How many of you use encrypted Email? - Page 1
Forum section: electronics / general

author: technix
author_rank: Super Contributor
timestamp: November 05, 2018, 08:24:58 am
content: If you don't know what encrypted Email is or what it does, readthis.I am extending this survey to both PGP/GnuPG and certificate-based S/MIME. I actually have both set up already, although only GnuPG is being actively used.p.s. Here is my key ID if you want to Email me using PGP encryption: EDF8CFAC. Search this on a keyserver and you will get my public key. Send me your messages signed too, so I can pick up your public key.

author: Bicurico
author_rank: Super Contributor
timestamp: November 05, 2018, 09:03:56 am
content: How can we be sure that this key is really yours? Your post could have been written by someone else.THAT is to me one of the issues with encrypted emails. The other is that 99% of other people have no understanding/need for encrypted messages and wouldn't know how to read/send them.Regards,Vitor

author: PartialDischarge
author_rank: Super Contributor
timestamp: November 05, 2018, 09:29:23 am
content: Email encryption it's like having a fax machine when no one else has it. Unless the big players, google, apple, microsoft decide that it is time for encrypted emails for everyone you're pretty much alone, and they don't seem that interested. And even then, the encryption method would be NSApproved so forget it.Don't kid yourself, even safe locks are forbidden in air travel

author: BradC
author_rank: Super Contributor
timestamp: November 05, 2018, 10:43:13 am
content: Quote from: MasterTech on November 05, 2018, 09:29:23 amI use distinctive cable ties. Let's face it, if they want to get in they'll have a TSA key anyway. I want to *know* someone has been in.I'm the same with email. I'm not after encryption, I just want it properly authenticated and validated. If it's too secure to email then it gets sent using one of a multitude of out of band secure transports.

author: bd139
author_rank: Super Contributor
timestamp: November 05, 2018, 10:55:13 am
content: Nope.Secure communications must go over a secure side channel.

author: madires
author_rank: Super Contributor
timestamp: November 05, 2018, 10:58:21 am
content: I'm using PGP/GnuPG for a long time and have received only a few encrypted emails so far. But on security related mailing lists I see a lot of emails signed with GnuPG. Today most people prefer some messenger app with e2e encryption.

author: tggzzz
author_rank: Super Contributor
timestamp: November 05, 2018, 11:13:47 am
content: Quote from: BradC on November 05, 2018, 10:43:13 amEven that has problems. In the late 90s one of my colleagues used to gleefully point out "my name is Donald Duck, and I have a digital certificate to prove it".OTOH, a hash will indicate whether it has been altered.Old adage: "If you think encryption will solve your problem, you don't understand encryption and you don't understand your problem". The same is probably true for blockchains.

author: pelule
author_rank: Frequent Contributor
timestamp: November 05, 2018, 12:02:13 pm
content: Encrypting ~50% of my mails (mainly business related or other confidential information)/PeLuLe

author: BradC
author_rank: Super Contributor
timestamp: November 05, 2018, 12:52:32 pm
content: Quote from: tggzzz on November 05, 2018, 11:13:47 amYeah, I probably wasn't as clear as I might have been there. Yes, by validation I mean signed hash to prove it hasn't been modified, and signed by a certificate I can verify. And by verify I mean the holder of said certificate has given me a physical copy of the public key and we've verified checked to make sure we both have the right USB keys and they contain the right certificates. If I've validated you and you've given me a certificate that says you are Donald Duck, that's ok as I still know that certificate came from you.The contractors sign-in book in Emirates Towers in Dubai has 5 years worth of weekly sign-ins by Mickey Mouse. Nobody ever batted an eyelid.

author: rt
author_rank: Regular Contributor
timestamp: November 05, 2018, 01:05:10 pm
content: PGP/etc just attracts attention.Steganography in cat/dog photo attachments is the only way to be secure.rt

author: Jeroen3
author_rank: Super Contributor
timestamp: November 05, 2018, 01:11:09 pm
content: Quote from: technix on November 05, 2018, 08:24:58 amYeah, that's why not. It's not normie friendly.

author: PartialDischarge
author_rank: Super Contributor
timestamp: November 05, 2018, 01:54:41 pm
content: Quote from: rt on November 05, 2018, 01:05:10 pmWe should also give homage to homing pigeons

author: technix
author_rank: Super Contributor
timestamp: November 05, 2018, 02:14:30 pm
content: Quote from: Jeroen3 on November 05, 2018, 01:11:09 pmFor normies, I would just instruct you to install GPG, generate your keys, and immediately send you a signed Email. The GPG plugin should pick up on that signature and download my public keys from a keyserver automatically, and in that Email I will ask you to reply. If all is good the reply would be signed with your key and encrypted with mine, which will allow both 1) check if it worked and 2) me getting your public keys.

author: MT
author_rank: Super Contributor
timestamp: November 05, 2018, 02:52:26 pm
content: https://protonmail.com/

author: madires
author_rank: Super Contributor
timestamp: November 05, 2018, 03:15:50 pm
content: Quote from: tggzzz on November 05, 2018, 11:13:47 amThe trust problem is solved by two methods usually. One method is to verify each others PGP key and passport. This works fine for people you meet. The other method is a chain of trust in form of signing organizations. A reliable and trustworthy organization checks your ID and signs your PGP key. The organizations do the same for each other and their keys are added as trust anchors. When I like to exchange emails with a person I don't know, I'll check if that person's PGP key is signed by an organization which is part of the chain of trust. This isn't 100% secure of course, but an acceptable trade-off, similar to the world of CAs for SSL certs.

author: tpowell1830
author_rank: Frequent Contributor
timestamp: November 05, 2018, 03:23:32 pm
content: Ok, where's NihaoMike showing us how we can get email encryption with Bitcoin?

author: cdev
author_rank: Super Contributor
timestamp: November 05, 2018, 03:49:46 pm
content: GnuPG is basically like using envelopes instead of postcards for your email.Quote from: MasterTech on November 05, 2018, 09:29:23 amCloud services, are not inherently private. "Encryption" doesn't apply in that context.Also the contents of mobile phones and email sent to and from them is unlikely to be truly private.Read their terms of service, if you don't believe me.GnuPG (openpgp compatible) encrypted text may be secure if one takes care to make it that way. I very rarely (almost never) have the need for that kind of security for encryption but its good to use for signing emails so they cant be modified. At times Ive tried to make it a practice of signing all my email. We all should start doing that again, just on principle."Secure" email services are of questionable value, IMHO, as others than the intended recipient could read them.

author: cdev
author_rank: Super Contributor
timestamp: November 05, 2018, 03:52:46 pm
content: How do we know which organizations are 'trustworthy'?In the current state of global capture, the ones claiming the loudest to be may quite well be not.Quote from: madires on November 05, 2018, 03:15:50 pm

author: coppercone2
author_rank: Super Contributor
timestamp: November 05, 2018, 05:02:19 pm
content: What the hell is attention? Maybe if your a spy pretending to be a dumbass. Using basic protection will keep alot of riff raff out. In some cases you might want to avoid using encryption but for most people it will keep out 99 percent of the garbage.

author: madires
author_rank: Super Contributor
timestamp: November 05, 2018, 05:37:11 pm
content: Quote from: cdev on November 05, 2018, 03:52:46 pmAs I've written, it's similar to the situation of HTTPS.

author: technix
author_rank: Super Contributor
timestamp: November 05, 2018, 06:48:15 pm
content: I wonder if you would trust government agencies. Here in Shanghai citizens and businesses can buy a hardware cryptographic token that has a certificate from a certificate authority operated by the government of the municipality of Shanghai, and in order to obtain such a device I need to apply for it in person with my photo ID.If you trust the government of Shanghai I can sign my PGP keys using that hardware token as a proof of identity. At least in Chinese laws this will also give my PGP keys almost the same legal power as the government-issued token, and documents signed with that PGP key will stand if used in court as if it is signed using that token.

author: coppercone2
author_rank: Super Contributor
timestamp: November 05, 2018, 07:59:51 pm
content: I think you can probably trust the Chinese goverment to keep your information private if your a good citizen and don't upset the party members. Oh, and if the party members don't feel like making some side money.Xinjiang and all..

author: PhilipPeake
author_rank: Regular Contributor
timestamp: November 05, 2018, 09:14:58 pm
content: A company that I worked for used S/MIME, with the Apple email client.It all worked well until Google (who's email they were using) decided to arbitrarily screw with some of the headers that are included in the S/MIME signature hash.The emails were still encrypted and worked, but always indicated signature problems.Google were not interested in fixing their standards-breaking ways (of course).You also had to hang on to old (expired) certs if you wanted to go back and re-read old emails (tech questions archive, for example).Eventually, they gave up.

author: MT
author_rank: Super Contributor
timestamp: November 05, 2018, 09:57:34 pm
content: Quote from: technix on November 05, 2018, 06:48:15 pmOnly if your a Han Chinese and "so called good citizen dancing to Xi and co tune", if Uighur and anything else minority your toast! How do we know you'r not a undercover MSS agent?

author: Bassman59
author_rank: Super Contributor
timestamp: November 06, 2018, 12:46:26 am
content: Quote from: technix on November 05, 2018, 08:24:58 amEncryption makes it more difficult for the Bad Actor to read your messages. But the email transport (SMTP servers) leaves a trail of breadcrumbs and metadata, and there is value in knowing who receives your messages.OK, that said, if you and your recipient use only one of the public free email services (Yahoo, GMail, etc) then that breadcrumb trail is less interesting, I suppose.I would use some other messaging mechanism if I wanted true privacy.

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 06, 2018, 04:18:02 am
content: Quote from: tpowell1830 on November 05, 2018, 03:23:32 pmI don't see how Bitcoin factors into it. Other than that SHA256 would be less usable in a message authenticity checking system due to the availability of hardware designed to brute force it. But even though mining crypto is technically a specific form of breaking crypto, the fear of cryptocurrency mining hardware being repurposed to break security hasn't materialized.I would say to just use some file encryption software like 7zip, which also works well to add another layer of security to cloud storage.

author: Halcyon
author_rank: Unknown
timestamp: November 06, 2018, 05:55:24 am
content: Quote from: NiHaoMike on November 06, 2018, 04:18:02 amIt most certainly has. GPUs and ASIC boards have been used for a long time already to break encryption. It's really nothing new.