Skip to main content

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my pgpPGP key and publishing to the global server.

Let me know if you are doing a larger PGP implementation in a corporate. I have some good lessons learnt.

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my pgp key and publishing to the global server.

Let me know if you are doing a larger PGP implementation in a corporate. I have some good lessons learnt.

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my PGP key and publishing to the global server.

Source Link
Rakkhi
  • 5.8k
  • 1
  • 25
  • 48

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my pgp key and publishing to the global server.

Let me know if you are doing a larger PGP implementation in a corporate. I have some good lessons learnt.