In a land where only about 10% of the people have electrical power in their houses, you might wonder what good such technology as electronics, satellites, radio, and cell phones might be. Actually, such technology is very useful, indeed. Technology is no substitute for living and proclaiming the Word of God. It can, however, make it easier to reach people with the Word of God and make the logistics of getting the Word of God to new people groups much easier.

We rely heavily on communication satellites. All of our telephone calls from Ukarumpa to anywhere farther than Kainantu are carried by satellite, no matter which way we make them. The Papua New Guinea Christian Broadcasting Network (also known as Wantok Radio Light) uses a satellite channel to distribute its programming to FM radio stations scattered all over the country. Our Internet connection is via satellite. In a country consisting of about 600 islands, including the very large and mountainous island of New Guinea, satellite links are the most practical way to communicate in many cases. Running cables all over the place is way too expensive, and far to vulnerable to damage by vandals, earthquakes, and other problems. We also make heavy use of HF and UHF radio links.

A few weeks ago, the local Wantok Radio Light station in Kainantu stopped working. Its receiver (shown in the picture) apparently suffered damage to its RF front end in a lightning storm. The station manager sent a replacement up via an SIL flight, and I put the new one in place. Many people were happy to be able to hear their favorite Christian programming, again.

Although few people have electrical power in their houses in Papua New Guinea, there are many battery-operated radios listening in. We have distributed about 700 fix-tuned, solar powered radios to people in Wantok Radio Light’s service area, so far.

Yes, the Good News of Jesus Christ is simple enough for a child to believe. Rocket science can help deliver that good news.

Our last field term in Ukarumpa, there was no mobile phone service at all in Ukarumpa, except for bulky and expensive hand-held satellite phones. Now, there is service from two different companies! One of those (B-Mobile) has excellent signal strength in Ukarumpa but high airtime prices. The other (Digicel) has better coverage most places in PNG and better prices, but weak signal strength in Ukarumpa. It is interesting to watch the culture changes that happen when technology like this comes to where it wasn’t available, before. The introduction of competition for telephone service has been resisted by the existing telephone company (Telikom and B-Mobile) and some people in government. Therefore, the newer and larger mobile phone network (Digicel) has been blocked from interconnecting with the existing telephone company, so far. Because of this political state of affairs, it takes two telephones to be able to talk to anyone with a telephone in the country. Both networks connect internationally, but there is a significant price difference ($1.97/minute for Telikom vs. $0.36/minute for Digicel). Fortunately, accepting inbound calls is free on both networks. I hope that Telikom wakes up, lowers prices, and makes an interconnect agreement with Digicel and Green Communications (the other licensed mobile phone service provider) before everyone cancels their B-Mobile and Telikom service and just goes with Digicel because of better service and lower prices.

Having these additional telephone services has significantly increased our communication reliability from Ukarumpa. In the last week or so, the “land line” service of Telikom from Ukarumpa to the outside world has gone out of service twice for about a day at a time, but mobile phone service was available at those times. (Telikom has had significant difficulties maintaining service due to theft and vandalism of their lines and equipment.)

The expansion of mobile telephone service in Papua New Guinea is a valuable additional communication option for many people, including Bible translators.

When doing Christian mission work, it is often necessary to consider the effects of email and the Internet when going into areas with opposition. Much mission work goes on in technologically advanced, developed countries. (That isn’t a good description of where I work, but I did take this picture within about 200 meters of a mobile phone sales booth.) Although I work in a country where I can be open about what I do, some don’t. One brother asked me for advice on email security in his country, which is less friendly than mine to Christians. Here is my answer to him and brothers and sisters like him:

* Be like Jesus. He doesn’t lie, but He doesn’t tell everyone everything, and often uses parables. Choose wisely what you reveal to whom and how.

Don’t say things that attract terrorist attention. Avoid saying things that sound like blasphemy or illegal activities. Avoid using religious key words that a terrorist might look for, or at least be very careful of the context of that use. Keeping the text clear of incendiary comments and personally identifying information and exact locations is a good practice when operating in some areas, but that should never be all that you do. It isn’t enough.

Be anonymous. Don’t get real specific about identifying information of individuals and locations. Maybe a common first name, pseudonym, or initial is enough to talk about a person. Use large geographic units (like “Southeast Asia” or “North Africa”) instead of precise addresses. Use of a specific country name may or may not be OK, depending on the country. Consider carefully what pictures to send, and how to crop or selectively blur them. If someone with murder in his heart intercepted your email and decided that he hated you and what you do, but couldn’t identify or find you or your brothers and sisters, then that email leak did no actual harm.

Use generic email addresses. There should be nothing to capture unwanted attention or reveal too much identity in either the user name part of an email address or in the domain name. There should be nothing incendiary that pops up if you visit http://www.networksolutions.com/whois/index.jsp with the domain name or surf to the corresponding web site. Something like imaketents@gmail.com or languagestudent@yahoo.com is much better than something like Joseph_David_Smith@name-of-disliked-organization-here.org.

* Use link encryption. For most people, that means requiring TLS or SSL connections between their email server and their email client. Galacticomm.org addresses and FirstClass mail clients automatically use link encryption, but they aren’t the cheapest solution, and not as easy to integrate with GnuPG. With standard email clients, like Thunderbird, Outlook Express, Eudora, etc., there is usually a little non-default setup that needs to be done. Link encryption is supported by all good email providers and email programs. If yours doesn’t, get another one that does. You can get free email accounts supporting encryption at gmail.com and other places, and high-quality free email software that supports encryption, so this need not cost money. Exactly how you set it up depends on your ISP and your email program. Thunderbird, in the account settings box, the “SSL” or “TLS” radio buttons should be checked, depending on what your ISP supports. Another option is to use SSH or VPN tunneling instead of or in addition to SSL or TLS, but that most likely requires some expert help to set up. Note that link encryption just protects the privacy of the email from your computer to the server and back, and does nothing to protect it on the server, on your local computer, in transit between the server and your correspondents, or on their computers. That might not seem like it is worth much, until you consider that it probably covers the portion of the email route where the worst threats are.

* Use a mail server in friendly territory, preferably in the country where most of your email correspondents live. There is no guarantee that email between your server and others will not pass through an enemy’s server, but the odds of that happening are lower than if you choose a mail server in a land populated primarily by the kinds of people you would least like reading your email.

* Use secure web mail. Web mail access is great on the road. Make sure the connection is secure, however, with https, not http. Don’t use web mail from untrusted cybercafes and stranger’s computers. Using your own notebook computer at a wireless hotspot is better.

* Use GnuPG where practical. Unfortunately, that isn’t in very many cases, unless you set it up for people… but if you really want to pour your heart out in an email, it may be just the thing if your intended recipient also is set up to handle GnuPG mail. This takes planning ahead, and it probably means having at least one GnuPG expert per working group. Once set up, it is really easy to use, if you use GnuPG with Enigmail and Thunderbird. (If you are using an email solution that doesn’t have OpenPGP integration, you should consider getting another account and email client for this task.) There are some other similar combinations that work, too, but I like Thunderbird + Enigmail + GnuPG, because it works for me on Windows, Linux, and Mac OS, and because it is really easy to use once set up. GnuPG is not a realistic thing to expect all of your partners to use, though.

* Practice safe computing. Enable a firewall. Protect yourself from viruses. Don’t install unnecessary software on your working computer. Don’t leave sensitive information unencrypted on your computer. Sensitive information is anything that would cause you significant concern if your computer was stolen and you were thinking about the thieves looking at it, like maybe bank account information and passwords, personal correspondence, etc. Scan for spyware and viruses regularly. Your email can be perfectly secure, but if you have a keystroke logger reporting your passwords and email contents to someone else, someone else can get it all, anyway.

* Encrypt the email (and other sensitive documents) stored on your disk. The easiest way I have found to do that is to use TrueCrypt (http://www.truecrypt.org) to create an encrypted volume, then install the PortableApps version of Thunderbird in that volume. The encrypted volume can be on a large capacity USB memory stick, if you like. See http://portableapps.com/ for more about portable applications. All of the care protecting the transmission of your email isn’t worth much if your computer (or memory stick) is suddenly stolen, and the data isn’t encrypted. Do this before you need to do it. (In other words, shut the barn door before the cattle stampede across the highway, even if you don’t see the kid with firecrackers hiding in the barn.) Some versions of Microsoft Windows allow you to encrypt certain directories with your login credentials. This feature is easier to use than Truecrypt, but I prefer to use Truecrypt for several practical reasons, including the ability to backup and recover from disk disasters in a more straight-forward manner. (There are other disk encryption programs, but Truecrypt is free, uses sound cryptography, and I know how to use it.)

* Separate your sensitive and non-sensitive data. Make a habit of keeping your sensitive data in an encrypted volume on your computer, and backing it up to an encrypted volume on a memory stick that you keep in a separate place. Most of your non-sensitive data is also probably worth backing up, but you don’t have to keep it encrypted.

* Use good passwords/passphrases. Don’t use things that are easy to guess, things that are in any dictionary, etc. Use first letters of a long phrase. Throw in some special characters. Make it long. Make it easy for you to remember and very hard for others to guess, even if they have automated help guessing. Longer passwords are usually better (as long as you don’t forget them). Even long passwords that you use regularly aren’t all that hard to remember.

* Keep remote backups in a safe place. If you have some really important data, make sure you back it up and store it in a separate place, preferably in another country. If it is sensitive data and you have any doubts about if it will be intercepted in transit or stolen from its destination, encrypt it. Remember the password to decrypt it.

Ask correspondents not to forward or post newsletters. There are things you might like to tell your partners in your home country that might not be appropriate to share with all of your neighbors. One forward to a mailing list with a public list archive that gets indexed by search engines could drastically increase the potential readership of your newsletter.

* Protect home and office networks. Use encryption (WPA or WPA2) on wireless networks. Don’t share more than you intend to via network. Turn off file sharing if you don’t need it. If you do, only share specific directories for specific purposes.

* Be careful what you publish to the world via the Internet. Make sure what you say is appropriate for your current situation, especially if you have a personal web site, blog, or photo-sharing site. Consider carefully how your near neighbors may view what they find out about you on the World-Wide Web. Google finds some amazing things.

*Items marked with an asterisk are good advice for missionaries even if they are not in places where terrorist attacks are likely.

Another missionary working in Papua New Guinea (and currently on another island) told my wife that they only got a newsletter out about once or twice a year. It is hard, and they just can’t “whip one out like [Michael] does.” I have a confession. I don’t just “whip out” a newsletter. OK, maybe a quick photo of the week email with no major content is pretty quick, but the “official” newsletter that we archive on our web site, email to our partners, and have printed and mailed to our email-less partners takes about two days of labor to produce. It would take less time if we made it longer, actually. We know that people are busy, so we endeavor to keep the newsletters short; no more than one sheet of 8.5 x 11 inch paper, printed on both sides, using type that most people won’t need a magnifying glass to read. In addition, we know that people like pictures. We like them, too. Pictures aren’t just fun to take, they are also effective tools to communicate a lot in a little time. Pictures tell stories. Of course, pictures bring to mind stories, too— usually more stories than I tell. Actually, one of the best things about our web site is that it gives me a place to put the overflow from stuff that didn’t make it into the newsletters. It also is a nice place to be able to post pictures without a really small size limit on the captions. Of course, I realize that not nearly as many people will read all that I post or enjoy the pictures as read our newsletters, but that is OK.

The richness of the full-color range of experiences and adventures with God here and in our travels just flat-out won’t fit in two pages every month or three. There are many significant things going on, times where God has gotten glory by protecting and healing His people, trials and victories over trials great and small, all mixed in with cross-cultural salsa and sprinkled with miracles. Sometimes it seems like a real struggle just to not lose heart, and other times, the joy of the Lord just overwhelms a guy. Through it all, God is faithful. Of course, adventures with God don’t require crossing large quantities of salt water. People struggle to grow close to the Lord in the busy USA, too. So, we keep trying to condense significant events, prayer requests, vision, thanks, and news of what we are doing into less than a page a month. Why do we even bother? Accountability. Reminders for both senders and sent of their dependence on each other. Reminders to pray. That makes it worth it.

Lately, I’ve been experimenting with making the newsletters a little “deeper,” at least for some people. By embedding hyperlinks in our newsletters, I make a way for people who are reading the electronic version online to dig a little deeper or see a little clearer picture with a simple click. At least that works for people who are on the Internet at the time. If they aren’t, or if they are looking at a printed copy, then they still get a decent newsletter.

I’ve also used prayer letter writing as a learning experience. I suppose that a normal person would figure out one software program for creating prayer letters and stick with it. I’ve used a wide variety of programs, sometimes just to learn to use that program. The most recent newsletter I produced was the first one that I produced with Scribus running under Ubuntu Linux. I like it. I think I’ll keep using Scribus for our newsletters for a while. It makes a really good PDF file for our purposes.

It turns out that my journal entries were not totally obliterated, just temporarily inaccessible. With a bit of labor, I was able to recover all of the posts in my blog. In the process, I decided to move the blog from the Rainbow Missions leased server to a “free” account on WordPress.com. Although this has the unfortunate side effect of breaking all of the “permanent” links to the individual articles, it has the advantages of (1) upgrading to the latest version of WordPress software (2) someone else maintains the server and keeps the software updated, and (3) it saves me the trouble of trying to get Plesk, WordPress, and various web pages working together with the same version of PHP and other programs on the same server. I can minimize the pain of the broken links by making the old main blog URL automatically forward to this one. Now, I’ll run one of my favorite features of the latest version of WordPress: export of the whole blog to an XML file that can be imported to restore the whole thing, later.

You would think that after more than three decades of working with computers, I would be better about backing up my data. Apparently, I’m not. I’m OK with regular files, but I hadn’t gotten around to setting up a proper backup system for MySQL data on my server, including my WordPress blog entries. A software glitch during remote upgrading of the Plesk software on that server killed it. This is sad. I’ll try to do better.

The last time I wrote about computers, I was happy to have found and fixed a serious problem with my Toshiba computer. I expressed high hopes that it would provide long and reliable service. Those hopes were disappointed as the Toshiba computer froze up a couple more times, one of which cost me about an hour of work. To me, having a computer that is so close to working well, but so far away, is frustrating. Fortunately, there is a good solution. A dear brother in the Lord gave me a MacBook notebook computer. I really like it. It has become my primary working notebook computer. The MacBook is smaller and lighter than the Toshiba computer, but it runs faster and has more RAM installed. I was pleasantly surprised at how well it runs not only its native Mac OS X, but (with a little help from Parallels) Microsoft Windows and Linux, as well. This is important for the cross-platform Bible translation software development that I’m working on. Praise God! It works!
The Toshiba computer isn’t totally out of service, yet. It has been assigned to entertainment duty and for use in places where I don’t want to have my primary working machine, such as showing photos in a display booth or as a loaner for other people to use for less critical and less demanding applications.

The saga of the Toshiba Satellite P35 notebook computer woes continues, but this time I have high hopes that things have turned around such that we will get our money’s worth of work out of this machine, yet. Its warranty has expired. It was working OK most of the time, at least running Ubuntu Linux, but it still flaked out at times. It seemed to be thermally sensitive. The environment I’ve been running my computer in has been a consistent 20 to 23 C, which shouldn’t be a problem at all, but at 2,425 meters above sea level, which might challenge the cooling system a little. This model of computer is notorious for overheating due to the heat sink over the CPU getting clogged with dust. I found instructions for disassembling and cleaning it, but didn’t want to perform that major surgery until I had a viable backup plan and ALL critical data was off of the computer. All the important data is mirrored to an external hard drive at least every other night, but it wasn’t until I had Linux set up on my desktop computer with all of the same applications and had another notebook computer that I felt that I could risk disassembling the computer.

What I found surprised me. The heat sink wasn’t clogged. The canned air treatments that I had given it had effectively cleared out most of the dust, dog hair, and other junk. However, when I lifted the heat sink up, the CPU just fell out of its socket with no resistance. The latch on the zero-insertion-force socket was set about half-way between “open” and “closed.” No wonder the machine had been flakey! It had a loose brain! I’m amazed that it had done as well as it had, to be honest. The top picture in this article shows the CPU properly latched in place.

After smearing on some fresh thermal transfer grease and attaching the heat sink, and putting all of the parts back together again, this computer has run flawlessly, so far, doing normal stuff like downloading pictures from my digital camera, reading and writing email, and and writing this article. I have high hopes that it will keep running well.

Praise God! It almost feels like getting a new computer!

I still remember when I first found out about the World-Wide Web and HTML-based web browsers. I had know about the Internet, text-based email, ftp, and Usenet, but this was a new thing, still highly experimental. By that time, the Lord had already directed me to start work on the World English Bible for free electronic distribution. Electronic bulletin boards were popular among a few people, and a 2400 baud dial-up modem was considered fast. Flash forward in time to the present, and Internet web site addresses adorn the packaging of much of the food in your kitchen, the backs of trucks, and TV commercials. Students do research using Google and other search engines, Wikipedia, and the on-line databases of libraries with their favorite web browsers. Paper library card catalogs are being phased out. Large numbers of people, especially young people, exchange information about themselves on social networking sites like facebook and myspace. Large numbers of people like to write web logs or blogs (like this one). Some of them are even worth reading. All major public relations efforts in the technologically developed world include an Internet web site presence. Domain names become valuable property, like trademarks, and sometimes sell for surprisingly large amounts of money.

Why should a nonprofit organization or a missionary have a web site? After all, the work of the Great Commission and missionary work have gone on long before the Internet. And before radio. And before jet aircraft. And before Gutenburg’s printing press.
Here are my favorite reasons for a nonprofit organization to have a web site:

• To provide contact information for people you want to hear from (partners, potential partners, potential members, clients, etc.). Often people search the web before even thinking of a phone book– and those are so limited in reach, anyway. If you don’t do anything else, a simple web page with contact information and a clue as to who you are and why you exist would meet the minimum expectations of many people.
• To further the mission of the organization by direct ministry. For example, if an organization exists to publish and promote the Holy Bible, the text of the Holy Scriptures can be published on line for reading and downloading. Information to help hurting people with their problems can be posted on line. Churches can post sermon recordings on line.
• To solicit donations. Fund-raising is not evil. Rather, it is a necessary part of keeping the organization running and fulfilling its mission. Donations are voluntary contributions by like-minded people and groups to further the cause of the mission.
• To recruit more volunteers, members, or (in some cases) employees.
• To communicate with partners and others. Communication runs both ways. The communication may be news, prayer requests, praise reports, answers to questions, etc. Outbound communication is fairly obvious. Inbound communication can be handled with web forms (usually more spam-resistant than regular email), email, email discussion lists, web-based forums, comments on blogs, etc.
• To communicate with members or employees things of a personal nature (such as financial statements or mailing lists) or things of interest only within the organization (such as policies, forms, etc.). This sort of thing should obviously be placed in a password-protected secure area instead of a public area.
• To sell things related to the mission of the organization, such as books and audio recordings, if applicable.
• To promote your organization and cause. Public relations is important both in terms of being able to perform your main mission and to gain funding for that work. The image cast must be truthful and reliable, as well as being positive. (This, of course, implies that your organization must also be good.)

My favorite reasons to not have a web site are:

• Your organization is secret. You don’t want any unauthorized people to know you exist.
• Your organization can’t properly manage even a simple web site, nor can it find a trustworthy and knowledgeable person to do so, and wants to save itself from very public embarrassment.

A good web site:

• Is up-to-date. Information marked current is really current. Archives of old or superceded information is clearly marked as such.
• Is accurate, truthful, and reliable. Not everything need be made public, but what is should reflect reality.
• Is efficient and loads quickly. Just because you have an extraordinarily fast broadband connection doesn’t mean that everyone else does. Even people with broadband connections tend to have short attention spans, and expect snappy performance. Some people are still on dial-up connections, and some people have even worse or more expensive connections in developing nations.
• Is compatible with the top browsers on multiple operating systems. Currently, this means reasonably current versions of Microsoft Internet Explorer, Firefox (and other Mozilla derivatives), Opera, Netscape, and Safari. Web pages should not do anything that tie visitors to one operating system (like using Microsoft Active-X controls).
• Is safe. Private and financial information is kept safe using careful design and proper use of encryption. Site infrastructure is kept reasonably well updated and secure against hacker attacks.
• Is accessible. Consider visually impaired people using smaller pixel size screens or audio screen readers. A design that looks great at 1280 x 1024 pixels may be unusable at 640 x 480 pixels. Tag pictures with meaningful alternate text. Make sure the site is navigable if graphics are not visible. If the target audience speaks more than one language, translations of the site are available.
• Has appropriate content. Things are made public that should be made public, and things are not made public that should not be made public. The content of the site accomplishes the purpose of the site.
• Is culturally sensitive. Web sites are international in reach and subject to being read by people of many cultures, religions, races, and nations. It may be impossible to avoid offending absolutely everyone, but try to minimize the offense.
• Is attractive and easy to read. Pay attention to graphic design. Great graphic design is no substitute for good content, but it can sure help enhance that content or at least make reading it more pleasant.
• Is intuitive to navigate and consistent in operation. Just say “no” to novel user interface ideas unless you have very compelling reasons not to. There are many ways to create consistent navigational structures, technically. Some are much easier to maintain than others, especially as the number of pages in a web site grows. With large sites, including a search engine may be a good idea. Avoid menus that are too long. (Nest or cascade menus, if necessary, to keep them manageable.)
• Has stable URLs. People can link to pages within your site and expect the links not to break right away. Search engines can send people directly to the page of most relevance to their search. Among other things, this means not arbitrarily changing page names or directory structures. Sometimes it means leaving a trail from the old to the new with a redirect, alias, or other technique. Useful content doesn’t disappear before its usefulness expires.
• Uses pictures to tell a story, but not to hold large amounts of text. Pictures should be big enough and clear enough to do their job, but not so big as to slow down page loading. If someone might want to see a larger version of a smaller picture, it is normal to make it available by linking the smaller picture to a larger version, or to provide links to multiple sizes.
• Is functional. The links, buttons, and other controls all work, and do what you would expect. If you feel compelled to make dead or stub links, either do so for very little time (like less than a day), or (better yet) go study web design some more until that feeling goes away.
• Is maintained and under construction, but doesn’t have a lot of “under construction” signs and excuses up. We expect web sites to change content, sometimes daily, but the really good sites that change the most never give you an “under construction” page. Either the page is there, and there are links to it, or it is not public, and there are no public links to it. It is clear who has authority and responsibility for site maintenance, and they do their jobs. It is actually unusual for one person to have all of the skills necessary to manage all aspects of web site design and maintenance single-handedly. Therefore, those working on the site must work together to combine their strengths.
• Is corrected promptly when things change or errors are found. Out-of date information is promptly removed.
• Displays journalistic excellence. Accuracy, spelling, and grammar count.
• Properly represents the organization. The views and opinions expressed in the web site accurately reflect the organization as a whole and its leadership. It is an advocate for the organization that emphasizes the strengths of the organization, the work and qualifications of its members, and the merits of its mission, without losing sight of humility.
• Doesn’t annoy people without just cause. Use flashing text, animated video, pop-ups, etc., sparingly, if at all.
• Keeps content primary and presentation technology secondary.
• Has an easy-to-remember and easy-to-type URL. The domain name is properly registered and kept safe from inadvertent lapse in registration. In some cases, it is worth registering more than one domain name for the same site. In other cases, it is fine just to use a new directory or subdomain on an existing domain (like eBible.org/Johnson or AdaptIt.ebt.cx).

So, how can you improve your web site, today? How can I improve mine?

Your normal email is less public than this web posting, but not by as much as you probably think. I’ll not get into how easy it is to intercept unencrypted email, except to say that it is very easy to do. Sometimes it is not only easy, but cheap to intercept your email. Yes, there are laws about such things, but some morally challenged people don’t care about those laws any more than the average spammer cares about the laws they break. Besides, those laws don’t reach everywhere your email travels. Even domestic email can be routed outside of the country you are in. Usually, you will have no clue that your email has been intercepted, read, or analyzed by someone you would not like reading your email. The unauthorized reader could be anywhere in the world: criminals, competitors, religiously violent people opposed to the Gospel of Jesus Christ, hostile governments, terrorists, etc. You would be amazed the routes your email takes, even when you aren’t on a particularly vulnerable network (like a wireless hot spot or cybercafe).
Sometimes I’m not really concerned about the privacy of communications. Sometimes, I intentionally put a message (like this one) in public view. Sometimes, I want more privacy, because the communications are personal, financial, proprietary, easily misconstrued, or something that could endanger someone if revealed to the wrong person. Sometimes I just feel like some communications should be private, even if there would be no harm in saying the same things openly.
OK, so what can we do about email privacy? Actually, there are some high security solutions, some medium security solutions, and some insecure solutions. For high security, use end-to-end encryption, like GPG or PGP. For medium security, use TLS or SSL encryption between your email client and your mail server. Although it is not hard at all to use GPG with Enigmail in Thunderbird, once it is set up, it does take a bit of effort to set up, and some learning to understand the concept of public key cryptography. Actually, that isn’t all that hard. Getting all of your correspondents to use GPG, however, is nearly impossible. That is why SSL and TLS are so attractive. With either SSL or TLS, the email is encrypted between the email client and the email server with no effort required from the user other than to get the initial settings right in the email client when setting up the email account. With SSL and TLS, the email is decrypted at the email server, and may be transmitted between email servers unencrypted, depending on how the email servers along the route are configured. This, naturally, makes this solution much less secure than end-to-end encryption, but it does get the email encrypted past the most vulnerable last leg of the journey, which might be at a wireless hotspot or some similar extremely insecure network. The SSL or TLS solution works well, however, within one organization (like SIL and its affiliates), which use only a few servers run by trusted parties in secure locations, and all email transfers between those servers are also encrypted. Of course, any email to or from a server that doesn’t support the encrypted transfer protocols (which most don’t) is like a post card.

Public key cryptography has a known weakness in that it is subject to a man-in-the-middle attack if you are not careful about making sure that the public key you use to initiate a session is actually the one belonging to the party you wish to communicate securely with. Philip Zimmermann, the creator of PGP, solved this brilliantly with the concept of the “web of trust” based on digital signatures on keys for which you, or someone you trust to do it right, has verified the identity and ownership of a public key. It is brilliant except for its asking people who spend much more time watching TV than reading about math and cryptography to care about key signing, let alone understand it. With SSL and TLS, the method of certifying key ownership is a more centralized system with a strict hierarchy of trust. It is worse in that failure in the security of just a few agents could essentially compromise the security of major portions of the secured Internet, but better in that average users need not understand much about how it works or do much to make it work.

To truly be immune to a man-in-the-middle attack with SSL or TLS, however, you need to (1) have a secure web browser and email client on a secure computer, (2) know what to look for in terms of security indications, like the padlock icon that is part of the web browser and not part of the web page, (3) set up your email client properly for SSL or TLS email, and (4) heed any security warnings you get.

That last one was a problem for us on our secure contact form until last week. You see, getting a security warning could mean that a man-in-the-middle attack was in progress, but it also could mean that I didn’t spend lots of money to get a rich corporation to verify my server’s key each year, digitally signing it so that it could be verified with one of the digital certificate authority credentials built into the common web browsers. Another solution was to create my own certificate authority and ask everyone using my site or email servers to import my certificate authority credentials into their web browser and/or email client. However, I found cert.StartCom.org, a service on the web that would act as a certificate authority for free, and which already had its credentials built into the most recent version of several web browsers, including my favorite, Firefox, as well as Safari, Konqueror, Seamonkey, Mozilla, and a couple others. Microsoft Internet Explorer and Opera users still have to install the StartCom certificate authority credentials to gain the full security benefit, but that beats starting from scratch with all of the browsers.

Now, people who use a browser with the StartCom certificate authority credentials in them (either pre-built or installed later) can use our web contact form without getting a security warning. It is important to get rid of the false alarms, so that people can recognize when a real attack might be under way. That form is a much more secure way to contact us than via regular email, because the message is encrypted in transit from your browser to the server via SSL, and from the server to my computer via Gnu Privacy Guard (GPG). Of course, my reply to you would be unencrypted once it leaves my email server, but even having a one-way secure line of communication is helpful.

You might wonder what that vulture picture has to do with this. Actually, not much, except that it was flying over the JAARS Center, which is the same place where I saw a computer security demonstration of how easy it is to pull off a man-in-the-middle attack, thus inspiring me to get a properly signed SSL certificate on several of my web sites, including eBible.org and cryptography.org.