Some guidelines about fax.

Susan Bradley, SBS Diva and Security Guru Extraordinaire, posts about some guidelines for making your fax modems work reliably over at http://msmvps.com/blogs/bradley/archive/2006/01/25/81854.aspx

This reminds me that I am continually amazed by people who call our company asking for instructions on faxing us – not because they want to fax us, but because of why they want to fax us.

Their perception is that fax is more secure than email.

I’ll pause while you think on that.

Ready?

Okay, so here we go…


  • Data Encryption: A fax cannot be encrypted, but an email can. Sure, there are some encrypting fax machines and/or software, but the ones I’ve seen all require that your peer has the same machine / software; email has standardised encryption methods – the most common of which is S/MIME.
  • Peer identification: An email can be diverted by hijacking the DNS settings in the sender’s DNS servers for the recipient’s domain – possible, but hardly trivial (and resolved by using encryption with a peer whose certificate you know). A fax can’t be so easily diverted, but when a company moves, its phone number gets assigned to someone else. That explains why we get a number of faxes every week for a rock quarry; some of these include ordering information.
  • Non-repudiation: again, S/MIME and others come into their own here, by providing the ability to sign an email. You can’t sign a fax, except with a hand signature that is so ludicrously easy to duplicate (cut it out of a previous fax, and paste it onto the next one).
I’m normally all over the idea that users should be using solutions with which they are comfortable, and whose failure modes and security mechanisms they are already familiar with – but it seems like too few people have ever considered these issues for facsimile machines, and they’ve all been told that email is unsecure.

By now, we should all be comfortable sending signed and encrypted messages, using self-signed certificates.

Update 2006-02-07: Prudential’s customers have their data sent, by the thousands, to a herbal remedy store, because the two fax numbers differ by only a digit.  Private information should be sent through secure channels – fax is not a secure channel.

One Response to Some guidelines about fax.

  • mathew says:

    Back in 1988 or so, Mantis tried to get lawyers and accountants interested in secure e-mail, because of the incredible insecurity of fax. It was pretty much an impossible battle.

    Then we had the stupid Electronic Signatures Act (S.761), the basic reasoning behind which seemed to be “It’s too much effort to require people to make electronic signature systems secure, so we’ll just pass a law saying that everyone should pretend the insecure systems are secure.”

Leave a Reply

Your email address will not be published. Required fields are marked *


*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>