Protect Your E-Mail From Prying Eyes

You've Got HushMail

Burson found his solution in HushMail, the most robust of the Web-based encryption systems. HushMail has one drawback: Currently, recipients of encrypted mail must also be HushMail members. But HushMail is free, sign-up is easy, and by the time this column appears, you may be able to exchange encrypted mail with PGP users too.

Once you register with HushMail, you're instructed to move your mouse around an on-screen box for about 15 seconds, prompting the program to create the encryption keys it will use to encode and decode mail. Next, you create a pass phrase. The longer and more cryptic your phrase, the more secure your mail will be.

To write a message, you first log in and click the Compose button. Unless you uncheck the 'Send securely' box, the program encrypts any message going to another HushMail member (which it determines by checking the recipient's address). You can read encrypted messages by opening them as you would other mail.

Unlike PGP or Outlook Express, HushMail allows you to encrypt messages from almost any Web-capable PC--even if it's located in an Internet café in Zanzibar. If you sign on at a remote terminal, HushMail downloads a 70KB Java applet to the system to verify your pass phrase and begin its encrypting work, using your unique keys. HushMail can do this because, unlike PGP, it stores all encryption keys on its server. (Users with critical privacy needs, such as businesspeople exchanging sensitive company data, may not want their private keys stored on a centralized server, so HushMail will not be the best option for them.) The HushMail Java applet requires Netscape Communicator or Internet Explorer versions 4.0 or later, or America Online 5.0, which means that you may run into compatibility problems on systems that use older browsers.