According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for advertisement or other purpose like government! (Based on Mr.Snowden disclosure)

The idea of “end-to-end encryption” — you could also refer to it as “local encryption and decryption” — is different. With end-to-end encryption, the data is decrypted only at the end points. In other words, an email sent with end-to-end encryption would be encrypted at the source, unreadable to service providers like Gmail in transit, and then decrypted at its endpoint. Crucially, the email would only be decrypted for the end user on their computer and would remain in encrypted, unreadable form to an email service like Gmail, which wouldn’t have the keys available to decrypt it. This is much more difficult.

Is gmail or the other mail services doing this ? (Storing encrypted data in the database without storing it's private key)


When an email is encrypted, the private key which can be used to decrypt it must be somewhere. If the provider does not have it, then you, as a user, must store it on your machine. Furthermore, the decryption must then necessarily occur on your own machine. This will not work well (or at all) with a Webmail: Javascript code is ill-suited for such crypto jobs.

If you want to do end-to-end encryption, then you must:

  • user a mail application which includes the necessary cryptography;
  • convince the people who send you emails to themselves use a compatible application.

Indeed, if the mail is encrypted, then it was encrypted somewhere, using your public key.

This points to GnuPG along with the plugins which embed GnuPG in an existing mailer application (e.g. that one).

| improve this answer | |
  • Thanks for your answer. So all of the mail services (even Google, Lavabit & etc.) encrypt the data before storing them, but they also store the private keys (That's why they have access to their user's data). Yes? – Seyed Hamed Shams Jan 27 '14 at 15:15
  • It is unknown whether the mail services apply any encryption for storage. You cannot check for it as a client. They use encryption in transit when you read the email (that's what the HTTPS is about), but for storage, that's a complete unknown. IF they encrypt then they also decrypt upon reading, and they have all the relevant keys for that. – Thomas Pornin Jan 27 '14 at 15:31

Thunderbird with the GnuPG plug-in Enigmail is another option for traditional email. For webmail, one can just copy/paste to a stand-alone GnuPG app. It's tedious and somewhat error-prone, but it works. Also, I know of one provider, Countermail, that uses a Java browser plug-in to encrypt messages locally before sending. But Java browser plug-ins are notoriously insecure.

All of these approaches only protect message bodies stored by service providers. Message headers (e.g., "Date", "To", "From" and "Subject") may be encrypted in transit, by SSL/TLS for email or HTTPS for webmail. But they can't be end-to-end encrypted, because they're needed for message routing.

Providers only need users' public keys for encryption. They could encrypt complete messages, sent or received. And then users could decrypt locally in a web plugin, without disclosing their private keys. But I suspect that there's something unworkable about that, because Countermail etc aren't doing it. Also, message headers wouldn't be protected for recipients using insecure providers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.