How can I protect my email from being read by others using my computer?

"If it's not physically secure, it's not secure."

That's a fundamental security principal that many people overlook or choose to ignore. If someone has physical access to your computer they could gain access to anything and everything you have.

And a shared computer, by definition, is all about shared physical access.

Now, the common response to this type of scenario is to use encryption, and indeed that's exactly the approach we'll take in a moment, but particularly in this shared computer scenario it's not really enough. If the other people using your computer are savvy and motivated enough, they could bypass what we're about to set up.

I'll explain how after I describe the technique.

•

In a nutshell, I'd have you do what you would do if you were traveling with a laptop computer.

I'd create a encrypted volume using TrueCrypt, and place your email and all of you other sensitive data there. I'd only mount that volume when actually using the computer. The rest of the time it would be dismounted, and would just be so much random data to the other casual users of your computer.

The biggest issue, in my opinion, is actually Outlook Express. It's quite possible to move Outlook Express's storage location, but experience shows that it can sometimes be a little fragile to do so.

And as I alluded do, this is a fine time to start using that encrypted volume for more than just your email: use it as a place to keep anything you might not want others to have access to.

•

OK, so here's why it won't work.

I'll admit that I'm purposely overstating that just a little. To be fair, if the folks using your computer are trustworthy, then what we've just put into place will work, and will work quite nicely.

But it falls into the category of "keeping honest people honest. I mean, really, if they were truly trustworthy why did we have to do it in the first place?

Here's your worst case scenario that renders everything we've done completely pointless: one of your computer's other users intentionally installs spyware - a keystroke logger specifically - and captures the passphrase you use to secure your encrypted volume. And, while they're at it, they use or get administrative access to the machine to bypass any Windows-level security you might have placed on your account or the encrypted file.

They have the file, and they have the passphrase. They have your email - and whatever else you might have placed there.

There's simply no scenario on a shared computer to actually guarantee that your information is secure. The mere act of sharing a computer implies - no, requires - a level of trust. If that trust isn't there, then to put it bluntly, you shouldn't be sharing that computer.

"If it's not physically secure, it's not secure."