CODEWITHSUNDEEP
smime
aaronb
aaronb

Reputation: 2229

Secure messaging using Secure MIME is it reliable?

We have an automatic reporting and notification system written in .net that sends emails with plain text. We are having to encrypt the messages that we send our clients.

The possible implementation approaches we have:

It seems like S/Mime is a simpler solution, as we won't need to create the web application or secure it.

Our concern is our interoperability with our clients email clients and more importantly their email filtering software.

Has anyone had success or issues deploying a Secure MIME messaging solution?

Upvotes: 0

Views: 293

Answers (3)

Mr. Nun.
Mr. Nun.

Reputation: 850

SideNote: (you can edit this in an answer) Not all mobile clients support SMIME. sadly the native android mail client (on Nexus 4, Nexus 5 etc...) does not support S/MIME . also, I personally have issues with the samsung galaxy SMIME support. Best (external and paid for...) solution I have found so far for android is MySecuredMail.

Upvotes: 0

Development 4.0
Development 4.0

Reputation: 2753

Given the wealth of different clients people use these days for email, like BlackBerry, Iphone, Android, Samsung, Nokia, Thunderbird, Outlook (Express), Apple Mail, web mail etc, I would go for the web application over https. It does take an extra step of clicking the link, and logging in, but it could be used from a lot more devices without extra configuration steps.

Upvotes: 3

Remus Rusanu
Remus Rusanu

Reputation: 294387

How are you going to solve the problem of provisioning the destination certificates? If you send mail to 1000 users, you need to send it 1000 times, and each time use a different public key, the one for the current destination (so that only he/she can decrypt it and read it). Having each individual report final user create a key for himself and send you the associated public key so you can associate the report mail with it is problematic. Some PKI infrastructure products can help, but only inside a (tighly run) organization.

Securing only your web site seems easier to manage, since you'll have all the ends under your control. You still have to handle authentication, but that can be handled at the HTTP level (eg. Digest, or even Basic over HTTPS).

Upvotes: 0

Related Questions