Secure Email FAQs for External Stakeholders Ver: 07 November 2012 What is secure email and why am I getting encrypted emails from the IPCC? Why do I have to register to open a Registered Envelope? What is the Securedoc.html file that is attached to an encrypted email message, and is it safe to open that file? What is the "Remember me on this Computer" option? Why is my Personal Security Phrase not shown and how do I enable it? Why is the Personal Security Phrase important? Why is my email address not shown on the envelope or in the list? I don't see the "Your address" field to enter my email address? What is "Forget me on this computer"? Page 1 of 15
What is secure email and why am I getting encrypted emails from the IPCC? The IPCC take great care to ensure that we look after your personal information. When information is sent across the public internet your email may not be as private as you think. Someone could intercept and read your email. The IPCC use encryption to ensure that any emails which contain sensitive information can not be intercepted before they reach your inbox. To help us ensure the security of your information you will need to provide a password to access the encrypted email and a security phrase so that you can be reassured that our emails are genuine and not phishing emails from someone trying to impersonate the IPCC. Why is the Personal Security Phrase important? Why is my Personal Security Phrase not shown and how do I enable it? Why do I have to register to open a Registered Envelope? Page 2 of 15
When an email is received it can often be larger than the sent size. This may mean that the recipient is unable to receive the file due to a size limit on their inbox. This can be for a number of reasons, including the recipient s mail system. An encrypted email from the IPCC does increase its size so this may now occur more frequently than before. If this happens, inform your IPCC point of contact. Why do I have to register to open a Registered Envelope? Page 3 of 15
Please log into a PC or laptop to open mail. Why do I have to register to open a Registered Envelope? Page 4 of 15
To ensure privacy, you should never send sensitive information through standard email, where it is susceptible to unauthorised access. Registered Envelopes from the IPCC use encryption to protect sensitive email content so that we can send them safely across the Internet. The Secure Email service delivers Registered Envelopes directly to the recipient's email inbox in any standard email system. Then the recipient can use a web browser to open the envelope. No special software is required. Why do I have to register to open a Registered Envelope? Page 5 of 15
A Personal Security Phrase helps protect you from password phishing threats. Online criminals are financially motivated to steal your information, whether or not they know who you are. They try to get your personal details by impersonating genuine organisations by sending out phishing emails to encourage recipients to send them their personal information. When you register with Secure Email service, you specify a short Personal Security Phrase that is known only to you and to our Secure Email service. The Personal Security Phrase will appear on Registered Envelopes that you receive from the IPCC when you are asked for your password. Note: If you have not selected "Remember me on this computer," then the Personal Security Phrase may not be displayed. If you have received a message unexpectedly and you think the message might be fraudulent, contact the IPCC before opening the attachment. Why do I have to register to open a Registered Envelope? Page 6 of 15
The first time you receive a Registered Envelope, you are asked to register with our Secure Email service. Use the password that you create during registration to open all Registered Envelopes that you receive. If you forget your password, click the 'Forgot My Password' link to reset your password. Why do I have to register to open a Registered Envelope? Page 7 of 15
Why do I have to register to open a Registered Envelope? Every Registered Envelope is password protected. When you register, you create the password that you use to open the Registered Envelopes that you receive. Page 8 of 15
What is the Securedoc.html file that is attached to an encrypted email message, and is it safe to open that file? The attached file named Securedoc.html contains the encrypted message that you have received. It also includes the information necessary to decrypt the message after your password has been verified. To read the encrypted message, complete the following steps: Double-click Securedoc.html to download the file to your PC.S elect whether to open the file or save it to your hard drive. Opening the file displays the attachment. When you are finished reading the attached file, close the browser window. To protect your computer from viruses, we recommend that you install an antivirus software program from a reputable company, and use the program to scan all email attachments. Download files only from known senders. If you have questions about the validity of the message, contact the sender before opening an attachment. Page 9 of 15
What is the "Remember me on this Computer" option? When you open a Registered Envelope using your password, your browser can store your login information. If you select the "Remember me on this computer" option, opening Registered Envelopes involves fewer steps. Important: If you use a shared computer, do not select the "Remember me on this computer" check box. When you select the "Remember me on this computer" option, the browser stores a persistent cookie that the Secure Email service uses to identify you when you open a Registered Envelope. Page 10 of 15
Why is my Personal Security Phrase not shown and how do I enable it? There are several reasons why your Personal Security Phrase may not be displayed: Your Personal Security Phrase is only shown if you have previously opened secure messages on this machine and checked the "Remember me on this computer" box. Using the "Remember me on this computer" option makes opening secure messages easier and more secure. How does this work? We do this with something called a persistent cookie. A cookie is a small piece of information stored by your browser to help identify who you are. Your Personal Security Phrase is only shown when you click on the password field. No Personal Security Phrase will be shown if you did not create a Personal Security Phrase at registration time. We recommend that you login to the secure email site and edit your profile to create a Personal Security Phrase. No Personal Security Phrase will be shown if you use a browser that does not support JavaScript. If you checked the "Remember password for this envelope" option, then your message will be automatically decrypted when you view it again, without showing your Personal Security Phrase. Page 11 of 15
Why is the Personal Security Phrase important? A Personal Security Phrase is a short phrase that is meaningful to you. When you register with an organisation's secure email system, you create a Personal Security Phrase that will be known only to you and to the organization. The Personal Security Phrase helps you to ensure that the Registered Envelope is from the organisation, and not a fraudulent 'password phishing' attempt. If you have received a message unexpectedly, and you think that the message might be fraudulent, contact the organization from which the message appears to be sent. Page 12 of 15
Why is my email address not shown on the envelope or in the list? A Registered Envelope sent from IPCC to multiple recipients will show a dropdown menu with the email addresses of all recipients. The recipient opening the message should choose his or her email address from this dropdown menu. If you've previously opened a Registered Envelope from the IPCC on this computer and checked "Remember Me", your address will be automatically selected. The following conditions may prevent your email address displaying in the dropdown menu: You were Bcc'd this message: Refer to the section below for instructions on opening the message. You have multiple email addresses: To open the message, choose the email address the sender used to contact you. This may be one of your email aliases or an address that automatically forwards to the mailbox where you opened your message. The message was forwarded to you: Contact the sender to resend the message using Secure Forward. The message was sent to a distribution list: Contact the sender to resend the message to your email address. If you were Bcc'd this message: Select "Address not listed" in the recipient dropdown menu. In the new "Your address" field enter the email address where you received this message. Click the "Submit" button. Page 13 of 15
I don't see the "Your address" field to enter my email address? If you are opening the message in a webmail system, such as Yahoo! or HotMail, then you may be subject to the limitations of that system. In this case do one of the following: Download and open the attached HTML file attached to this message, then: 1. Select "Address not listed" in the recipient dropdown menu. 2. In the new "Your address" field enter the email address where you received this message. 3. Click the "Submit" button. Follow the instructions for "Mobile device users" in the email body. You will be emailed a link where you can enter your password to open the secure message. This option should be chosen only if you have previously registered and created a password with the sender's secure email system. Note: If you have not registered with the sender's secure email system and do not have a password, contact the sender to send you a new secure message addressed only to you. This will guide you through the registration process. After you have registered, you can open the original message using your password. Page 14 of 15
What is "Forget me on this computer"? When you open a Registered Envelope from the IPCC using your password, your browser can "remember" this information. If you check the "Remember me on this computer" box, opening Registered Envelopes is easier and more secure. When you select "Forget me on this computer", the IPCC Secure Email service removes that information from the computer. This means that you won't see your Personal Security Phrase when opening a Registered Envelope and you will always have to select your address and enter your password. It is recommended that you use the "Remember me on this computer" feature on your personal computer where you will be receiving most secure messages, but you should never choose to be remembered on a public computer. How does this work? We do this with something called a persistent cookie. A cookie is a small piece of information stored by your browser to help identify who you are. Page 15 of 15