I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In addition, the press releases of the last time may have encouraged people to think about their safety a little more.

What is the best way to tell people that I am capable of encrypting emails using the OpenPGP standard?

Possible solutions could be:

  • Sign each outgoing mail

    However, this will always produce a lot of text even for a small message. This would definitely annoy me if I do not know anything about it or if I don't care.

    Hash: SHA256
    Hi, yes that is okay.
    [ a lot of stuff ]
    -----END PGP SIGNATURE-----
  • Include a text in the signature of the mail

    One could write something like:

    Please note that unencrypted emails can be easily intercepted and read by third parties. For transmitting confidential information please consider encrypting your emails. My PGP key fingerprint is XX XX XX XX XX XX XX.

    Are there any suggestions on how to write that more precisely while keeping it short and sweet?

  • Asking them directly to encrypt their mails

What are the pros/cons of each solution and how can you show people that may it takes less than five minutes to install an appropriate browser plugin and to generate a key pair with it? Should I offer them that I may possibly assist?

  • This is a decent question but you should draw it in to avoid opinionated answers. For instance, ask for pros/cons instead of 'what is the best way'. Also, you may want to add who your target audience is and some more case specifics... Commented Sep 12, 2014 at 13:28
  • This is more kind of a general question. My audience could be (almost) everyone. I'm working at an university and cannot foresee who is (willing to) using encryption.
    – MrD
    Commented Sep 12, 2014 at 14:11
  • 1
    Even better! I used to work at a public university and so I placed a notice in my emails stating that they are public records. The same concept could be used here. Just place a "This correspondence is insecure, to secure it go to www.university.edu/people/yourname/email-encryption" (most universities have a place for staff/faculty webpages and if not, just link to a public domain). Commented Sep 12, 2014 at 14:18

3 Answers 3

  • Signing mails is in my experience the best method to show others they can send you encrypted mail. If they're using OpenPGP anyway, their mail client might even automatically enable encrypted mails as replies to signed ones. Recently I was very surprised receiving (S/MIME) encrypted mail from both a bank and a health care institute, just because I signed the mails I sent them.

    You don't need to (and shouldn't do anyway) use clear text (inline) signatures (with all their bulk), although they're a very present hint you're accepting OpenPGP encrypted mail. It might be of interest using this if you especially want to prompt others sending encrypted mail, your capability of doing so, or just make them curious... Instead, there is also PGP/MIME, which will not distract anybody (but I think users of MS Outlook might see some attachment they don't understand), but still offer the advantages to other OpenPGP users described above.

    Always signing mail (using PGP/MIME or S/MIME) produces some background noise, but doesn't disturb and nobody has to care about a few additional bits in each mail, and you might get awareness for signing and encryption into the subconscious mind. Worked out for me pretty well, I got quite a bunch of people around me to sign and encrypted mail this way (or do it again, and regularly).

  • Put your fingerprint into your signature and on your business card. Expect to get asked about it, and be ready to explain what that's all about.
  • Put your public key on keyservers. Lots of mail clients with support for OpenPGP automatically query them, especially after receiving signed mail.
  • Talk to others. Request them to send confidential information encrypted. Encrypting mails is rather easy, the sender doesn't even have to create his own key pair. Guiding others is rather easy even on the phone if you tried the most relevant plugins.
  • Consider also using S/MIME, even if it's "just" a CAcert certificate. Even if the certificate is not trusted, most mail clients support S/MIME out of the box, and replying with encrypted mail is much easier than with OpenPGP: no plugins required, and the certificate is automatically attached to your mail, the replying sender just has to click the "encrypt" button.
  • Note that there are also some trusted providers where you can get a free email S/MIME
    – SztupY
    Commented Sep 12, 2014 at 16:08
  • I'm surprised that Outlook shows a confusing mess for S/MIME; since I know it supports signing or encrypting email via smartcards. Commented Sep 12, 2014 at 20:56
  • 2
    Not for S/MIME, but OpenPGP/MIME seems to puzzle it (well, there's an attachment containing the signature; probably its more the user that is puzzled). Systems that I observed getting puzzled have been some customer relation management systems, if I signed my mails to some companies, they couldn't read any attachment any more.
    – Jens Erat
    Commented Sep 12, 2014 at 20:59
  • Just to be curios, shouldn't it be possible to add the PGP version as alternative, instead of multipart? (Or cann't outlook handle this correctly?) Commented Nov 17, 2014 at 2:03
  • 1
    I use inline signatures for almost everything as a way of proselytizing, not necessarily for message integrity. If I start getting signed or encrypted email back, I use Enigmail's per-recipient rules to switch to PGP/MIME on the theory that the recipient (or recipient's email client) will know what to do with it.
    – Bob Brown
    Commented Nov 17, 2014 at 13:47

Including your PGP key fingerprint in the signature is not a good solution because there's no way to verify the identity of the person sending the message. It provides a bad example of what PGP is intended for. Including your PGP fingerprint on your business card is a reasonable way to handle fingerprints.

A long signature describing the insecurity of regular email is reasonable if you're working professionally with sensitive data. E.g., banking, accounting, lawyer, etc.

I would suggest that if you're dealing with a non-technical audience, to have a website with a secure submission form where they can use SSL to send you sensitive information. Hushmail or similar solutions can be used to do this, although they don't protect you from court actions or law enforcement.

Your post caught my eye though because of the nature of your encrypted message. PGP does not sign subject lines or headers, so this kind of message can be replayed and used against you. The only clue that this could be a replay attack would be the timestamp in the signature.


Mind if I borrow your car for the weekend?

Hash: SHA256

Hi, yes that is okay.


[ a lot of stuff ]



For this reason, and the reason you describe about the noisy messages, I don't regularly sign my messages.

  • 2
    I disagree that putting your fingerprint in an email is a good idea - it encourages people to think that a fingerprint delivered in this way should be trusted.
    – symcbean
    Commented Sep 12, 2014 at 13:58
  • 1
    I strongly agree. Not really sure what I was thinking this morning :-) I've edited my answer and drunk more coffee.
    – mgjk
    Commented Sep 12, 2014 at 14:14
  • 3
    Mandatory XKCD reference
    – SztupY
    Commented Sep 12, 2014 at 16:09
  • is gpg different from pgp?
    – J-Dizzle
    Commented Sep 12, 2014 at 16:16
  • 1
    GPG (Gnu Privacy Guard) is an alternative and mostly compatible implementation of PGP. GPG's existence and history is in part due to patent restrictions on PGP encryption algorithms. lists.gnupg.org/pipermail/gnupg-announce/2007q4/000268.html I've updated my answer to refer to PGP, because we're talkign about the PGP protocol. I'm only used to typing "gpg" when using the GnuPG program.
    – mgjk
    Commented Sep 12, 2014 at 17:09

In Outlook (not sure about other email clients), you can setup separate signatures for both the initial message and replies/forwards. I would suggest putting a message there and then simply omit a signature for replies (or just include the public key).

You can also include a small link for a user to read more about email encryption.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .