quick PGP primer. If you can't afford PGP from PGP Corporation, then you can get freeware PGP from the PGP International Project. Do not download your version of PGP from anywhere else. Yes, the freeware version is more difficult to use and has a steeper learning curve. No, all of the features of commercial PGP may not be present and/or work correctly in the freeware version, but it is still worth it to install and use PGP. My advice is based on commercial version 8.0.2. First, read the manual, directions, readme.txt/.doc/.rtf/.pdf, online support, and help file(s) for your version of the program. Once you have done this and are ready to create your key pair, make sure you use the slow method of key generation, as it is more secure. Make your keys the highest bit strength your software will allow (4096-bit in 8.0.2). And use a passphrase, not a password. Include alpha-numeric and symbol digits in your passphrase. This process only has to be done once and may take several hours...just start the key generation, and pop a movie in the VCR; your key pair will be ready when the movie is over. Once you have done this, upload your public key to the PGP KeyServer and have your email client include your public key in all email messages you send (you can use a signature file for this). Anyone who has PGP and your public key can decrypt PGP email messages from you. Zealously guard your private key. If your private key is compromised, the only thing protecting your email message privacy is your passphrase. Your passphrase is much easier to guess than your private key. If your computer is shared with others, configure PGP to ask you for your passphrase when you attempt to open a PGP email message and not to cache your passphrase. You may also wish to store a copy of your private key on two floppy disks (one to keep in a safe place, and one to use on the shared computer). If your private key is compromised, make a new key pair, revoke the "old" public key on the PGP KeyServer, and alert all of your email contacts to start using your "new" public key effective immediately. Any attempts to alter a signed (much less encrypted) message by others will render it invalid and PGP will warn you. You now know that someone is monkeying in your business.

If you are concerned about TEMPEST attacks configure PGP to use the "secure viewer" when you read your PGP email messages. What is a TEMPEST attack? I don't know what it stands for, but TEMPEST is an acronym. Those of you with Cathode Ray Tube (CRT) computer monitors are the ones at risk for a TEMPEST attack. Your CRT generates and uses electromagnetic energy to display information on your screen. This energy (and thus the information on your screen) can be "read" using sophisticated/expensive equipment from some distance away and through walls. The "secure viewer" uses a font that is light gray and thus doesn't require nearly as much electromagnetic energy to display on your screen. This greatly reduces the possibility that your PGP email message can be "seen" by others using TEMPEST equipment. Notice that I said, "reduces the possibility" not "eliminates the possibility." The TEMPEST equipment may still be able to "see" your screen if it is physically moved closer to your monitor. LCD monitors (including notebook computers) are immune from TEMPEST attacks. Unless you are in the intelligence business, work for a major corporation, or are engaged in activities that have aroused the interest of law enforcement, you probably don't have to worry about TEMPEST attacks. Remember, just because you are using an LCD monitor doesn't guarantee your "screen" information is secure. It is cheaper than TEMPEST to simply trespass onto your property and place a wireless micro video camera in your ceiling to view your screen. Also, keyloggers/screen capture software can be surreptitiously installed on your computer to "steal" your passwords/screen information and email them to others. And don't forget the old fashioned "hack:" If you don't have a properly configured software/hardware firewall and virus protection, hackers can compromise your computer's security over the network (Internet).

The person you are sending a PGP email message to will benefit greatly from having PGP themselves. If the recipient doesn't have PGP, no one (including the recipient) can read the email message. If you have a correspondent who simply refuses to download/use PGP, then you can send them PGP Self-Decrypting Archives (SDA) as an alternative. Both parties will probably have to have an IA-32 (Intel 32-bit processors such as the Pentium) for this to work. How does this work? You write your message in whatever format you want (e.g.: Microsoft Word). Then save the file to your hard disk drive (HDD) and run SDA on it. To further confound would-be cryptologists, compress the file (e.g.: make a .zip file out of it) before you run SDA on it. This will make the file smaller, easier to send via email or to fit on a floppy disk (CD-ROM, or whatever), and exponentially increases the difficulty of "brute force" decryption by attackers. SDA will ask you for a password/phrase to use on the SDA. Do not use your PGP passphrase. Use a different passphrase. If your security needs dictate, use a different passphrase for each SDA you send (or at least a different passphrase for different correspondents). Now send the SDA file you created to the intended recipient via USPS mail (e.g: on a floppy disk) or email it to them as an attachment. Making an SDA does not destroy your original file, it makes an encrypted copy of it. If you need to irrevocably delete the original file (or the SDA after it has been sent), run PGP Wipe on it. Configure wipe to use the maximum number of passes. Once the recipient receives the SDA, they simply "double-click" on it, enter the passphrase and the original message is decrypted. The SDA remains intact; a copy of the message is created. After reading the message, the copy of it, the SDA itself, or both can be deleted, if necessary. Here is the inherently insecure part about using SDA: Without a key pair, you have to use a passphrase, and you must give this passphrase to the recipient so they can decrypt it. Do not include the passphrase in your email that has the SDA attachment or in a file on the media that contains the SDA. If you do that, you negate the purpose of encrypting the file in the first place. Telephone (with a wired, land-line) or postal mail (separate from the SDA) the recipient and give them the passphrase. This is much less secure than you both using PGP, but is more secure than using a wireless or cordless phone, or paging/text-messaging/instant messaging the recipient with the passphrase. Unless you are in the intelligence business, work for a major corporation, or are engaged in activities that have aroused the interest of law enforcement, you probably don't have to worry about anyone eavesdropping on your wired, land-line conversation or opening your postal mail to get the passphrase. This discussion has focused on email security, however, you can use SDA or PGP (in a supported email client such as Eudora) to encrypt (and sign in PGP) files as well as email.

Lastly, if you have a serious security situation, do this:
1.    use an LCD monitor (to thwart TEMPEST attacks)
2.    use the secure viewer (just in case)
3.    use Qualcomms's Eudora e-mail client
4.    check for and install security updates for your operating system, PGP, your email client, and your word processor daily
5.    use PGP as described in the preceding paragraphs
6.    properly configure and use a software/hardware firewall and virus scanner (to prevent viruses, Trojan horses, keyloggers, etc.)
7.    make sure your correspondent uses follows the same steps.
and then...
1.    create your message in your word processor
2.    compress it (using a widely available compression program such as WinZip from WinZip Computing)
3.    SDA it with the output as text
4.    attach the SDA file to an email message
5.    sign the email message with PGP
6.    encrypt the email message with PGP
7.    send the message
If you do this, no one who intercepts that email message in transit will be able to read that email message except for the intended recipient. However, this doesn't mean that it can't be gotten off of your computer or the recipients computer once it is delivered and decrypted on their end. So once the message is sent, use PGP Wipe to delete the message, the SDA, and Clipboard contents. Have the recipient do the same and not print the message. If you and your correspondent do all of this, you can be almost 100% sure that even the NSA or Federal Bureau of Investigation (FBI) can't decrypt that message. The only way for them to get the contents of the message is for you or the recipient to tell them. Most cases of encrypted messages being decrypted are because the authorities coerced a suspect to give them the passphrase in exchange for leniency or to show good will through cooperation with the authorities. If you don't divulge your PGP passphrase and have taken the precautions above, no one can read your messages, period.

Software every computer should have installed, updated, and used regularly.

1.    Symantec Norton AntiVirus Professional (the current year's edition) - an antivirus program
2.    Symantec Norton Personal Firewall (the current year's edition) - a firewall program
3.    Symantec Norton AntiSpam (the current year's edition) - a UCE blocking program
4.    PGP Corporation PGP Personal Desktop (current commercial version) - an encryption program
5.    Microsoft Windows XP Professional - an operating system
6.    Microsoft Word (current version) - a word processor
7.    WinZip Computing WinZip (current version) - a file compression program
8.    Qualcomm Eudora (current version) - an email client program

My PGP Public Key.

Click [HERE] for the file version of my PGP public key.

Here is my clear text public PGP key: