1

I've build an (offline)app (HTML/JS). The app allows the user to write a report (event when he is offline). The data from the report is sent via the body of an email to the companies special email address. In the company I collect the emails via an access database that holds the emails inbox. Then the data is read by a python analysis app. The data (collected via a form in the app) is in a human readable format (JSON).

The email might be intercepted when an insecure connection is used (e.g. in an hotel). When this happens I don't want that the interceptor can read the data, therefore I want to have it encrypted.

This form-data-web setup is temporarily, for a test. I am unable to sent the form data back to the server via ssl. I realise this is not water tight and very secure. I can make a ssl connection when the users download the form.

My questions:

  1. How can I encrypt the data that is sent in the body of a mail ?

  2. How can I decrypt the data when I read the emails in my automated python email reader?

1

Short Answer:

Use GNUPG to encrypt and decrypt messages.

Long Answer:

Basically, you want to encrypt the data to avoid get stolen if some security flow, as I understood, come along. Nowadays, the best encryption for such purposes is to use PGP encryption (GNUGP as free implementation). It can be used in Python. (find python lib here, here) If you work on Ubuntu base system then you probably have it preinstalled, else check the GNU website for more info

The philosophy behind this encryptions is that it uses RSA encryption.

You will create two accounts. One for your machine and one for the server. The message can be encrypt with the public key of your company's account and decrypt with the same private key.

So you'll create a messsage, encrypt it with the public key of your server account, send it and decrypt it with the private key of the server account.

With that way if you get in a situation, like man-in-the-middle attack, the attacker can not decrypt your data. But just to point out, if you want a better security check, you have the possibility to verify the messages every time that get to the server just in case someone change your message.

To sum up, I won't tell you more, cause cryptoography is a hole class in universities and IT and would get us pages and time to understand it. I advise you to give a try in google, searching about PGP encryption and ask someone who knows about cryptography.

0

If your email servers are properly configured to use SSL/TLS, you don't have to worry about encrypting anything. The email will be sent encrypted, nobody in the path will be able to decrypt it. Just make sure to not accept failed, expired or invalid certificates.

Now, your questions:

How can I encrypt the data that is sent in the body of a mail? How can I decrypt the data when I read the emails in my automated python email reader?

Use Public Key Encryption. Create a public/private key pair, and bundle the public key into your app. Encrypt the data before sending. In the server, use the private key to decrypt and store. There are a couple libraries in Python and Javascript to care care of that.

  • I don't think that using TLS provides end to end encryption for emails. So nobody in the path will be able to read it is incorrect. – Neil Smithline Nov 24 '15 at 6:25
  • @NeilSmithline you may be correct or not, depending on the way the application is written by OP. If the application access the company's mail server directly, without intermediates, the statement is true. Otherwise you are right. – ThoriumBR Nov 24 '15 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.