3

If you're using a service that offers end-to-end encryption, what happens when you send an email to another non-encrypted email address? Let's say I write my email in ProtonMail and then send it to a Gmail account, is the email somehow encrypted in-transit?

Unfortunately I don't really know how to word my question any better than this, sorry if it doesn't make much sense. I guess what I'm asking is how secure encrypted email services are when only one party is using it. The way I understand encrypted email is that the connection between you and the server is secure, but as soon as the email departs to the recipient, I don't know what actually happens to all the previous encryption.

2

1 Answer 1

2

It depends on the design of a particular service, but if you send an email outside of a service providing encrypted emails it is subject to the same relaying mechanisms as every other email on the Internet.

This means you don't know and have no control over (and that's reason you want to avoid sending unencrypted emails in the first place).

Regarding ProtonMail it offers two solutions for encrypted communication with recipients outside the service (source Wikipedia, March 2016):

Emails sent from ProtonMail to non-ProtonMail email addresses may be sent with or without encryption. With encryption, the email is encrypted with AES under a user-supplied password and then stored on ProtonMail's servers. The recipient receives a link to the ProtonMail website on which they can enter the password and read the decrypted email. 

(...) ProtonMail added native support to their web interface and mobile app for Pretty Good Privacy (PGP). This allows a user to export their ProtonMail PGP-encoded public key to others outside of ProtonMail, enabling them to use the key for email encryption. 

In practice a test email (with both encrypted and unencrypted content) from @protonmail.com to @gmail.com email was sent directly between the two parties using encrypted and authenticated protocol ESMTP with STARTTLS:

Received: from mail2.protonmail.ch (mail2.protonmail.ch. [185.70.40.22])
        by mx.google.com with ESMTPS id e3si15787607wjn.27.2016.03.18.05.07.18
        for <________@gmail.com>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Fri, 18 Mar 2016 05:07:18 -0700 (PDT)

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of _________@protonmail.com designates 185.70.40.22 as permitted sender) smtp.mailfrom=________@protonmail.com;
       dkim=pass header.i=@protonmail.com;
       dmarc=pass (p=QUARANTINE dis=NONE) header.from=protonmail.com

This post also touches on the subject of encrypted email transmission.

2
  • So what happens when you chose not to encrypt the message? In what state does the email travel to the recipient? Over standard HTTPS?
    – Astrum
    Mar 18, 2016 at 7:23
  • Without encryption the email is not encrypted. It is relayed using protocols used by relaying severs. You have no way of knowing what exact means of transmission were used. However HTTPS is not an email routing protocol. SMTP is.
    – techraf
    Mar 18, 2016 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.