We have a question among some of our users about whether putting e-mail addresses in the BCC box provides pretty good or complete security for sensitive information. Specifically, there is some belief that knowledgeable people could hack the e-mail and find out who else the message was BCC’ed to, which could present a problem for some of our clients. I can’t find anything about this out there regarding this being truthful (and if so, how easy or unlikely is it) or being a “legend”. Can anyone comment on this possibility (without giving details for how it may be done if it can be)?
This is with internet messaging, and some use digital signatures, but this isn’t enforced or consistent. Assuming the message is not encrypted (text-based), I guess part of the question boils down to this. Does the e-mail program (Exchange/Outlook 97/2000 in this case) send separate messages to the BCC recipients without any text or other clues about other BCCs, or is this handled on the recipient’s end (hence the text includes some code or other form of the other BCC recipients)?