Protect your Email: Signing and Encrypting


What is this about?

Encrypting an email means exactly what it says: none other than the recipient of the mail should be able to read it. For this, the sender and the recipient need to agree on a way to do this, usually using products like GnuPG and Enigmail (these products are Free Software and are available for most computing platforms including Linux, Apple MacOS and Windows.)

With the same products, a sender can also sign an email. This means that the recipient can verify that nobody has modified the message since it was sent. A signed (but not encrypted) email is readable with a normal email client, so it is perfectly fine to sign all outgoing email. Recipients without the necessary software obviously won't be able to verify the signature.

Why do it?

Normal email is unprotected. Anybody with access to a system between the sender and the recipient (most of the time this includes several large corporations, government agencies etc.) can potentially read and modify the email. Even if you don't plan a revolution, you probably don't want your email be scanned for keywords, even if it only happens “for statistical purposes”, to customize what ad banners are shown to you.

Why not do it?

With encryption, the main problem is that sender and recipient need to have an understanding of some kind: other than having the necessary software installed, it is also necessary that the sender has got the recipient's “public key” file. Since today, people are likely to read email on all kind of devices, and perhaps also want access to email from internet cafes etc., having access to the email decryption key in all these places can prove to be difficult.

Signing emails does not interfer with the recipient's ability to read it, so there's less of a barrier. The only downside is that since it's not possible to (undetectably) modify an email after it has been signed, it is also practically impossible to claim after the fact that the author has not written an email. Usually, this is not a problem, but it is something to be aware of. (The correct term is non-repudiation.)

How do it?

The title page of the Enigmail home page is a good starting point. There also is a Wikipedia Article on email encryption, with a collection of links.


©2011, Adrian von Bidder,