31

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In addition, the press releases of the last time may have encouraged people to think about their safety a little more.

What is the best way to tell people that I am capable of encrypting emails using the OpenPGP standard?

Possible solutions could be:

  • Sign each outgoing mail

    However, this will always produce a lot of text even for a small message. This would definitely annoy me if I do not know anything about it or if I don't care.

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    Hi, yes that is okay.
    
    -----BEGIN PGP SIGNATURE-----
    
    [ a lot of stuff ]
    
    -----END PGP SIGNATURE-----
    
  • Include a text in the signature of the mail

    One could write something like:

    Please note that unencrypted emails can be easily intercepted and read by third parties. For transmitting confidential information please consider encrypting your emails. My PGP key fingerprint is XX XX XX XX XX XX XX.

    Are there any suggestions on how to write that more precisely while keeping it short and sweet?

  • Asking them directly to encrypt their mails

What are the pros/cons of each solution and how can you show people that may it takes less than five minutes to install an appropriate browser plugin and to generate a key pair with it? Should I offer them that I may possibly assist?

  • This is a decent question but you should draw it in to avoid opinionated answers. For instance, ask for pros/cons instead of 'what is the best way'. Also, you may want to add who your target audience is and some more case specifics... – Matthew Peters Sep 12 '14 at 13:28
  • This is more kind of a general question. My audience could be (almost) everyone. I'm working at an university and cannot foresee who is (willing to) using encryption. – MrD Sep 12 '14 at 14:11
  • 1
    Even better! I used to work at a public university and so I placed a notice in my emails stating that they are public records. The same concept could be used here. Just place a "This correspondence is insecure, to secure it go to www.university.edu/people/yourname/email-encryption" (most universities have a place for staff/faculty webpages and if not, just link to a public domain). – Matthew Peters Sep 12 '14 at 14:18
26
  • Signing mails is in my experience the best method to show others they can send you encrypted mail. If they're using OpenPGP anyway, their mail client might even automatically enable encrypted mails as replies to signed ones. Recently I was very surprised receiving (S/MIME) encrypted mail from both a bank and a health care institute, just because I signed the mails I sent them.

    You don't need to (and shouldn't do anyway) use clear text (inline) signatures (with all their bulk), although they're a very present hint you're accepting OpenPGP encrypted mail. It might be of interest using this if you especially want to prompt others sending encrypted mail, your capability of doing so, or just make them curious... Instead, there is also PGP/MIME, which will not distract anybody (but I think users of MS Outlook might see some attachment they don't understand), but still offer the advantages to other OpenPGP users described above.

    Always signing mail (using PGP/MIME or S/MIME) produces some background noise, but doesn't disturb and nobody has to care about a few additional bits in each mail, and you might get awareness for signing and encryption into the subconscious mind. Worked out for me pretty well, I got quite a bunch of people around me to sign and encrypted mail this way (or do it again, and regularly).

  • Put your fingerprint into your signature and on your business card. Expect to get asked about it, and be ready to explain what that's all about.
  • Put your public key on keyservers. Lots of mail clients with support for OpenPGP automatically query them, especially after receiving signed mail.
  • Talk to others. Request them to send confidential information encrypted. Encrypting mails is rather easy, the sender doesn't even have to create his own key pair. Guiding others is rather easy even on the phone if you tried the most relevant plugins.
  • Consider also using S/MIME, even if it's "just" a CAcert certificate. Even if the certificate is not trusted, most mail clients support S/MIME out of the box, and replying with encrypted mail is much easier than with OpenPGP: no plugins required, and the certificate is automatically attached to your mail, the replying sender just has to click the "encrypt" button.
  • Note that there are also some trusted providers where you can get a free email S/MIME – SztupY Sep 12 '14 at 16:08
  • I'm surprised that Outlook shows a confusing mess for S/MIME; since I know it supports signing or encrypting email via smartcards. – Dan Neely Sep 12 '14 at 20:56
  • 2
    Not for S/MIME, but OpenPGP/MIME seems to puzzle it (well, there's an attachment containing the signature; probably its more the user that is puzzled). Systems that I observed getting puzzled have been some customer relation management systems, if I signed my mails to some companies, they couldn't read any attachment any more. – Jens Erat Sep 12 '14 at 20:59
  • Just to be curios, shouldn't it be possible to add the PGP version as alternative, instead of multipart? (Or cann't outlook handle this correctly?) – Johannes Kuhn Nov 17 '14 at 2:03
  • 1
    I use inline signatures for almost everything as a way of proselytizing, not necessarily for message integrity. If I start getting signed or encrypted email back, I use Enigmail's per-recipient rules to switch to PGP/MIME on the theory that the recipient (or recipient's email client) will know what to do with it. – Bob Brown Nov 17 '14 at 13:47
6

Including your PGP key fingerprint in the signature is not a good solution because there's no way to verify the identity of the person sending the message. It provides a bad example of what PGP is intended for. Including your PGP fingerprint on your business card is a reasonable way to handle fingerprints.

A long signature describing the insecurity of regular email is reasonable if you're working professionally with sensitive data. E.g., banking, accounting, lawyer, etc.

I would suggest that if you're dealing with a non-technical audience, to have a website with a secure submission form where they can use SSL to send you sensitive information. Hushmail or similar solutions can be used to do this, although they don't protect you from court actions or law enforcement.

Your post caught my eye though because of the nature of your encrypted message. PGP does not sign subject lines or headers, so this kind of message can be replayed and used against you. The only clue that this could be a replay attack would be the timestamp in the signature.

e.g.,

Mind if I borrow your car for the weekend?


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi, yes that is okay.

-----BEGIN PGP SIGNATURE-----

[ a lot of stuff ]

-----END PGP SIGNATURE-----


Thanks!

For this reason, and the reason you describe about the noisy messages, I don't regularly sign my messages.

  • 2
    I disagree that putting your fingerprint in an email is a good idea - it encourages people to think that a fingerprint delivered in this way should be trusted. – symcbean Sep 12 '14 at 13:58
  • 1
    I strongly agree. Not really sure what I was thinking this morning :-) I've edited my answer and drunk more coffee. – mgjk Sep 12 '14 at 14:14
  • 3
    Mandatory XKCD reference – SztupY Sep 12 '14 at 16:09
  • is gpg different from pgp? – J-Dizzle Sep 12 '14 at 16:16
  • 1
    GPG (Gnu Privacy Guard) is an alternative and mostly compatible implementation of PGP. GPG's existence and history is in part due to patent restrictions on PGP encryption algorithms. lists.gnupg.org/pipermail/gnupg-announce/2007q4/000268.html I've updated my answer to refer to PGP, because we're talkign about the PGP protocol. I'm only used to typing "gpg" when using the GnuPG program. – mgjk Sep 12 '14 at 17:09
0

In Outlook (not sure about other email clients), you can setup separate signatures for both the initial message and replies/forwards. I would suggest putting a message there and then simply omit a signature for replies (or just include the public key).

You can also include a small link for a user to read more about email encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.