2

The ISP they know everything I send and receive over the Internet including my emails and messages right ? So I am wondering if there is a way to prevent them to do it ?

2
  • Use SSL or TLS.
    – kobaltz
    Jun 11, 2013 at 17:05
  • 3
    @Jatsing - Unless you encrypt every single email you send out and every single email you recieve is encrypted you can't prevent an email provider from accessing your email. There are tons of ways to encrypt your messages send by your instant messenger.
    – Ramhound
    Jun 11, 2013 at 17:11

3 Answers 3

3

http://www.cypherpunks.ca/otr/ for instant messaging, http://www.gnupg.org/ for emails. Make sure to exchange keys through a secure channel, if they are compromised all your efforts are wasted. Using SSL where available should be a no-brainer.

2

End-to-end encryption is the best solution as noone can spy on you then, but if it's all just about your ISP, then SSL encryption should be enough. That means using only https:// webpages, checking use SSL/TLS in your e-mail client and so on.

Regarding the e-mails, it's probably best to use PGP which is end-to-end encryption. The recipient, however, has to use it, too.

As to browsing the web, you might be interested in VPN or Tor (slower, safer). This, however, still doesn't stop exit nodes and the server from seeing what you are doing - so, in the end, end-to-end encryption is still a must if the privacy really matters.

6
  • I don't understand your objections. As I clearly stated, this prevents his Internet Service Provider from reading the communication with the server. Mailserver, webserver, whatever. Of course, the server owner, such as Google, can read the message. No, some instant messangers do not use secure connection. Does it mean if they use it, it's not secure anymore? It doesn't. Finally, as I stated, one should be concerned about other attackers than just the ISP, too. The end-to-end encryption is the solution here.
    – KamikazeCZ
    Jun 11, 2013 at 17:16
  • I suggested an end-to-end encryption in the answer, too. "Outside attackers" can, should and must be a concern. What about the cases you wrote yourself, as Google? What about the recipient who doesn't use SSL/TLS? Waht about his mailserver who can see the message in cleartext?
    – KamikazeCZ
    Jun 11, 2013 at 17:22
  • Tor is an anonymiser and should not be trusted as an encryption service. The exit node connection is not secured and could be tracked. Hides traffic from the ISP, but the not exit node owner necessarily.
    – nerdwaller
    Jun 11, 2013 at 17:33
  • When we use SSL/TLS the ISP cannot see the message in cleartext but can they decrypt it then ?
    – JatSing
    Jun 12, 2013 at 5:01
  • @nerdwaller That's true, I forgot to mention this and it is crucial! Although, it does stop his ISP from reading the message as OP asked. Thank you anyway, I will add this to the post.
    – KamikazeCZ
    Jun 12, 2013 at 9:49
1

If you use Skype for IM, note that Skype encrypts its communications.

Regarding email, If you use webmail, and your connection to your email provider's website is HTTPS, and you've verified that the HTTPS certificate is actually from your email provider, then your ISP can't see what you are doing on that site.

If you are using a standalone email client such as Thunderbird or Outlook, you need to make sure SSL and/or TLS is selected/enabled when you set up the account. You may need to consult the email provider's online help to determine what settings to use (i.e. ports, servernames, etc.)

Note that most of this only ensures your ISP cannot see your communications. You have no way of controlling what the remote end does with the message, or if it encrypts upon transporting to the recipient. So it is not an end-to-end encryption solution that will prevent eavesdropping completely.

Now, if end-to-end encryption is what you want, use OTR as @Squeezy suggests. This lets you add encryption over various existing instant messaging services - transparent to you if you are using the plugin. It's a plugin for the open-source multi-protocol IM client Pidgin.

End-to-end encryption for email is possible, using PGP or GPG, and there are plugins for Thunderbird and (possibly non-working, non-reliable) plugins for Outlook. Both ends have to have these plugins installed and the proper keys installed beforehand (which you don't want to transmit via email as that defeats the entire purpose.) Claws Mail may serve your needs if you can get your recipients to use it.

In a pinch though, if you and the recipient know a shared password, using an encrypted (i.e. "password-protected") zip file to contain your message should be pretty good. Use AES-256 or higher if you can. 7-zip is a free program that allows you to easily do this with a right click.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .