Slashdot Mirror
Ask Slashdot: Secure, Yet Accessible E-mail Archive Storage?
New submitter mlts writes: As of now, I just leave E-mail in a 'received-2015' subfolder on my provider's server, adding a new folder yearly. With the rise of E-mail account intrusions (where even though I'm likely not a primary target, but it is a concern), what is a secure, but yet accessible way to archive E-mail? I'm far less worried about the FBI/NSA/Illuminati, as I am about having stuff divulged to all and sundry if a mass breach happens. A few alternative I've considered: 1) Running my own physical IMAP server. The server would run on a hypervisor (likely ESXi), have Dovecot limited to the VPN I use, and use other sane techniques to limit access. 2) Archive the E-mail files through a cloud provider, with a client encryption utility (EncFS, BoxCryptor, etc.) In this case, E-mail would be stored in a different file a week. 3) Move it to local storage on a virtual machine, and if access is needed, use LogMeIn or another remote access item to fire up Thunderbird to access it. What would be a recommended way to secure E-mail that sits around, for the long haul, but still have it accessible? Even if you're not specifically worried about it, keeping older email around on a provider's server opens you up to warrantless access by U.S. law enforcement officials.
Pull it down to your local machine either via pop3 or just moving messages from your imap inbox to a local folder.
Then whenever you like, archive that off somewhere. You could even convert maildir format to mbox and then run something like mhonarc on it to make web pages of 'em all wtih indexes and such, and just archive off the HTML onto a CD/DVD/whatever.
All that said, why are you keeping it all? I've kept all of my work related email for 18 years now (same employer) on my local machine. I've gone thru a few things more than a year old just for giggles, and one time I needed a license number that was locked up in a filing cabinet but didn't have my keys that day... But mostly an email that is 2 months old or older just isn't needed (by me, for my work, your needs probably vary).
Don't blame me, I voted for Kodos
On paper
Back it up locally and encrypt the backup on an external drive.
then, either lock that in a safe-deposit box, have a friend hold it, or hide it in some random but physically secure location. A fire-proof safe in your basement would work.
It is the only way, if any still exists at all
And yes, I like to have access to 1990's emails sometimes. Or need to. The world does not need to see them. BTW, law enforcement, under USA PATRIOT or CISA or some court ruling, do not need a warrant to read any email older than one year.
... is just INCREASING your attack surface, not reducing it! I'd go with the local backup if I were you.
Which has more power: the hammer, or the anvil?
Get an email account with any domain provider, and set it up to forward to your private server. Read mail by connecting to an account on the private IMAP server. No need to run your own SMTP server; outgoing mail can be handled by your domain provider.
Problem solved.
"I'd just use Outlook for the mail client."
One feature of M$ Lookout is it's built in VTP (virus transport protocol). And it is very effective, from what i've been told.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Or your new IT guy?
My ISP (Comcast) won't allow me to run a fully functional mail server due to so many ports being blocked so I host my domain/mx record at Google for your Domain (got a free account way back when). I then have Thunderbird running 24/7 alongside my home mail server, automatically sucking down new mail from my gmail account and putting them in the inbox of my own server. I still have to periodically go and delete all mail on gmail because I've not figured out how to automatically & permanently delete them (or sent mail) from an IMAP client. I also use Google's servers as a smart host for outbound mail, so when an email client it setup to send/receive mail to my server, it all works, just on alternate ports. TLS all around.
So.... there's a limited amount of my email sitting in gmail trash at any given moment, while I have access to all of my email on my own server via imap on all of my devices.
It was the best I could come up with on my very low budget. I do it less from a fear of google/government snooping (though that bothers me) than from a fear of hackers getting into my gmail account. My own server is a much smaller and more obscure target...
you could set up journaling locally. decent solutions exist to dedupe compress and encrypt.
Is locked away in your home or in a secure place at your place of work. Everyone so far is telling you the obvious, nothing is safe or secure in the cloud.
There's a software solution for this. The most secure way is on your own computer. Using IMAP to download those directly from your provider so you can then delete them. Webmail Archive Manager does just this. Downloads all emails in any folder(s) that you select. It has the entire email (text, rendered/code html, attachments, all the recipients, all the CCd and the full header for forensics). You can search, reorganize, whatever you like. I'm not sure what the policy is on links but it's here: http://maxedge.com/ If that link doesn't show up, just google Webmail Archive Manager....it's by MaxEdge. Oh...it's cheap too. -MichaelMac
Monica's ex-boyfriend's wife can tell you how to do this.....
Im sure ill get downvoted for offering a non-solution but, bear with me...I think you need to take a more practical and meaningful approach to email in general...
speaking as an email administrator, Yearly archives of email are the virtual equivalent of an elderly hoarder with shoeboxes full of random correspondence. Once something is deleted, consider deleting it for good. Create a policy that, after 1 year or 30 days or $n amount of time, mail is automatically deleted regardless of whether its been read. if youve been mailed something for your personal record and its not in PDF format, click print-to-pdf, store it in an encrypted drive, and delete that message immediately. If you need information from the email for later use beyond the period of deletion then theres most surely a date youll have to act upon it. store it as a reminder in a calendar, and delete the email. the less email you have, the safer you are because youre being accountable for the data and information you're entrusted with by your peers...not just shoeboxing it.
Good people go to bed earlier.
As some others recommended, I use my own IMAP server – both for holding my complete mail archive (I once used the aid4mail tool to transfer my mail client based archive from Thunderbird to the IMAP server) and for continuously receiving (fetching) current e-mail from every active mail account I have. It is the one point of access for my email, whether I'm at home or on the road, from whatever device, and I have access to every single mail I have ever received or written (and not discarded...) from wherever I might be. Personally, I haven't implemented strong safety measures yet, actually I'm running hmailserver on a Windows machine which isn't really what I would call a wise solution, but so far it works perfectly well, as long as the server's internet connection is alive...
I personally store archives emails in a local folder in Thunderbird on my primary workstation.
I then have it backup regularly to a secondary ("backup") drive installed in the system.
From there I have the backup drive encrypt and sync to a backup server (in a vm on a dedicated box) I have in a datacenter for disaster recovery.
Thunderbird automatically creates an Archives folder, with sub-folders of each year, when you use the "Archive" button.
Works for me. YMMV.
I have my own domain which I host at zoho.com for free since I only need one account. I only use that for incoming mail and spam filtering. Anything I want to keep I transfer over to the IMAP server that's running on my Synology NAS.
Just keep standard UNIX mail spool files locally, if you're worried about it.
Also, a mail server is not physical if it runs under a hypervisor, unless you physically have the box that runs both in your possession. You'll all see - hypervisors will be shown to be manipulated by cloud providers and/or TLA agencies to extract data from virtual machines without the virtual machines' admins knowing anything about it.
I should have been a tad clearer in my post. The machine would physically sit at a location I (hopefully) control, so it would be in my physical possession. The reason for a hypervisor is so that the VM used for stashing archived mail would be able to be passed from bare metal to bare metal install as time goes on, without need to rebuild the system. It makes backups easy as well, where I just power the VM off, plug a USB drive into the host, mount a VeraCrypt volume, export the VM as a .OVA file, dismount the .hc file and drive, call it done. This isn't fancy, but snapshots taken often combined with monthly/quarterly exports to offsite media should cover things fairly reliably. If the data is vital, I toss it into one IMAP folder, encrypt that folder via PGP, GPG, VeraCrypt or some other brute-force resistant method, then toss it onto Amazon Glacier to rot as the backup of last resort.
TLAs are really not on my threat model, so I treat hypervisors the same as operating systems. However, I do like keeping communications with clients around for a period of time before dumping it, as a best practice, so I'm mainly concerned with an E-mail provider getting breached and wide swaths of users having their stuff made into torrents.
So let's be reasonable. Encrypt when needed, and take reasonable precautions, but don't make yourself a target.
If you only encrypt** that which needs special precautions, then you're making it EXTREMELY easy to target the messages that are important.
If you're going to encrypt, encrypt everything. This advice is also good for things like vpn use, proxy use, tor use, etc.
** ... or do anything out of the ordinary, like deleting it, or moving it to a different folder, or only downloading those messages, etc.
None of your bullet points are a negative to S/MIME use. The only edge case one is that the NSA may hold all your email because it is encrypted, but:
1. Who cares? I mean, I do from an overall rights issue, and I think it's wrong, but they're not going to leak stuff to my employer or any other trivial things.
2. The more we make them store (ie. if everyone encrypts everything), the less useful and feasible their selective storage becomes.
3. If you're actually worried about that, then your advice to selectively encrypt only when needed is debunked even further.
Acting out of the ordinary can draw attention, as you noted. The answer is to make encryption on many levels the norm for all trivial stuff, from slashdot to txt's to calls to ordering pizza etc. Then, when you do need it for something, it'll look absolutely normal.
modern filesystems have no 255 char limit.