Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access built into most of the publicly available email services like Gmail, Yahoo, etc. Even if I'm using PGP to encrypt my personal emails, there are other factors to consider like Geo-IP tracking, etc.

Honestly, I'm quite paranoid about security & privacy. Although I have nothing to hide but I don't feel comfortable with the idea of other people reading my personal emails. Also most people that I have to deal with on a regular basis are non-technical users and they probably haven't adopted the PGP encryption scheme for handling emails.

So, considering all of this and to be more specific here are my questions:

1) Other than PGP are there other ways to send & receive encrypted emails between contacts that are automated & convenient at the same time? If not, are there any good ways to get a non-technical user started into PGP?

2) Are there reliable options for secure instant communication online (text and voice)? Most chat & VOIP services like Facebook, Skype, etc. are backdoored.

3) What is the best approach when you're trying to share your PGP public key with your online contact?

share|improve this question
2  
Person who down voted me without a comment is clearly working for the NSA ;) –  irenicus09 Jun 11 '13 at 13:31
4  
I downvoted the question because I believe it's not up to the website's standard which requires practical answerable questions. Your first question is a product recommendation which is also debateable. The second answer is also open for debate. 3,4, 5 are answerable. –  Lucas Kauffman Jun 11 '13 at 13:33
2  
Exactly, you are asking about opinion which is explicitly forbidden by the FaQ security.stackexchange.com/about –  Lucas Kauffman Jun 11 '13 at 13:39
1  
Read before you post, that's why we have this section. –  Lucas Kauffman Jun 11 '13 at 13:49
1  
In point 3, you ask about sharing your private key, do you mean your public key, since you probably shouldn't be sharing the private key :-p –  Tinned_Tuna Jun 11 '13 at 13:57
show 3 more comments

closed as off topic by Lucas Kauffman, NULLZ, Terry Chia, Adnan, Gilles Jun 11 '13 at 17:21

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

  1. PGP/GPG is the defacto standard, getting a non-technical user started can be done. Take into consideration that there are applications that can hemp the non-technical user, but the user must become more security aware if he does not one to leak his private key.
  2. There is a tool called Silent Circle which was created by Phill Zimmerman, the man behind PGP, just for this use-case
  3. attend a key signing party (this is an event at which people present their PGP-compatible keys to others in person, who, if they are confident the key actually belongs to the person who claims it, digitally sign the PGP certificate containing that public key and the person's name, etc. This is one way to strengthen the web of trust)
share|improve this answer
add comment

Without using PGP or some similar client based system, the best bet is a trusted mail server on both ends that enforce TLS to be used for e-mail exchange. It may or may not be possible for TLS to be broken by a highly sophisticated attacker like the NSA using quantum computers at this time, but it would still be highly expensive and thus unlikely they would bother unless they had a reason to investigate you.

This isn't really a workable solution in most cases though as you need a trusted service provider on both ends and secure configuration from end to end. This is why PGP is the standard since it only requires each client to participate and allows clients to control their own security.

Unfortunately not everyone can run their own web/e-mail/cloud storage server. I'm glad I have the resources to do so, but that doesn't make it a solution for the masses.

As for voice chat, again, running your own encrypted communications is the best bet, but systems like RedPhone or Silent Circle (as Lucas Kauffman first pointed out) that allow for encrypted direct communication.

As for key exchange, either exchange the key and verify the fingerprint on a trusted connection or use a PKI (either trusted third party infrastructure or a web of trust) to assign a level of trust to the public key certificate.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.