2

I was thinking about using a secure email service. So, I read about it. And it feels completely useless for me personally.

Almost everyone that I exchange emails with, don't use PGP or any kind of encryption. Most of them uses Gmail. So, me having PGP encryption doesn't matter. I will have to send/receive plain text emails with everyone.

I don't think average person will be able to learn to generate key and send an email. It's not as simple as using an encrypted chat app.

Improve this question
1
  • 4
    Chicken and egg problem: if everyone around you say exactly the same "no one around me uses encryption" then of course noone will use it. Note that there is also two parts in fact: authentication and message confidentiality.
    – Patrick Mevzek
    Commented Dec 28, 2017 at 14:31

1 Answer 1

Reset to default
1

Encryption is one thing, authentication is the other thing. Encryption prevents somebody else except the intended receiver to read the e-mail. Authentication prevents somebody else from impersonating you.

In regular e-mails you use neither encryption nor authentication. This means that anybody can send you an e-mail claiming to be anybody they want. This introduces two problems:

  • A.) Somebody can see what you write
  • B.) Somebody else can claim to be somebody they are not

Now, you can argue that A.) isn't really that much of a big deal for your average person. So somebody else on the internet can read your e-mails. Not a big deal. However, B.) is much a bigger deal even for an average person.

Somebody can send a nasty e-mail to your boss claiming to be you potentially resulting in you being fired. Somebody can write threats to somebody claiming to be you potentially having legal consequences for you. Basically, anybody can write any e-mail as you.

However, this issue is partially mitigated by servers checking whether the e-mail comes at least from the domain as mentioned in the From:. Such as, if you send an e-mail to a google mailserver using From: [email protected] google will perform a reverse lookup on the IP (of the sender) and check whether this matches me.com and it will also check if you have MX records for your domain (DNS). This prevents somebody at least from impersonating someone from another domain but google can't really verify whether it was truly hi who sent that e-mail. So, this is not a complete solution to the problem, it just mitigates it somewhat.

Generating keypairs isn't actually that hard it's just that a lot of e-mail clients don't have built-in supports for doing that but you need plugins and let's be honest - plugins are usually a usability issue. If you'd tightly integrate it properly into an e-mail client it would already be somewhat easier. However, you'd still have to solve the problem of who validates/verifies you. Theoretically, you could start employing a system similar to PKI for web but for e-mails using CAs etc. but that's probably not going to happen any time soon.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .