Sending confidential emails in Gmail

We are pretty used to sending encrypted emails in office or work environment with outlook or other mail clients and PKI and S/Mime certificates in place.

I was trying to explore how to make my email from Gmail more secure (of course can't ask for moon on a free service). Look what I found Gmail does offer confidential mode. Here are the settings.

First feature observed here is that you will not be able to forward, copy, print, or download such emails. 

You could send the mail without passcodes where another Gmail user can open it without passcodes but the ones on other services would be mailed a passcode to open the mail.

If you choose SMS passcode then you would get a screen to enter the recipient phone number on hitting send (would not work if your don't have the number this option will not work).

An option to set the expiry on mail (the mail auto deletes) is also present.

Although this feature looks more like a two factor authentication rather than encryption, something is better than nothing.

PS - Thanks Google for considering such a feature on personal email service.

Detect Phishing / Malware in an Email

There are countless mails for promotions or otherwise in your inbox, a lot of which have malicious intent. Some of them try to extract your personal information. Others might just carry a file that can infect your computer. Here are some tell tale signs to detect a spurious email.


This is a classic social engineering trick to make it seem like the mail is from a reliable source. In below figure it says it is from Reserve Bank of India. It also carries an attachment and has no subject.

This is the first sign as RBI does not send such emails. One should not open such emails and mark them as spam or delete them right away. 

Modern email services do filter many such mails automatically but some emails do pass the filter.

On opening the mail you can notice the email id as something completely unrelated to RBI, confirming that it is a potentially dangerous email.

You can see that there is an image file attached. This file should not be opened or downloaded. The file could be of any format (.zip, .doc etc.) This is a clear sign of a malware and opening it on your system might have severe effect. 

Small pieces of  code can be easily embedded in the file to install on your system and can vary from doing nothing to installing a keylogger or a virus.

 

On opening the header of the mail we can see complete details of the sender. This is called mail header showing complete details of the sender. 

It is easy to understand that a central government institute like RBI would not have an email id as shown in the image.

 

What to do if you see such a mail?

 

This part is simple. Just delete or mark the message as spam. If your email is handled by an IT team, notify them.

 

Detecting Emails such as the one discussed in this post is pretty straight forward. Sometimes even the email id also seems to be genuine. It can happen in case a mail server is hacked and is used to send spurious emails. It might also happen that you receive such emails from a person you know! This happens when their email account or the device where it's client is configured is compromised

 

Best policy for emails is to follow these simple steps:

1. Be very careful with emails from unknown senders.
2. Check the email header for clues.
3. Do not open the attachments in unsolicited mails before checking.
4. If you have a doubt that your friend's account is compromised, verify.
5. Delete or spam such mails.

Many of us are not aware about such threats and even aware people fall prey to them, so please be careful.