Secure Windows E-mail Clients?

barbaBob asks: "I'm looking for a powerful and secure e-mail client that can handle large volumes of mail for multiple accounts (a mix of POP3 and IMAP). Since I don't want Outlook to be an option, I've been searching for alternatives (eMailMan is an excellent resource). Eudora Pro is a powerful client app, but isn't very stable running on Win2K so far. OpenSoft's ExpressMail seems to be an attractive option with its heavy focus on security and encryption. Netscape Mail is not up to the job, since it doesn't offer filtering. Pegasus Mail is another possibility. HP's OpenMail is very attractive in that if offers full compatability with Outlook/Exchange server-side-drop-in replacement, runs on Linux/Unix - but the client seems to be available to licensed users only so I can't try it yet. So what do you use when stuck with Windows for certain tasks?"

Comments

Five requirements for security

[Mark A. Rhowe]

When implementing secure e-mail, organizations need to consider the kinds of transactions that need to be secure, along with five security requirements:

(1) Confidentiality - Ensure unauthorized individuals cannot intercept and read your e-mail.

(2) Integrity - Ensure that the contents of the message are not altered in transmission. The message received at the other end needs to be exactly the same as the message that you sent.

(3) Authentication - Verify the identities of both the sender and receiver of a message. When you receive a message you need to be sure of the sender's identity.

(4) Access control - Ensure that your messages are not accessible to unauthorized individuals. For example, when you walk away from your desk, leaving your e-mail application open, you need to know that the contents of your messages are protected.

(5) Non-repudiation - The sender of a message should not be able to deny or repudiate signing a transaction. For example, the sender should not be able to deny signing a purchase order

pegasus mail

[sniggly]

Pegasus mail initial release was in 1990 - it was my first email client and still is my current email client on windows machines.

I have tried other programs - I wrote an email to netscape in '98 asking them to implement multiple POP support and they believed very few people would ever use that. Perhaps that attitude got them to where the... never mind that one :)

As far as i can tell pegasus was the first email client that implemented mail filtering rules, multiple accounts, and quite a few other goodies that are commonplace now. It's also been a free program since inception and the guy programming it seems to be a terribly smart aleck with great ideas and seems to listen to good ideas from the user community.

If you wont end up using pegasus at least you will have been impressed with examining it.

Too bad it isnt available for linux, however anyone willing enough to try seems welcome and seems to have to do a serious rewrite.

We have added OpenMail (to our Sendmail MTA setup)

[BitMan]

My company refuses to drop the "Microsoft Virus Distribution System" (aka Outlook). After applying the security patch (that disables a crapload of its insecure features), we ran into various issues. Basically, I think the whole security patches for Outlook were specifically designed to force you to buy Exchange. Instead, we opted for HP OpenMail. It's free for upto 50 users and has a 6 month trial (unlimited users).

It solved our shared Calendar and Contacts issues with its MAPI interface. Of course, none of these features of Outlook, even though they are stored on the server, are compatible with its included, native clients. We're still waiting for something better, but for free, it was a perfect fit (as my "cry baby" ignorant Office users complained after I installed the much needed Outlook fix when it came out). Hopefully the iCalendar and vCard standards in clients like Evolution will push Microsoft (among others) to support them (hopefully).

I mean, E-mail shouldn't be this hard and Sendmail (once setup) has been running for us solid for 12 months non-stop. OpenMail is great because it uses Sendmail (or any other MTA) underneath so you're not at it's mercy. Although you can have all our company's mail get redirected to OpenMail (e.g., as a Sendmail rule), setting up a subdomain or other MX record keeps its crap separate (I don't like Outlook crap going around on my network any more than I have to).

Anything to keep ignorant users (only about 20% of my company are these admin users, the rest are UNIX-using engineers) from screaming for Exchange is helpful. OpenMail is your ticket to keeping your servers Microsoft-free -- like ours where 90% of our work is UNIX-based and Samba handles the rest nicely. It is incredibly stable (even though the MAPI client for Outlook is only version 0.5 "preview release") and our server has been running for months now. Everytime I've dealt with an Exchange server, I expect no more than 60 days before a major corruption that keeps me busy for 48 hours straight. Not with OpenMail, it's rock-solid and has even survived someone twice accidently (and quite incorrectly) powering-off the Linux box where it is hosted.

It also doesn't take a lot of resources to run. Figure about 1-2MB max per client. For ~50 clients, a Pentium with 128MB of RAM will do nicely. We use a Pentium II 400MHz with 384MB and this system also seconds as a secondary NFS/SMB server (to Solaris clients and NT workstations) and Intranet (informational) server. Gotta love Linux baby!

-- Bryan "TheBS" Smith

Outlook, yes your heard that right.

[MrEfficient]

I don't expect to change your mind about outlook, but I think a few things need to be mentioned about security. I think the two main reasons people have problems with outlook is because they don't make use of the security settings and they don't keep on top of updates and patches. These are two things you have to keep on top of with any program, not just outlook. Remember the latest problem with FTP, even OpenBSD suffered from that.

There is a setting in outlook which tells it to use the "Internet Zone" security setting. This should be the default but I don't think it is. This is what I have my Outlook security set to. You also have to adjust the "Internet Zone" settings to not allow scripting of any kind. I suspect that if everyone had the correct security settings, the Melissa and ILoveYou viruses would never have caused any damage whatsoever. I'm not saying that outlook is perfect (Scripting in email is a dangerous thing and should be turned off by default) but I think it gets a bad rap because its from Microsoft. Remember, basic security principles must be followed no matter what program or OS you're using.

PS: One advantage of Outlook, is that it integrates fairly easily with PGP. Eudora also does this. One note about Pegasus, we have it at work and its the ugliest most user unfriendly email program I've ever used. And this is coming from a person whose first email program was Pegasus.

----------
AbiWord: The BEST opensource word processor