SafeMessage Masks Mail, Even Behind Firewalls

Your "private" Internet e-mail often bounces through as many mail servers as the hands that touch a basketball traveling down a court. Even the secret code of encryption doesn't ensure total privacy; a header still leaves tracks. And a delete command is only as final as a recovery utility permits.

Addressing each of these shortcomings is SafeMessage, a private messaging system unveiled recently by AbsoluteFuture that goes beyond encryption. Correspondents using it can swap messages that sidestep the Internet's SMTP mail servers.

AbsoluteFuture markets its SafeMessage programs as subscriptions. SafeMessage Personal costs $99 yearly; SafeMessage Deluxe, which supports file attachments, costs $149. The software requires Windows 95 or later. Both sender and receiver must have copies of SafeMessage on their systems and must subscribe to the service.

If you're behind a corporate firewall, SafeMessage will shuttle your messages past the potentially snooping eyes of the company mail server, whether your message's recipient is on the Internet or the company network. SafeMessage can also be used as a secure corporate instant-messaging program.

Messages are triple-encoded. SafeMessage enciphers not only the message but its header as well to make the communication untraceable. It uses the impregnable Diffie-Hellman encryption algorithm. Like most secure encryption, it uses a public/private key system. Each user has a public key of hexadecimal numbers. This key is given to correspondents who use it to generate unique secret codes that only the key's owner can read. Private keys are used to unlock codes, or read messages.

Traditionally the key system has been a hassle to use, but SafeMessage generates keys and shuttles them invisibly to message recipients so that you never need to enter anything except your password. SafeMessage even changes keys regularly for each user.

Messages Time Out

Other security features prevent message recipients from forwarding, copying, or printing messages, or even cutting and pasting material from them, according to SafeMessage representatives. This program also automatically deletes messages from the recipient's disk after a number of days specified by the sender.

"We've gone to extreme efforts to make sure that this is a limited persistence system," says Tony McNamara, chief technology officer for AbsoluteFuture. SafeMessage checks the Greenwich Meantime Clock on the Web to make sure that message recipients haven't set the clock back on their computer to retain confidential mail past its expiration. Unlike messages, file attachments can be stored indefinitely.

A potential Achilles' heel is the fact that AbsoluteFuture's server in Bellevue, Washington, is responsible for juggling encryption keys, and also storing and forwarding messages when sender and receiver are not online simultaneously. The company is adamant, however, that it stores nothing that could compromise the privacy of its subscribers.

"We have no records of subscribers' names. We have no records of anything. If someone loses their user ID and password, they're lost, because we don't even keep a record of that," says Scott Whitmore, vice president of sales and marketing.

SafeMessage does not function as an add-on to existing mail programs, like some of its competitors. Disappearing Email, for example, offers similar features, but works exclusively with Microsoft Outlook. That reliance on an outside e-mail program makes the system less secure, claims AbsoluteFuture. (See also "Internet Tips: Encryption.")