0

What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts?

Use case, both of parties use third party email services, like gmail/hotmail/protonmail, to connect in the first place, most likely will continue using email (after we have a video chat to confirm we are who we are）for the rest of the communication. Just feel like email seem the best for online where we are not locked down to an APP. Now need to learn the confidentiality and integrrity parts.

Improve this question
4
  • 1. What exactly do you need to do and do you really need to use mail for this in the first place? 2. Neither PGP nor S/MIME are about privacy, they are about confidentiality and integrity.
    – Steffen Ullrich
    Jun 17 at 4:38
  • Ok, privacy is not focused. Use case, both of parties use third party email services, like gmail/hotmail/protonmail/yahoomail, to connect in the first place, most likely will continue using email (after we have a video chat to confirm we are who we are）for the rest of the communication. Just feel like email seem the best for online where we are not locked down to an APP. Now need to learn the confidentiality and integrrity parts.
    – user294265
    Jun 17 at 4:46
  • With both PGP and S/MIME third parties (like the mail providers) can observe who is communicating with whom and how much - they only cannot see the actual content or manipulate it (apart from blocking). So no privacy here, only confidentiality and integrity. If you want privacy then email is the wrong way.
    – Steffen Ullrich
    Jun 17 at 4:53
  • @Ghedipunk: Please don't add additional confusion by claiming OTP being the most secure since this might result in the OP asking how to do OTP with mail. This statement is only true in the very limited use case of doing encryption with an already exchanged key - and thus does not really reflect the situation the OP is asking about. In practice (i.e. the scope of the question) the same trade-offs need to be applied for OTP too, i.e. the problem is how to exchange the key in a secure way.
    – Steffen Ullrich
    Jun 17 at 6:35

1 Answer 1

Reset to default
1

There's no simple answer to that. In terms of algorithms, OpenPGP and S/MIME are roughly equivalent. And both standards have similar flaws that can be a problem under specific circumstances.

The main difference is the trust model: In OpenPGP, you rely on a decentralized Web of Trust or personal trust. This means you either arrange a meeting with the person you want to communicate with, so that you can directly verify each other's public key. Or you rely on somebody else to do the verification for you in a friend-of-a-friend way: If you trust some person or organization A, and A trusts B, then you may decide to trust B as well (and so on). S/MIME, on the other hand, relies on central, hierarchically organized certificate authorities (CAs) which verify keys and act as trusted third parties. For example, a company may run its own CA to issue S/MIME certificates for its employees. Whenever two employees want to exchange mails, they can do that without having to personally meet or build a Web of Trust, because they can both rely on the company CA.

Which model is more appropriate depends on you and the person you want to communicate with.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .