Webamil insecurity

There are reports today that Google is considering quitting China after many Gmail accounts were hacked, belonging to human rights activists, both inside and outside China, apparently by the Chinese government. This poses an interesting question: how many people using Gmail or any other free, web-based mail system, are sending and receiving information that they consider confidential, with little or no idea about whether their accounts are secure.

You get what you pay for
It’s true: if you don’t pay for a service, why should you have any expectation that the provider is under any obligation to you? If you look at Microsoft’s “Terms of Service” for Hotmail, it clearly states that it provides no warranties for the service. In addition, the content may be stored pretty much anywhere in the world. So, how can people assess the risk of storing confidential information in these systems?

Auto forwarding mail
I have also come across people who automatically forward all of their work emails to an external Gmail or Hotmail account as they find it easier to use than the company-provided mail system. It might have more features; have a prettier user interface; whatever... However, this could potentially create a serious headache for the company or organisation concerned. Authentication to web-based mail systems is usually weaker, employing simple password-reset routines, where people can set their own questions (I saw one who had written, as his secret question “What is Captain Kirk’s middle name”. Not exactly the hardest thing to find out).
People routinely using webmail for very sensitive information, where the implications of disclosure include risks to people’s lives, should really reconsider whether using something like Gmail, Yahoo mail or Hotmail is a good idea in the first place.

There are a few solutions. Stick to your company’s mail system and consider using encryption, or try to use encrypted mail with webmail accounts. Encryption brings a whole new raft of issues I won’t go into here, but some companies already provide an integrated, but paid for, service to do this, like Hushmail.

But never forward email out of a company automatically to an external source without checking with your IT department first – there may be many more serious implications than you might realise.