Safe Email Viewing in Outlook

The most important part of safe email viewing in Outlook is the same as in Eudora -- social engineering -- your being careful. In fact, it's much more important in Outlook than in Eudora because, unfortunately, Outlook doesn't offer quite as many ways to protect yourself from your own mistakes.

You can turn off the Preview Pane: View -> Preview Pane toggles it on or off. The next item in the View menu, Autopreview, displays only the first three lines of messages, or of unread messages, depending on how you have it set up; don't use that either.

Now comes the problem. Your security choices in Outlook are tied to your security choices in Internet Explorer (at least). While you definitely don't want to execute Java or ActiveX in email messages, there are lots of Web pages that won't work properly if you don't allow them to run there. So you don't want to turn HTML executables off altogether.

I found a TechTV (http://www.techtv.com) Web page that had a really good idea on how to turn HTML executables off for Outlook but not for IE. They suggest setting Outlook up to use Window's Restricted Internet Security Zone, which in theory are sites that you don't trust at all. Turn off all the HTML executables for the Restricted Zone, which makes sense, and leave on whatever options you're comfortable with for the Internet Zone, which is mostly what Internet Explorer uses.

The instructions in the TechTV page are for Outlook Express. The real URL for the TechTV page is 76 characters, which is much to long for a printed page, but this "Tiny URL" will take you there: http://tinyurl.com/xlxa
(I went to http://tinyurl.com and had them make the URL tiny for me!)

Here's how to do it for Outlook 2000 and Windows 2000, which is what I happen to have. Your Outlook and Windows will probably be slightly different; that's the way it is with Windows.

In Outlook, select Tools -> Options -> the Security tab, select the Restricted Sites zone from the dropdown list and click the Zone Settings... button. A warning dialog box will open telling you that the changes you're making will affect Outlook and IE and so on. Click OK.

This opens the Web content Security box, figure 1. You can change the settings for any of the security zones here, but we're only working on Restricted Sites, which will already be selected. You'd click the Sites... button to add specific sites to the Restricted sites zone, but in this case it doesn't matter whether there are any sites in the zone or not; we're only concerned with the security settings for the zone. So click Custom Level....

Figure 1. Windows Security

This opens the Security Settings box, figure 2. Select Disable or Prompt for all the Active X, Java, and Scripting options. If you want to turn everything off, you can select Reset to: High and click Reset. Then click OK, OK, and OK.

Figure 2. Security Settings

And now for the bad news. There does not appear to be any way to tell Outlook not to download HTML images. In fact, Microsoft says that it can't be done. But a colleague pointed me to a column in TwinCities.com Pioneer Press that gives a way to do it that involves editing the Windows registry. "Workaround stops e-mail pictures" by Jeffrey C. Kummer, Pioneer Press columnist, http://tinyurl.com/ugs2

Modifying the registry is definitely not for the timid; if you mess it up, your whole computer might not work. Unless you're confident about what you're doing, please don't do it.