Is web-based email more secure than using a PC email program?

In this excerpt from
Answercast #80, I look at some of the security implications of web-based
email over local access. Most important is to back up!

]]>
<![CDATA[

Is web-based email more secure?

Not really. The email, whether you use web-based or not, is sitting on your email provider’s server any way.

When you use a POP3 email client on your desktop, you move the mail to your desktop PC. If you’re using IMAP, you just create a copy of the email on your desktop PC.

All of the communication paths are very similar when you’re using web-based email. Most of the sites provide an HTTPS secure encrypted connection, so nobody can snoop on your email being read, but most of the POP 3 and/or IMAP providers also provide a similar SSL type of connection that provides the same level of functionality.

Secure from viruses

We also think of things like malware and so forth. But malware usually arrives in the form of an attachment and it’s up to you whether you open that attachment.

Well, opening it is going to be opening it regardless of where you happen to get it from. If you grab the attachment from email on the web and download it and open it, or get it in your email program on your desktop and open it, it’s the same thing.

Choose what works

So ultimately, I really don’t see a huge security advantage to one approach over the other.

I definitely would choose one over the other based on convenience and what works the best for you – and what allows you to insure that your email is properly backed up.

That more than anything is perhaps one of the downsides of web-based email. People assume that it will always be there and we have seen time and time again that accounts can get hacked. Emails can disappear and so forth.

With that in mind, I strongly recommend that you find some way of backing up your email if you’re only going to read it on a web-based interface.

(Transcript lightly edited for readability.)