I use Gmail to exchange confidential and important documents with my customers. The documents are read by an unauthorized person (during sending the email) that I don't know him/her. How can I solve the problem?

  • Note that if your documents are definitely being intercepted (I can;t tell from your wording if they are or you suspect they are or you worry they might be) then you are facing a targeted attack, which is very serious, and you should get expert help. – Graham Hill Dec 12 '13 at 9:26

E-mail is not designed to protect the confidentiality of the information sent, hence additional security mechanisms are needed.

To ensure that only the specific recipient will be able to access the information sent, you could use public-key cryptography. A free and open-source implementation is GNU Privacy Guard (GPG).

GPG (and similar implementations) is able to preserve:

  • the confidentiality of information by encrypting it;
  • the integrity of information by signing it.

To get started, take a look at this GPG Cheat Sheet. I'd also suggest using specific add-ons, like Enigmail, that make it way easier to manage and use GPG.

It's important to notice that your customers must generate their own pair of keys (public and private), otherwise you won't be able to encrypt information to be shared only with them.

If this is not possible, you may have to rely on different (and less ideal) ways. A possible solution is to provide your customers with an FTP directory, where the data will be placed, and to share the password via other channels (e.g. SMS). Another solution, but not as secure as the previous ones, is to encrypt a zip file containing the information and send the password to the customer via SMS or any other non-email channel.

  • You say that 'E-mail is not designed to protect the confidentiality of the information sent, hence additional security mechanisms are needed.'. I have a question. As far as I know, Gmail uses SSL; So, Why do you say this? – j.mohsen.88 Dec 12 '13 at 8:49
  • SSL in this instance is one of the additional security mechanisms that Gurzo mentions - it is something Google have added on top of standard email to improve security. Importantly, it is not enough, because it can only protect the mail as it travels between you and Google - it does't protect the mail as it travels between Google and your client. – Graham Hill Dec 12 '13 at 9:22
  • @Gurzo, Why GPG instead of DKIM/SPF? – Pacerier May 23 '15 at 12:11

You can use GPG or S/MIME to encrypt the contents of the email before sending it to your customers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.