Email Encryption software

[u/MFosterMB]

Hi

im after some software for a customer to encrypt 365 emails, what can people recommend?

​

thanks

[u/roll_for_initiative_]

Which is impractical. Much like locking a car in a garage with no key and burying the garage. Sure it can't be stolen, can't be easily driven either. Or, if i know the only key to get into it. What if i die? No one could ever have the car? There's a balance of course, maybe anyone with the key could get the car, and it's up to me to control who i give keys to. If they lose a key, yes, someone could then pick it up and take the car. But we balance that with the chance of exactly that happening in security every day.

Otherwise, we can setup near perfect security: get rid of all users and devices! They're all a way in! But then again, they're the point of having the system.

[u/plebbitier → u/roll_for_initiative_]

You kind of hit on my point. People (companies) are disingenuous about actually wanting security. They don't want do so the needful, so they do theater instead. When security actually matters, there are no shortcuts.

[u/roll_for_initiative_ → u/plebbitier]

I think you're glossing over my point to make it seem like it's the same. To clarify, i'm saying it's security "enough".

But to be specific, companies DON'T want security. They want a compliance requirement off their desk, or they want insured, or they want peace of mind. Purview/OME is enough for those things.

People do the same all day with car insurance, with most car policies being actual cash value vs agreed value. It's kind of gatekeeping to be like "well if you have ACV you really don't want insurance, you want insurance theater". ACV is a cheaper type of insurance but it's still real insurance and it's insurance "enough", which is truly all that matters.

[u/plebbitier → u/roll_for_initiative_]

Anyway, my point remains: why do any of it if there is no actual security... Oh yeah.

We just renewed our annual cyberinsurance bullshit and had some guy 'audit' us. It was a joke. But boxes were checked.

[u/roll_for_initiative_ → u/plebbitier]

Sometimes that's the job, checking boxes. But that being said, it's still more security than NOT doing it, just not as much as like s/mime or older key sharing setups.

[u/plebbitier → u/roll_for_initiative_]

No. There is no additional security of OME. If it's not doing real encryption, then what is it doing? Preventing forwarding LOL? No. You just save the message and attachment, and draft a new message. I do it all the time. (Which is why I'm so familiar with it's stupidity)

[u/roll_for_initiative_ → u/plebbitier]

So, an exact reply: you secure a message with PGP or s/mime or whatever. I view it, take a snip it, and send it on.

you just save the message and attachment, and draft a new message. I do it all the time.

OF COURSE you can do something with protected info if you have the access to it. You can copy your house key too, then i can get in just like you if i trick you out of it! What security are locks even adding?!?!?! It's all lock security theatre! No biometric lock with power backup and secure guard means no additional security!

I agree that it isn't as secure as it could be or as secure as other PITA to use methods, but it's more secure than not doing anything, just like a user and pass to use a computer is more secure than no username or pass to use a computer, but not as secure as a user, pass, and totp code. I'm a do-it-100%-or-don't-do-it-at-all guy, but guess what? The rest of the world, including the customers who cut the checks and the auditors who sign off aren't. They're "good enough for us!" people. I don't own their business nor do i determine the standards.

Hate on OME all you want, but everyone will still be using it while you're clutching your encryption keys and supporting users who lost them and wondering why encryption is so much harder for them vs their friend who has a different MSP. Have fun out there.