Comments on: Help Key: How to protect your webmail with GnuPG and FireGPG

By: JLG

JLG — Fri, 27 Nov 2009 06:50:50 +0000

I’m afraid that’s a poor analogy. Google targets the ads you see based on the content of your email. In other words, they’re already reading your email (and so is their upstream ISP…your webmail or IMAP connection might be SSL-encrypted, but server-to-server SMTP connections typically aren’t). Google has already proven that it’s willing to sacrifice its users’ privacy if and when the government–any government–asks it to. Are you foolish enough to really trust them to protect your privacy? They (and whoever they’re in bed with) can read ALL OF YOUR EMAIL–except, of course, those emails that are encrypted with PGP/GPG.

By: Encryption Software

Encryption Software — Fri, 16 Oct 2009 15:49:48 +0000

This article reminds me of someone telling me to dress warmly before going out, which I do, but then hop in my car and turn on the heat, making my painfully composed outfit obsolete. Assembling this article in terms of my analogy, the painstakingly assembled outfit can be compared to the gnupg and firegpg encryption process and google’s supercomplicated mathematical algorithms are the heat in my car. The theoretical hacker would have to crack gmail’s algorithms to get into my email before he can read my information, which no one is able to do. Therefore, these encryptions would only be necessary if instead of my “car” I had a “bike” and instead of gmail, I used some cheap email server from the 1990’s.

By: kent

kent — Wed, 05 Aug 2009 06:15:28 +0000

for the right group of people this can be very helpful. encryption is not for everyone – only for those who have a real need – and it is a partnership that takes effort. good security will never be convenient.

By: Paul D the 1st

Paul D the 1st — Sat, 18 Jul 2009 12:12:38 +0000

Flawed. This defeats the whole point of using encryption and authentication in the first place.

1-you cannot decrypt using someone’s public key
2-what’s the point of encryption that only works between the hops of mail servers, and not between the users computers which are often the biggest and least protected hops?

Infrastructure is promoted by (at a start) awareness, so make everyone aware.

Otherwise, a nice idea which you should ask the developers of GPG plugins to implement. ;)

By: ashutosh

ashutosh — Wed, 24 Sep 2008 13:11:40 +0000

vegon’s advice seems more plausible to me :)

By: AW

AW — Tue, 23 Sep 2008 22:05:19 +0000

Man, let me tell you, Rich, if I weren’t illiterate I’d really let you have it!

By: Rich

Rich — Tue, 23 Sep 2008 16:58:00 +0000

Nifty stuff, Skippy. Shame the illiterate people got here to comment first. Yes, it’s complex, and you did a good job of explaining it such that it’s understandable to people who care enough about privacy to take the time to actually read it.

Fortunately, for the most part, folks too lazy to be willing to read a page of instructions generally don’t have anything worth saying in email anyways, so they’re probably not missing out on anything.

By: veqon

veqon — Tue, 23 Sep 2008 16:41:07 +0000

Encryption is a great idea, but I know most of my clients would not even try to set it up. Palin’s account was hacked through password recovery. Use nonsensical answers on the questions used to establish an account. “What was the name of your first pet?” Use something like HtwoO here or georgeBush. “What city were you born in?” Not Kansas City, use Audi or Sun. Try not to get hacked in the first place.

By: Anon

Anon — Tue, 23 Sep 2008 15:12:22 +0000

You can forget about Google doing this. How would they know which ads to show you if the message was encrypted? Just like Chrome won’t block ads, Gmail won’t encrypt messages.

By: Kaj Kandler

Kaj Kandler — Tue, 23 Sep 2008 14:27:17 +0000

You do not get the schema. In order to send encrypted information to someone you need to have the recipients public key.

If you encrypt something with your own key and publish the public key, then anybody can retrieve the public key and decrypt it (zero security).

If you guest want secure encrypted message from you, they need to have their own private/public key. If you encrypt the message with their public key, they are the only person to be able to decrypt it, because they are the only one that have the private key.

By: Kaj Kandler

Kaj Kandler — Tue, 23 Sep 2008 14:20:04 +0000

Gee, I did not know about the Firefox extensions. For those that love convenience, use HushMail (http://www.hushmail.com/) and get all this in one package.

For those that live still in the stone ages of desktop apps, use Thunderbird (http://www.mozilla.com/thunderbird/) and Enigmail (http://enigmail.mozdev.org/)

And if you want to eliminate spam, go and sign (not necessarily encrypt) every message you send. Then spam filters (http://search.cpan.org/~brondsem/Mail-SpamAssassin-Plugin-OpenPGP-1.0.4/lib/Mail/SpamAssassin/Plugin/OpenPGP.pm) can be sure it is your message and filter (pass) accordingly.

By: Stephen Paul Weber

Stephen Paul Weber — Tue, 23 Sep 2008 14:02:36 +0000

One problem with this post is the focus on Windows. On most linuxes, installing and configuring GPG is easy and can be done from a GUI. The low hanging fruit there is key verification (which is unmentioned in this post).

On Mac, there are just a few apps to install (the one installer and one DMG) to get full integration into Mail.app
Thunderbird on Mac/Linux is also not too bad.

The problem is that gpg on windows is that few nice UIs have been written.

By: Stephen Paul Weber

Stephen Paul Weber — Tue, 23 Sep 2008 13:57:52 +0000

The only other ways are PKI (which requires a CA to be involved – blech) and Symmetric encryption, which encrypts to a passphrase. GPG can do symmetric encryption with FireGPG or any other tool :)

By: Minh N.

Minh N. — Tue, 23 Sep 2008 13:41:03 +0000

This process is a little too unwieldy for regular use with the exception of mom’s top secret lasagna recipe.

At work, we do encrypt quite a few e-mails but I would guess it is less than 1%. We do use keys for file transmission via SSH, and sometimes we even encrypt the file too.

By: F. D. Bryant III

F. D. Bryant III — Tue, 23 Sep 2008 12:44:11 +0000

The problem with email encryption is that your recipient has to be able to de-crypt it. This means that they must get your public key and then use it to de-crypt it. Until we develop a system where public keys are retrieved and cached automatically and transparently email is going to remain a largely clear text activity and never a private means of communication.

Another problem is we do encryption at the wrong level for just using as a method of secure (if not necessarily private) point to point communication (which is why it cannot replace fax machines). It should be possible to form an email address with a flag to encrypt an email during transit – for instance instead of example@example.com you would send it to example@$example.com. This would tell your SMTP server that you wish this message to be encrypted. Your SMTP server would check a cache of public keys to see if it has the one for example.com. If not it would then contact SMTP server (or perhaps a key server) for example.com who would send your server its public key (perhaps via SSL as a verification method). Your server then encrypts the message and sends it. When example.com receives the message it decrypts it and the puts it in the mailbox for the recipient. This would provide method of secure communication across the Internet that is transparent and easy to use by the average user.

We have the technology, just not the infrastructure.

By: Aaron Dragushan

Aaron Dragushan — Tue, 23 Sep 2008 12:00:30 +0000

Absolutely. But until they do, you won’t be encrypting your mail as suggested here because it ALSO requires all your buddies to bother with it on their end. fail.

Love the idea, but until someone makes it easy on both ends it’ll never take off.

By: Castle Steps

Castle Steps — Tue, 23 Sep 2008 11:36:28 +0000

I work at a hotel in Prague, and we are currently searching for a way to encrypt e-mails that we send to our guests. These e-mails include sensitive information about our guests, so obviously we need a secure way to send this to them. However, this seems much too complicated as it would require our guests to use the public key which we give them. Does anyone know of any other software that we can use which will still encrypt the information on our end, but not require our guests to do anything more than open their e-mail (as many of them only speak a little English, so these instructions would be impossible for them to understand)? Is there an e-mail service we can use which has very secure encryption?

By: Mike

Mike — Tue, 23 Sep 2008 08:44:47 +0000

Nice post – take no notice of the “reading challenged”.

By: Ron

Ron — Tue, 23 Sep 2008 08:40:41 +0000

‘gpg -–gen-key’ (not ‘gpg –gen-key’). Please fix that.

By: Snowyprincess

Snowyprincess — Tue, 23 Sep 2008 08:19:00 +0000

Nice job…but pretty complex!!!