Slashdot Mirror
Ask Slashdot: Secure, Yet Accessible E-mail Archive Storage?
New submitter mlts writes: As of now, I just leave E-mail in a 'received-2015' subfolder on my provider's server, adding a new folder yearly. With the rise of E-mail account intrusions (where even though I'm likely not a primary target, but it is a concern), what is a secure, but yet accessible way to archive E-mail? I'm far less worried about the FBI/NSA/Illuminati, as I am about having stuff divulged to all and sundry if a mass breach happens. A few alternative I've considered: 1) Running my own physical IMAP server. The server would run on a hypervisor (likely ESXi), have Dovecot limited to the VPN I use, and use other sane techniques to limit access. 2) Archive the E-mail files through a cloud provider, with a client encryption utility (EncFS, BoxCryptor, etc.) In this case, E-mail would be stored in a different file a week. 3) Move it to local storage on a virtual machine, and if access is needed, use LogMeIn or another remote access item to fire up Thunderbird to access it. What would be a recommended way to secure E-mail that sits around, for the long haul, but still have it accessible? Even if you're not specifically worried about it, keeping older email around on a provider's server opens you up to warrantless access by U.S. law enforcement officials.
Pull it down to your local machine either via pop3 or just moving messages from your imap inbox to a local folder.
Then whenever you like, archive that off somewhere. You could even convert maildir format to mbox and then run something like mhonarc on it to make web pages of 'em all wtih indexes and such, and just archive off the HTML onto a CD/DVD/whatever.
All that said, why are you keeping it all? I've kept all of my work related email for 18 years now (same employer) on my local machine. I've gone thru a few things more than a year old just for giggles, and one time I needed a license number that was locked up in a filing cabinet but didn't have my keys that day... But mostly an email that is 2 months old or older just isn't needed (by me, for my work, your needs probably vary).
Don't blame me, I voted for Kodos
On paper
Back it up locally and encrypt the backup on an external drive.
then, either lock that in a safe-deposit box, have a friend hold it, or hide it in some random but physically secure location. A fire-proof safe in your basement would work.
It is the only way, if any still exists at all
And yes, I like to have access to 1990's emails sometimes. Or need to. The world does not need to see them. BTW, law enforcement, under USA PATRIOT or CISA or some court ruling, do not need a warrant to read any email older than one year.
... is just INCREASING your attack surface, not reducing it! I'd go with the local backup if I were you.
Which has more power: the hammer, or the anvil?
Expect it to be indexed and viewable at will by the United States or just about any other modern Western government. It doesn't matter if it's "archived" there or not, it's archived there. Once it hits a server and gets replicated for backups and redundancy, it exists forever. Deletion does nothing. A log is kept (even if it's just in the backups) of every email, chat, IM, SMS, etc. you've ever sent or received. You can bet on it.
Get an email account with any domain provider, and set it up to forward to your private server. Read mail by connecting to an account on the private IMAP server. No need to run your own SMTP server; outgoing mail can be handled by your domain provider.
Problem solved.
"I'd just use Outlook for the mail client."
One feature of M$ Lookout is it's built in VTP (virus transport protocol). And it is very effective, from what i've been told.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Or your new IT guy?
Important part of the wintel upgrade cycle.
Looks like we have some Microsoft fan boi moderators. It's sad that this used to be a tech site.
Becuase EncFS encodes certain extra metadata in the filename, the maximum filename limit for EncFS mounts is significantly shorter than the usual 255 character limit (just wanted to throw that out there for you).
My ISP (Comcast) won't allow me to run a fully functional mail server due to so many ports being blocked so I host my domain/mx record at Google for your Domain (got a free account way back when). I then have Thunderbird running 24/7 alongside my home mail server, automatically sucking down new mail from my gmail account and putting them in the inbox of my own server. I still have to periodically go and delete all mail on gmail because I've not figured out how to automatically & permanently delete them (or sent mail) from an IMAP client. I also use Google's servers as a smart host for outbound mail, so when an email client it setup to send/receive mail to my server, it all works, just on alternate ports. TLS all around.
So.... there's a limited amount of my email sitting in gmail trash at any given moment, while I have access to all of my email on my own server via imap on all of my devices.
It was the best I could come up with on my very low budget. I do it less from a fear of google/government snooping (though that bothers me) than from a fear of hackers getting into my gmail account. My own server is a much smaller and more obscure target...
I have used Outlook for long term archives. Even when I check the archive with scanpst.exe, I have had some larger archives get horrifically corrupted.
Ixnay on that. Thunderbird's mbox format may be archaic, but even corrupted, you are still able to get your E-mails out of it with basic UNIX text utilities. Back when Mozilla was an all in one utility (the ancestor of SeaMonkey), it was a lot better for archiving just because corruption wasn't as big an issue as it is with .PST files. A corrupt PST file can mean no way of recovering.
There is just no reason to store email.
If the concern for security is embarrassment or liability, quit being an embarrassment or liability and quit documenting how long you have been such.
If you need to store correspondence for a compelling reason, then by all means set up a filing system and use it.
you could set up journaling locally. decent solutions exist to dedupe compress and encrypt.
Is locked away in your home or in a secure place at your place of work. Everyone so far is telling you the obvious, nothing is safe or secure in the cloud.
piler on a dedicated server.
There's a software solution for this. The most secure way is on your own computer. Using IMAP to download those directly from your provider so you can then delete them. Webmail Archive Manager does just this. Downloads all emails in any folder(s) that you select. It has the entire email (text, rendered/code html, attachments, all the recipients, all the CCd and the full header for forensics). You can search, reorganize, whatever you like. I'm not sure what the policy is on links but it's here: http://maxedge.com/ If that link doesn't show up, just google Webmail Archive Manager....it's by MaxEdge. Oh...it's cheap too. -MichaelMac
I run fetchmail, dovecot IMAP, and a local sendmail on my Ubuntu Linux server, which is an always-on, low-power, fanless server located in my home. I can continue to use my ISP provided email account and their SMTP (outgoing) server with this configuration, but any incoming mail is taken off their server (POP3) within minutes of its arrival and delivered locally.
Monica's ex-boyfriend's wife can tell you how to do this.....
Im sure ill get downvoted for offering a non-solution but, bear with me...I think you need to take a more practical and meaningful approach to email in general...
speaking as an email administrator, Yearly archives of email are the virtual equivalent of an elderly hoarder with shoeboxes full of random correspondence. Once something is deleted, consider deleting it for good. Create a policy that, after 1 year or 30 days or $n amount of time, mail is automatically deleted regardless of whether its been read. if youve been mailed something for your personal record and its not in PDF format, click print-to-pdf, store it in an encrypted drive, and delete that message immediately. If you need information from the email for later use beyond the period of deletion then theres most surely a date youll have to act upon it. store it as a reminder in a calendar, and delete the email. the less email you have, the safer you are because youre being accountable for the data and information you're entrusted with by your peers...not just shoeboxing it.
Good people go to bed earlier.
I can't find the info on it from the EFF, but after near 30 years we finally won the war over that. They can't search emails without a warrant that are held after a certain period of time. I was very (happily) surprised when I read about this victory because my company is working on a product to enable users to easily self-host there email to stop the government from having warrantless access to old email via a technical means.
That said I don't think we're going to not release a product. We need better tools to protect our privacy and security and we shouldn't let our defences down just because it is now illegal for the government to do so. We already know they generally interpret there way around laws and rulings. And get away with it. They'll likely find some other loophole or make some other interpretation of the ruling.
As some others recommended, I use my own IMAP server – both for holding my complete mail archive (I once used the aid4mail tool to transfer my mail client based archive from Thunderbird to the IMAP server) and for continuously receiving (fetching) current e-mail from every active mail account I have. It is the one point of access for my email, whether I'm at home or on the road, from whatever device, and I have access to every single mail I have ever received or written (and not discarded...) from wherever I might be. Personally, I haven't implemented strong safety measures yet, actually I'm running hmailserver on a Windows machine which isn't really what I would call a wise solution, but so far it works perfectly well, as long as the server's internet connection is alive...
First, be aware of the rules and practices around your email. I work in an industry where litigation may occur several years after the fact, so missing email can be very costly for me. I annually backup my closed projects to a PGP encrypted file, and upload that to a managed server.
This isn't "NSA" secure but it is "Anonymous secure"
The solutions so far address just archiving it. I want much the same as the author; just keep the past few months on my provider's server, but have a locally indexed archive that I can search and retrieve on. Short of setting up a local email server and importing all the content from the archives, is there a database system or such that can take a folder full of emails and index it?
I personally store archives emails in a local folder in Thunderbird on my primary workstation.
I then have it backup regularly to a secondary ("backup") drive installed in the system.
From there I have the backup drive encrypt and sync to a backup server (in a vm on a dedicated box) I have in a datacenter for disaster recovery.
Thunderbird automatically creates an Archives folder, with sub-folders of each year, when you use the "Archive" button.
Works for me. YMMV.
I have my own domain which I host at zoho.com for free since I only need one account. I only use that for incoming mail and spam filtering. Anything I want to keep I transfer over to the IMAP server that's running on my Synology NAS.
Just keep standard UNIX mail spool files locally, if you're worried about it.
Also, a mail server is not physical if it runs under a hypervisor, unless you physically have the box that runs both in your possession. You'll all see - hypervisors will be shown to be manipulated by cloud providers and/or TLA agencies to extract data from virtual machines without the virtual machines' admins knowing anything about it.
That's obvious. Hillary knows it all. ROFLMA.
I normally use Thunderbird, using TLS transport and set to delete after download. But I don't panic over S/MIME (though I use it for some messages) because ...
* While sitting at $BIGSERVICE it's not encrypted, even if it is while in transit. S/MIME can help here.
* As another mentioned, if it ever visits a big service, it's available to $GOVT.
* Even after deletion, messages sit in the Trash until you log on and delete them. Backed up by then?
* It might be illegal to delete email, and anyway if you delete it quickly you become a suspect - something to hide?
* If you encrypt your email, NSA keeps it forever. Is your S/MIME good enough to resist attack forever? Do you need it to be that good? For everything?
* Even if you store it locally, the physical machines and copies can be removed with (sometimes without) a warrant and kept forever.
So let's be reasonable. Encrypt when needed, and take reasonable precautions, but don't make yourself a target.
* Don't be conspicuous. In wartime it draws fire. In peacetime it draws sergeants. *
I should have been a tad clearer in my post. The machine would physically sit at a location I (hopefully) control, so it would be in my physical possession. The reason for a hypervisor is so that the VM used for stashing archived mail would be able to be passed from bare metal to bare metal install as time goes on, without need to rebuild the system. It makes backups easy as well, where I just power the VM off, plug a USB drive into the host, mount a VeraCrypt volume, export the VM as a .OVA file, dismount the .hc file and drive, call it done. This isn't fancy, but snapshots taken often combined with monthly/quarterly exports to offsite media should cover things fairly reliably. If the data is vital, I toss it into one IMAP folder, encrypt that folder via PGP, GPG, VeraCrypt or some other brute-force resistant method, then toss it onto Amazon Glacier to rot as the backup of last resort.
TLAs are really not on my threat model, so I treat hypervisors the same as operating systems. However, I do like keeping communications with clients around for a period of time before dumping it, as a best practice, so I'm mainly concerned with an E-mail provider getting breached and wide swaths of users having their stuff made into torrents.
I use both IMAP and POP3 email accounts, but every email that I save locally is automatically encrypted and every email that I sent is saved (encrypted) in a local Outbox folder, not in the "cloud".
I input a password when I start the email program (Bersoft Private Mail) and keep a backup simply by copying the program folder, that stores the message's folder (like Thunderbird portable), because the software is portable.
> So let's be reasonable. Encrypt when needed, and take reasonable precautions,
> but don't make yourself a target.
Quite frankly...FUCK THAT!
How about those assholes doing the spying 'be reasonable'?!
Not to mention, that the 'need' for encryption, per default, has to be just about everything, since not YOU but THEM are making the decision, whether something is 'of interest' or not. So much for 'don't make yourself a target'...nice post from under the rock, dude!
So let's be reasonable. Encrypt when needed, and take reasonable precautions, but don't make yourself a target.
If you only encrypt** that which needs special precautions, then you're making it EXTREMELY easy to target the messages that are important.
If you're going to encrypt, encrypt everything. This advice is also good for things like vpn use, proxy use, tor use, etc.
** ... or do anything out of the ordinary, like deleting it, or moving it to a different folder, or only downloading those messages, etc.
None of your bullet points are a negative to S/MIME use. The only edge case one is that the NSA may hold all your email because it is encrypted, but:
1. Who cares? I mean, I do from an overall rights issue, and I think it's wrong, but they're not going to leak stuff to my employer or any other trivial things.
2. The more we make them store (ie. if everyone encrypts everything), the less useful and feasible their selective storage becomes.
3. If you're actually worried about that, then your advice to selectively encrypt only when needed is debunked even further.
Acting out of the ordinary can draw attention, as you noted. The answer is to make encryption on many levels the norm for all trivial stuff, from slashdot to txt's to calls to ordering pizza etc. Then, when you do need it for something, it'll look absolutely normal.