Slashdot Mirror
Do Slashdotters Encrypt Their Email?
An anonymous reader writes "Many years ago when I first heard of PGP, I found an add-on that made it fairly simple to use PGP to encrypt my email. Despite the fact that these days most people know that email is a highly insecure means of communication, very few people that I know ever use any form of email encryption despite the fact that it is pretty easy to use. This isn't quite what I would have expected when I first set it up. So, my question to fellow Slashdotters is 'Do you encrypt your email? If not, 'Why not?' and 'Why has email encryption using PGP or something similar not become more commonplace?' The use of cryptography used to be a hot topic once upon a time."
I think it's largely pointless anyway...
Most people (myself included) use a web based email client, where the plain text form of the email would be easily snatchable by the one party with any likely chance to actually intercept an email.
Cryptographic signing has a place, but even that falls into the cryptogeek fantasy realm, but If you're into that sorta thing.. you can always join the Debian community.
In our business, I routinely communicate with customers using s/mime mail. We set it up as part of the contract (not in the terms, just as part of the meet-n-greet kickoff), so anything related to the contract work goes through encrypted.
Crypto is our business... so it only makes sense.
I said no... but I missed and it came out yes.
I was negotiating a mortgage a few years ago, and the bank happily was transitioning from faxes to email. So I sent them all the somewhat sensitive docs they requested, encrypted by hushmail/web. I sent them decryption instructions out of band.
The pretty simple decryption procedure baffled the hell out of them, at first. Then they figured out it was a great excuse to delay the loan. After a few weeks they came back saying they couldn't follow the hushmail retrieval procedure because they had no internet access.
Finally I just faxed everything.
gpg: Signature made Mon Dec 19 21:46:40 2011 CST using DSA key ID 98EF9A49 ........
gpg: Good signature from
Not posting the rest, but you can get the name and email address from the signature. :) I'd be surprised if any spammers know how to do that though.
I wonder; if I am using gmail, and send an "email" to another gmail user -- both users are required to use https to connect to gmail, does that mean we're in effect using encrypted (RC4_128 according to gmail/chrome) email?
moox. for a new generation.
When it comes down to it, there is no one program that can truly automate good security. At some point, users cannot be spoon fed and have to do it themselves. CAs can be spoofed, trusted introducers can be hacked or bribed, and so on.
In reality, if you want security these days (I mean actual security, not some pretty spiffy lock icon promising security), then one will have to go out and pack your own parachute, just as people did in the early 1990s.
It is easier now than it was back then -- gpg and the commercial PGP versions can encrypt and decrypt clipboard contents, both Android and the iPhone have implementations of this. It also easier that the specter of encryption being outlawed is not over our heads as it was back in the days of the Clipper Chip.
So, it boils to a social issue more than technical now. Do people want to do proper keysigning gatherings, stick their PGP IDs and signatures on their business cards, and have this info as much a part of their contact info as their E-mail address and FB contacts? If we can get people to understand this and the concept of a web of trust, security in general will be much improved.
Unfortunately, even that's not easy enough for my mom. Nowehere near easy enough, in fact. In order to popularise encrypted email, you have to surrender the idea of out of band key exchange and the concept of web of trust. You also need a highly interoparable way to have it just magically work by default. One good starting place would be a "Public Key At URL" header standard in all email. If you had that, you can imagine a future scenario circa 2015...
Ordinary corporate email user alice@example.com fires up Outlook 2014. A key has been automatically generated for the user without them knowing it on the Exchange server. Alice sends an ordinary unsecured email to bob@othercorp.com without pushing any extra buttons. This is the first time they have corresponded. Alice's email client includes a header for public-key-location which states that her public key is stored at "https://exchange.example.com/keys/alice". Bob doesn't specifically check email headers, so he just sees a normal email in his inbox. He decides to reply. His email client sees that he is sending to an email address with a known public key location, so it downloads alice's key automatically, and uses it to encrypt bob's message to alice so that only she can read it. This fact manifests itself as a discreet "encrypt" checkbox in the compose email window of bob's mail client. He never needs to manually intervene in the process unless he wants to install a key manually, or actively turn off encryption. Most people would never specifically do that.
The technology for that kind of infrastructure has been in place for ages. But, there isn't a critical mass that want's it. The security die hards want a system with manual key verification, and user awareness and training. Microsoft might create something similar to what I describe, but it would only work with Outlook and be explicitly incompatible with anything that isn't an Exchange client. And, they would do all decryption server side with decrypted mail stores so IT can audit corporate email. The overwhelming majority of users just don't care. But, basically one of the big players (Microsoft? Google?) needs to create a whole ecosystem in one swoop, with a massive installed base automatically, in order to get any real traction.
And the rest of us tend to put anything important through a medium other than email. scp for files, ssh tunnels for random things, ssh and talk for nefarious conversations.
Actually, in a cursory search of my mail logs, it appears approximately 40% of all mail heading out of and coming into my server (Exim4) are using some form of encryption. Including Google, Yahoo, and Messagelabs. (We're a small independent hosting company, our customers are not particularly technically apt nor inept; mostly small-medium businesses.)
The answer to the original question for me is: no. I use TLS to talk to my own mailserver, but the only 'secret' stuff that I send over email (which still isn't very secret) goes to my business partner who uses the same server, and TLS himself.
That said, even that stuff's not 'super seekrit', as any business we have to do that would be considered important not to be intercepted we have other channels, or just getting together in person for.
There is also that: most of people I communicate with use GMail and as the message does not leave the server and server-client communication is over ssl, so it eliminates the third, unencrypted link in the communication chain.
As for GPG — only a small percentage of even IT inclined people I know have bothered to generate a key and setup encryption/decryption solution. Mostly those, that have to deal with very sensitive material from time to time.
Although there is a government issued smartcard that allows for a widely adopted solution for asymmetric encryption that has software mostly on every computer, which kind of makes the situation a little better (I don't have to get into details explaining about the encryption, public and secret keys or explain how to install the software). Keys are government-issued opensc compatible crypto cards, pubkeys are available online if you know a person's name. So in case of emergency I can always encrypt files with that, given that almost everyone has them now.
P.S. That is about Estonia.