What is the best way to send a secure email in PHP

Question

I wrote a PHP script which will run every Monday using cron. In this email I am attaching an XLS document which contains sensitive information. What is the best way to secure this email? Can I set a password on the XLS document? Can I encrypt the email and only allow the correct receiver to have authorization to open it?

I am using PHPExcel to create the XLS docuement, in case this helps.

Thanks for any help!
Metropolis

Answer 1

You could encrypt this e-mail with the recipient's public key/certificate using GPG or S/MIME.

This could be a good starting point: http://www.php.net/manual/en/function.openssl-public-encrypt.php

Answer 2

Encrypting the email is the most secure way to do it IMHO. If you have control of the server you can install GPG and call it from the command line to encrypt the email with a secret key. The downside is the recipient will require a plugin to their email client and the public key to decrypt the message with.

A slightly less secure way but easier on your end user is to send a plain email containing a link for the person to download the XLS file. The XLS file is then stored behind a password protected area. Use HTTPS to encrypt the page and the download. Additionally you could create a one time HASH using MD5, or better, SHA256 that is generated by the PHP script and stored in a database in relation to the file. Send that as a link parameter and have it expire. That makes it much more difficult for an unintended person to access the link.

The second method also has the benefit of being available on any host that will let you do SSL. No need to have special access to the server.

Answer 3

PHPExcel don't support passwords (yet) and AFAIK passwords on Excel files are not 100% secure (only Office 2007+ are good at securing files). The best way would be to encrypt the file before attaching it to the email and then decrypt it after you receive it. If you can encrypt it with GnuPG under your PHP installation (see this) there is a plugin for Thunderbird and Seamonkey mail clients called Enigmail which will automate the decryption process.