I’ve been trying to get people to encrypt their email, and send me encrypted email, since 1995 or so. Here’s why: email is cleartext.
What does “cleartext” mean?
Well, if your ISP is having you send your email out through port 25, you can do this. (I’ve done it myself to test my own mail server at work.)
That’s basically what happens, automated, when you send your email out through a client. So unless your ISP has you send your mail out over SSL (they’ll probably give you another port to use, like 465 or 587), anyone sitting between you and your ISP’s outgoing mail server can potentially sniff that mail. (Like, that malicious person at the free wifi hotspot you’re using.)
So, you have an encrypted connection to your outgoing server, or you’re using https to access webmail. YAY! People sitting between you and that server can’t sniff it.
(Note: It’s even worse if you aren’t encrypting the connection to your incoming mail server in a mail client. Your username and password are sent cleartext over the wires.)
Don’t relax yet. 😉
What happens next is that your outgoing mail, or SMTP, server goes through the same process with your recipient’s SMTP server. This connection may or may not be encrypted and you have no way of knowing this unless your ISP refuses to talk to other servers that don’t encrypt. (Posteo.de says they do that.) Then the mail is stored on a server disk unencrypted until you or the recipient access it.
This is where encrypting the contents come in. If I send someone an encrypted email, my outgoing mail server and their incoming mail server know that:
- the mail came from my email address
- the mail is addressed to their email address
- there is a cleartext subject line.
The contents, however, look like:
—–BEGIN PGP MESSAGE—–
Version: GnuPG v2
hQIMA7RxPzPiyyNTAQ/+INv2GhVp9fCdib7JkzmEis8jw2Qtoazrp5mXDxwRG9Qv
evYhcnY8GIcwkMvYRTMlFfmcS4D/iZTmvPfj9+fZ0piHUWC3zYUgXDIm77821edr
Hfs158zPmmrAbX2ZtsG3GfNnhkCZHQceKuD4pKCAuoa2tlkvNwYTCuWH6g741YyY
Dllci00n5WB1dlR0lhUMhx42jpLW5q2Gco42axqZ1sAPDBSII4+I24LSL5cYr98E
DAJq98T2SgSF2jtGCwBg+xmRFOt2UPPP5fhxz8UnmHbdiFdVXbF0Wb/FiAydXCOl
OqkEVhGraPG9kPs9otBkP469fHAXlnBifBdioHVIArzmrsvXQyeT4kfGgd5aLoAr
pAKuSQmaaEjRmu0rUyKB5NnfNzd4djyDeJA+iVfexSDz7xY8rSRAXWJjFcQmGEg/
+7xdpr/qK/VD9m8htF0Th6kLs2EV+3tlmjNwjC4Jlt3l9wpSHwno9rIFLZaka4Br
GgJ6sKbPC/4mzKhbJV+I4pMGvCnEbzeEwlGFWlAoPE1Vg4JO2oNVrjTAS6Y+qKLP
rDGRcwBqS9FbM94KLKx9WUgpV1FBXMG7uHDKfxIT75yfQXeOJ26GhCxNYjJuvvUn
vlQzGrVmn9XdpgnGngjXMMLyyPnPGzDSCTAMeIjlHO7s73iFc7Bzho3ucMNQJH7S
ZQGr4l0YcjlYu7b1Z12BFW+9v6wjVBJsha2KwwqK9ukFt4GK//Lymd3n8sVkCfot
JWOW+u0ArTiX/I1OAlGM7+1Qe8XUzuSADTOmSMbUYpY+W7o6V7dhNE3lTfEyChNQ
8V2kgbjn
=l7cD
—–END PGP MESSAGE—–
By the way, even though I’ve posted that to my blog, only the person who has the private key can read that.
This isn’t new technology. It’s actually old. The reason everyone isn’t using it is because it’s not set up by default, and because the people you email are probably not using it already and you can’t if they don’t. 🙁
If you’re a webmail user, there’s Mailvelope, which I haven’t used. For everyone else, Enigmail for Thunderbird is awesome. GPG4Win used to be kind of buggy but it’s gotten really good–I particularly like the “encrypt/decrypt clipboard” feature, which I’m using instead of Mailvelope for webmail.
Then, all you need is a recipient’s public key. (You always encrypt to the recipient’s public key.) The way it works, in short, is that each person has two keys: one public, one private. They give the public key to you and keep the private one a secret. Only the private key can decrypt something encrypted with its public key. So only one person can read what you’ve sent, and that’s the person who’s got the private key. (Here’s more.)
