Is PGP combined with a regular web-based email service secure?

Question

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard services like Hotmail and Gmail for email purposes. However, is PGP secure enough to protect the content of a email from prying eyes and possibly government surveilance?

Basically, the path my "secure" email will take is as follows:

Trusted and logless VPN/Proxy - HTTPS - Hotmail/Gmail with PGP - recieving party

Will this setup provide enough protection and anoymity for both parties?

Answer 1

They key to PGP e-mail security is that it provides full end-to-end encryption. The "path" you describe is actually flawed, and in fact may be overkill depending on your needs.

Hopefully, the below overview will help you see how the multiple layers of security you are suggesting would be applied.

• You start with your e-mail.

  [Email]

• Your system encrypts the e-mail with PGP.

  [PGP [Email] ]

• Your system puts the package into a secure stream addressed to your e-mail provider. (We'll say SSL.)

  [SSL [PGP [Email] ] ] ]

• Your system sends that traffic to your trusted VPN gateway.

  [VPN [SSL [PGP [Email] ] ] ]

• Once traffic reaches the VPN gateway, the VPN gateway forwards it along to your e-mail provider through the open Internet. However, this is not part of your trusted connection to the VPN gateway.

  [SSL [PGP [Email] ] ]

• Your e-mail provider stores the message on their servers. Without intimate knowledge or agreements as to how the provider handles their data storage, you cannot assume that any additional encryption is used.

  [PGP [Email] ]

• When the E-mail provider receives your message, they send it along to the recipient's e-mail provider. However, you cannot be sure that their provider's servers require connection security to receive e-mail or that there is any encryption used on their at-rest data.

  [PGP [Email] ]

• The recipient contacts their provider's server to check their e-mail. However, you cannot be sure that the recipient's client software is configured to use a secure connection for this.

  [PGP [Email] ]

• The recipient finally decrypts the e-mail and reads it.

  [Email]

Strictly for the purpose of ensuring confidentiality of the e-mail message's contents, the VPN is essentially superfluous. In fact, so long as PGP remains unbroken and the keys you are using are trustworthy and un-compromised, every layer of security applied afterward could fail and the e-mail's contents would still remain protected in transit. You could be using an unencrypted connection to your e-mail provider over the clear Internet, from the sketchiest of coffee house hotspots, and your e-mail would still be protected in its travels. That's the point of end-to-end encryption - it's made so that the transfer medium does not need to be trusted, especially because it cannot be trusted.

If you're looking to additionally provide anonymity, then the VPN does have a purpose. However, to be fully effective, this requires that you do not provide any Personally Identifiable Information (PII) to your e-mail & VPN providers (E-mail headers still have to be sent in the clear, and you cannot trust the path between your VPN provider and the recipient. Your e-mail and/or VPN provider may therefore be forced by court order or other coercive measures to reveal your account info & connection logs.) and that you do not do anything over the VPN connection from which your PII can be directly obtained or inferred.

Of course, all this protection also relies upon yours and the recipient's systems being secure. If either system is compromised, all bets are off anyway.

In the end, you should always remember Law #9.

Answer 2

PGP, GnuPG and S/MIME are all good choices for encrypting email data. They use publicly known, strong encryption algorithms such as RSA for encryption and digital signatures.

In today's context, it is probably impossible to bruteforce emails encrypted with any one of the three schemes even with the resources of large entities like the NSA. Of course, there are speculations that this might be untrue but so far, they are just speculations.

Let's get one thing clear though, while schemes like PGP will protect your email's confidentiality, it will not provide anonymity. You still have to direct your messages to a specific email address. PGP also requires you to exchange PGP keys with the person you are trying to communicate with. This may or may not be a practical thing to do. There are concepts such as the web-of-trust that attempts to remove this hassle, but I don't see many people relying on it in the real world.

With that being said, it is probably the most reliable way of securely encrypting email messages that exist today.

Answer 3

Short answer is yes, PGP is "secure enough".

The point of end-to-end cryptography, as PGP (or S/MIME) implements, is that it abstracts away the transport mechanism. When you use PGP, the email is encrypted on the sender's own machine, and is decrypted on the recipient's machine. Whether the email got through HTTPS, a VPN, one, two, or seventeen proxies, or was patiently memorized and then repeated by a travelling buddhist monk, has no importance whatsoever. That's the whole idea of such cryptographic tools.

Note, though, the following:

• Both PGP and S/MIME suppose that there is some rather complex software on both the sender's and recipient's computers. Such software is easily obtained (e.g. GnuPG in the case of PGP), but this means that it won't integrate smoothly with Webmails. A "Webmail" is an email interface within some Web pages; on the user's side there is only some Javascript, which lacks the power and functionalities for reasonable PGP or S/MIME support (in particular private key storage).

• For the email to be secure against active attackers (as opposed to passive eavesdroppers who listen but never interfere), the sender must make sure that he uses the correct recipient's public key. S/MIME does so with X.509 certificates, which are a centralized, hierarchical PKI. PGP relies on a decentralized system called the Web of Trust. Both systems have advantages and drawbacks. What really works is a one-time face-to-face meeting between sender and recipient, so that they may give each other copies of their public keys (it also works with a phone call, though).

• PGP and S/MIME both guarantee confidentiality and integrity of email contents, but they do nothing to hide the fact that an email was sent. Eavesdroppers can still do traffic analysis to know who is talking to whom.

• PGP and S/MIME cannot guarantee delivery. Active attackers can still intercept emails and drop them.

• If your own government is against you, specifically, then they already have installed a concealed webcam in your home, near the ceiling, with a good view on your computer screen. Or, at least, you should assume it. Remember that spying is not a game; there are no rules and no notion of cheating.

Answer 4

Depends on what you mean by "enough" -- any cryptographic algorithm can be brute forced with enough computation resources, and the agents you seem interested in evading have a ridiculous amount of computation power at their fingertips, and are continually increasing that amount.

Also, several of the cipher suites used by PGP have theoretical or practical weaknesses that can reduce the effective cryptographic strength of the algorithm. Let's enumerate them:

• MD5 is extremely weak, even in practice, and it is used in PGP as a cryptographic hash.
• SHA-1 has known theoretical weaknesses and it is also used as a cryptographic hash.
• RSA, while it is still relatively secure as far as practical bits of encryption is concerned, is starting to show cracks in its armor, as evidenced by this article.
• ElGamal is vulnerable to the Chosen-ciphertext attack.

In short, PGP, GNUPG, etc. are only as secure as you believe the cryptography system to be. At present, the publicly-available, non-patented cryptographic ciphers in common use worldwide, and specified by standards bodies, are showing serious signs of being either immediately decipherable (in a matter of days/weeks) by advanced persistent threats with extensive resources, or will be decipherable in that amount of time within 5 years.

PGP has the added disadvantage that you have to securely exchange keys with your conversation partner ahead of time, which means that:

• Sending email to parties that do not use encrypted email is useless, because they will not be able to read it unless they participate in the system;
• Depending on how much you need to verify that the person you are emailing is really who they say they are, you need to be absolutely sure that you are not exchanging keys with an imposter. Some kind of exchange over an SSL tunneled connection (SSH, HTTPS, FTPES, etc.) could be okay, but the most obvious way to do this is in-person. Having to meet everyone you email in person could be too much work for most people though.

Answer 5

It's secure, but not perfect

PGP alone ensures privacy, but how you use it may introduce additional vectors for attack, which may compromise security.

The problem lies in the fact most email readers render HTML and that HTML can be exploited. PGP doesn't prevent the SMTP subsystem from being exploited unless you can safely extract the PGP MIME data.

Specifically, PGP messages as you describe are often not scanned for Viruses, Phishing, Malware, or other scams at the gateway. More often than not, the technology to protect the desktop user isn't as sophisticated, or out of date.

Since the SMTP body can have additional alt-text representations, and it's possible that the main text to be displayed may have an HTML exploit injected into the body. This can be done by any malicious relay, or hop in the middle.

To limit that exposure, I would recommend DKIM signing from a domain you control and forwarding that out a trusted MTA. Make sure the appropriate options are set (no -l setting, and do sign the header, subject and body)

Although a VPN and TLS for SMTP would help protect your message, it is a point-to-point security mechanism where all trust starts and ends between two nodes of the communication. (your MTA and Microsoft's MTA).

An improved solution

• Any of the following: PGP, S/MIME, GnuPG

• DKIM sign the message, on a TLD domain you control.

• Use antivirus and antispam countermeasures on the client, and make sure the client validates the DKIM blob before opening it.

• Use a VPN if you're sending email over a Wifi connection

Answer 6

I'll add another answer to this. PGP is 'theoretically' secure enough. But not 'practical' enough to use it. It is secure 'from end to end', which means the underlying mail-/internet-provider doesn't play a role in this. But this also means you need a secure end point to do the de-/encryption. The only machine considered 'secure' is a machine that

• you own
• no one else has or had physical access to
• is and never was connected to the internet
• uses only programs you fully trust
• processes only data that has been thoroughly checked

Do you own such a machine? I don't.

Things that definitely are not a secure end point:

• a public computer
• a smartphone
• a webbrowser on any machine
• a company-administered laptop
• any PC you surf the web with

So unless you have such a machine and print&re-type your encrypted mails into it, you have to take some additional risk.

Answer 7

No. It is not. When you're typing your message in a web browser for a web based email provider, there is typically an auto-refresh feature. This means that data is transmitted to google, yahoo, wherever - before it's encrypted.