Software

Ask something
Discussion Locked

security and BCC

0 helpful
4 replies

by juiceplus

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a question among some of our users about whether putting e-mail addresses in the BCC box provides pretty good or complete security for sensitive information. Specifically, there is some belief that knowledgeable people could hack the e-mailand find out who else the message was BCC'ed to, which could present a problem for some of our clients. I can't find anything about this out there regarding this being truthful (and if so, how easy or unlikely is it) or being a "legend". Can anyone comment on this possibility (without giving details for how it may be done if it can be)?
Thanks.

4 replies

by [_rick_>

Didn't mention Internet messaging, but my answer is assuming Internet message flow.

Review the following Request For Comments for detailed Header and SMTP functionality - very technical in nature.

RFC821
RFC822

If you are concerned about message security than I woudl recommend using a encryption / digital signature - either PGP or SSL - to safe gaurd the message as it travels the Internet.

There are numerous products available, some that keep the message on a dedicate server requiring the end user to visit the server to read the message. Others that encrypt using a shared key, and others that use PKI. Encrypting is the only way to 'protect' the data. remember all messages traveling the Internet are text based.

by juiceplus

How do I find the RFC items mentioned? I assume these are on the TechRepublic Q&A, but a search did not reveal these items.

by juiceplus

This is with internet messaging, and some use digital signatures, but this isn't enforced or consistent. Assuming the message is not encrypted (text-based), I guess part of the question boils down to this. Does the e-mail program (Exchange/Outlook97/2000 in this case) send separate messages to the BCC recipients without any text or other clues about other BCCs, or is this handled on the recipient's end (hence the text includes some code or other form of the other BCC recipients)?

This discussion is closed to new replies.