Hushmail
Encyclopedia
Hushmail is a web-based email
service offering PGP
-encrypted e-mail
, file storage, vanity domain
service, and instant messaging
(Hush Messenger). Hushmail uses OpenPGP standards and the source is available for download. Additional security features include hidden IP address
es in e-mail headers. The free e-mail account has a limit of 25MB, and no IMAP
or POP3
.
If a free account is not logged into for three weeks it is deactivated and the only option given to reactivate it is to upgrade to a paid account. Paid accounts range from 1GB to 10GB of storage as well as IMAP and POP3 access.
If public encryption keys are available to both recipient and sender (either both are Hushmail users or have uploaded PGP keys to the Hush keyserver), Hushmail can convey authenticated, encrypted messages in both directions. For recipients for whom no public key is available, Hushmail will allow a message to be encrypted by a password (with a password hint) and stored for pickup by the recipient, or the message can be sent in cleartext.
Hushmail was founded by Cliff Baltzley in 1999 after leaving Ultimate Privacy, and is based in Vancouver
. The servers are in Vancouver, and there are also offices in Dublin, Ireland
; Delaware
, United States
; and Anguilla
.
as they are in the United States and if data were to be handed over encrypted messages would be available only in encrypted form.
However, recent developments have led to doubts among security-conscious users about Hushmail's security and concern over a backdoor in an OpenPGP service. Hushmail has turned over cleartext copies of private e-mail messages associated with several addresses at the request of law enforcement agencies under a Mutual Legal Assistance Treaty
with the United States.
An example of this behavior is in the case of U.S. v. Tyler Stumbo. In addition, the contents of emails between Hushmail addresses were analyzed, and a total of 12 CDs were turned over to US authorities. Another example of this is the case of Thomas Andrews Drake
, a former NSA employee, who allegedly used a Hushmail account to transfer NSA confidential documents to a reporter. Hushmail also now states that it also logs IP addresses in order "to analyze market trends, gather broad demographic information, and prevent abuse of our services."
Hush Communications, the company that provides Hushmail, states that it will not release any user data without a court order from the Supreme Court of British Columbia
, Canada, and that other countries seeking access to user data must apply to the government of Canada via an applicable Mutual Legal Assistance Treaty.
Hushmail states that "...That means that there is no guarantee that we will not be compelled, under a court order issued by the Supreme Court of British Columbia, Canada, to treat a user named in a court order differently, and compromise that user's privacy." and additionally "...If a court order has been issued by the Supreme Court of British Columbia compelling us to reveal the content of your encrypted email, the "attacker" could be Hush Communications, the actual service provider."
The issue originally revolved around the use of the non-java version of the Hush system. It performed the encrypt and decrypt steps on Hush's servers and then used SSL to transmit the data to the user. The data is available as cleartext during this small window; additionally the passphrase can be captured at this point. This facilitates the decryption of all stored messages and future messages using this passphrase.
Hushmail has stated that the java version is also vulnerable in that they may be compelled to deliver a compromised java applet to a user. Hushmail recommends using non web-based services such as GnuPG and PGP Desktop
for those who need stronger security.
The privacy policy of Hushmail has been defended by privacy advocate and PGP creator Phil Zimmermann
, who sits on the advisory board of Hush Communications. Zimmermann has stated, "Their hearts are in the right place but there are certain kinds of attacks that are beyond the scope of their abilities to thwart. They are not a sovereign state." Zimmermann suggests that "online encrypted email storage" cannot be expected to provide a defense against a legal process, because government can "compel a service provider to cooperate". This is in contrast to "using encryption software on one's own computer", which is presumably a reference to his original PGP program and equivalent software.
Web-based email
The term Webmail is used to describe two things. One use of the word is to describe a Webmail client: an email client implemented as a web application accessed via a web browser. This article focuses in this use of the term...
service offering PGP
Pretty Good Privacy
Pretty Good Privacy is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security...
-encrypted e-mail
E-mail
Electronic mail, commonly known as email or e-mail, is a method of exchanging digital messages from an author to one or more recipients. Modern email operates across the Internet or other computer networks. Some early email systems required that the author and the recipient both be online at the...
, file storage, vanity domain
Vanity domain
In the Domain Name System , a vanity domain is a domain name whose purpose is to express the individuality of the person on whose behalf it is registered. This contrasts with domain names which resolve to an organisation or a service that organisation offers...
service, and instant messaging
Instant messaging
Instant Messaging is a form of real-time direct text-based chatting communication in push mode between two or more people using personal computers or other devices, along with shared clients. The user's text is conveyed over a network, such as the Internet...
(Hush Messenger). Hushmail uses OpenPGP standards and the source is available for download. Additional security features include hidden IP address
IP address
An Internet Protocol address is a numerical label assigned to each device participating in a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing...
es in e-mail headers. The free e-mail account has a limit of 25MB, and no IMAP
Internet Message Access Protocol
Internet message access protocol is one of the two most prevalent Internet standard protocols for e-mail retrieval, the other being the Post Office Protocol...
or POP3
Post Office Protocol
In computing, the Post Office Protocol is an application-layer Internet standard protocol used by local e-mail clients to retrieve e-mail from a remote server over a TCP/IP connection. POP and IMAP are the two most prevalent Internet standard protocols for e-mail retrieval. Virtually all modern...
.
If a free account is not logged into for three weeks it is deactivated and the only option given to reactivate it is to upgrade to a paid account. Paid accounts range from 1GB to 10GB of storage as well as IMAP and POP3 access.
If public encryption keys are available to both recipient and sender (either both are Hushmail users or have uploaded PGP keys to the Hush keyserver), Hushmail can convey authenticated, encrypted messages in both directions. For recipients for whom no public key is available, Hushmail will allow a message to be encrypted by a password (with a password hint) and stored for pickup by the recipient, or the message can be sent in cleartext.
Hushmail was founded by Cliff Baltzley in 1999 after leaving Ultimate Privacy, and is based in Vancouver
Vancouver
Vancouver is a coastal seaport city on the mainland of British Columbia, Canada. It is the hub of Greater Vancouver, which, with over 2.3 million residents, is the third most populous metropolitan area in the country,...
. The servers are in Vancouver, and there are also offices in Dublin, Ireland
Ireland
Ireland is an island to the northwest of continental Europe. It is the third-largest island in Europe and the twentieth-largest island on Earth...
; Delaware
Delaware
Delaware is a U.S. state located on the Atlantic Coast in the Mid-Atlantic region of the United States. It is bordered to the south and west by Maryland, and to the north by Pennsylvania...
, United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
; and Anguilla
Anguilla
Anguilla is a British overseas territory and overseas territory of the European Union in the Caribbean. It is one of the most northerly of the Leeward Islands in the Lesser Antilles, lying east of Puerto Rico and the Virgin Islands and directly north of Saint Martin...
.
Controversy
Until September 2007, Hushmail received generally favorable reviews in the press. It was believed that possible threats, such as demands from the legal system to reveal the content of traffic through the system, were not as imminent in CanadaCanada
Canada is a North American country consisting of ten provinces and three territories. Located in the northern part of the continent, it extends from the Atlantic Ocean in the east to the Pacific Ocean in the west, and northward into the Arctic Ocean...
as they are in the United States and if data were to be handed over encrypted messages would be available only in encrypted form.
However, recent developments have led to doubts among security-conscious users about Hushmail's security and concern over a backdoor in an OpenPGP service. Hushmail has turned over cleartext copies of private e-mail messages associated with several addresses at the request of law enforcement agencies under a Mutual Legal Assistance Treaty
Mutual Legal Assistance Treaty
A mutual legal assistance treaty is an agreement between two countries for the purpose of gathering and exchanging information in an effort to enforce public laws or criminal laws...
with the United States.
An example of this behavior is in the case of U.S. v. Tyler Stumbo. In addition, the contents of emails between Hushmail addresses were analyzed, and a total of 12 CDs were turned over to US authorities. Another example of this is the case of Thomas Andrews Drake
Thomas Andrews Drake
Thomas Andrews Drake is a former senior official of the U.S. National Security Agency , decorated United States Air Force and United States Navy veteran, computer software expert, linguist, management and leadership specialist, and whistleblower. In 2010 the government alleged that he 'mishandled'...
, a former NSA employee, who allegedly used a Hushmail account to transfer NSA confidential documents to a reporter. Hushmail also now states that it also logs IP addresses in order "to analyze market trends, gather broad demographic information, and prevent abuse of our services."
Hush Communications, the company that provides Hushmail, states that it will not release any user data without a court order from the Supreme Court of British Columbia
Supreme Court of British Columbia
The Supreme Court of British Columbia is the superior trial court for the province of British Columbia. The BCSC hears civil and criminal law cases as well as appeals from the Provincial Court of British Columbia. Including supernumerary judges, there are presently 108 judges...
, Canada, and that other countries seeking access to user data must apply to the government of Canada via an applicable Mutual Legal Assistance Treaty.
Hushmail states that "...That means that there is no guarantee that we will not be compelled, under a court order issued by the Supreme Court of British Columbia, Canada, to treat a user named in a court order differently, and compromise that user's privacy." and additionally "...If a court order has been issued by the Supreme Court of British Columbia compelling us to reveal the content of your encrypted email, the "attacker" could be Hush Communications, the actual service provider."
The issue originally revolved around the use of the non-java version of the Hush system. It performed the encrypt and decrypt steps on Hush's servers and then used SSL to transmit the data to the user. The data is available as cleartext during this small window; additionally the passphrase can be captured at this point. This facilitates the decryption of all stored messages and future messages using this passphrase.
Hushmail has stated that the java version is also vulnerable in that they may be compelled to deliver a compromised java applet to a user. Hushmail recommends using non web-based services such as GnuPG and PGP Desktop
Pretty Good Privacy
Pretty Good Privacy is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security...
for those who need stronger security.
The privacy policy of Hushmail has been defended by privacy advocate and PGP creator Phil Zimmermann
Phil Zimmermann
Philip R. "Phil" Zimmermann Jr. is the creator of Pretty Good Privacy , the most widely used email encryption software in the world. He is also known for his work in VoIP encryption protocols, notably ZRTP and Zfone....
, who sits on the advisory board of Hush Communications. Zimmermann has stated, "Their hearts are in the right place but there are certain kinds of attacks that are beyond the scope of their abilities to thwart. They are not a sovereign state." Zimmermann suggests that "online encrypted email storage" cannot be expected to provide a defense against a legal process, because government can "compel a service provider to cooperate". This is in contrast to "using encryption software on one's own computer", which is presumably a reference to his original PGP program and equivalent software.
See also
- Anonymous remailerAnonymous remailerAn anonymous remailer is a server computer which receives messages with embedded instructions on where to send them next, and which forwards them without revealing where they originally came from...
- CryptographyCryptographyCryptography is the practice and study of techniques for secure communication in the presence of third parties...
- Thomas Andrews DrakeThomas Andrews DrakeThomas Andrews Drake is a former senior official of the U.S. National Security Agency , decorated United States Air Force and United States Navy veteran, computer software expert, linguist, management and leadership specialist, and whistleblower. In 2010 the government alleged that he 'mishandled'...
- E-mail privacyE-mail privacyThe protection of email from unauthorized access and inspection is known as electronic privacy. In countries with a constitutional guarantee of the secrecy of correspondence, email is equated with letters and thus legally protected from all forms of eavesdropping.In the United States, privacy of...
- GPGGNU Privacy GuardGNU Privacy Guard is a GPL Licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, which is the current IETF standards track specification of OpenPGP...
/ PGPPretty Good PrivacyPretty Good Privacy is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security... - Nym server
- Secure channelSecure channelIn cryptography, a secure channel is a way of transferring data that is resistant to interception and tampering.A confidential channel is a way of transferring data that is resistant to interception, but not necessarily resistant to tampering....