8 ms·

Email Self-Defense – a guide to fighting surveillance with GnuPG

148 points by tjr 12y ago

atmosx 12y ago
I get and send ~ 10 to 15 emails per week. Not even 1 of my regular 'correspondence' uses GnuPG. It's too complicated to setup and even harder to use for avg Joe, like bitcoin, he has to spent time understanding totally new concepts. And no one is willing to do that, unfortunately :-(
- sssbc 12y ago
  ok, get info-raped by any and all then.
  - pyre 12y ago
    Consider this: 1. It's probably better to remain civil in your discourse if you want people to take you seriously, and not just dismiss you as a troll. If you really do feel so strongly about your position, then you're probably doing more harm than good to your cause by firing off such remarks. 2. I doubt that you personally communicate with everyone using encrypted email. If you do, your world is probably fairly insular (and you should probably consider expanding your experience to include communicating with people outside of your comfort-zone). 3. The most constructive response to the parent post would probably be a suggested plan of action. I'm sure that many here would be all-ears to even a decent framework for convincing the average person to use encrypted email.
    - dllthomas 12y ago
      It seems like teaching people to use GPG for the authentication is probably the first step. Sending to someone who doesn't use GPG then is still readable, and if you want to push the point with a particular person then every time they email you call them and say "I got an email, I wanted to be sure it was from you, since there was no signature..." Once you can count on contacts using GPG, the path to encrypting is much easier.
      - amirmc 12y ago
        I'd argue that getting address books to understand what keys are and how to use them would be more impactful. If I put public keys in my address book, which is nicely integrated with my mail client anyway, then sending encrypted mail should be far more straightforward. The problem then is getting people to use new address books.
        XorNot 12y ago
        Making the Thunderbird address book not suck would be a good firsr step in this regard.
      - atmosx 12y ago
        IMHO the problem is the NOT infrastructure per se, it's the theoretical part that is cumbersome. If you now why you are doing something, it's easy to understand why you should not save the 'key' in the "Keychain" or sign random emails. To use GnuPG correctly you need explain to average Joe concepts like: * PKI * Key signing * Web of trust * Revocation key The problem is that, as Einstein said: Everything should be made as simple as possible, but no simple. Same problem I can't talk bitcoin with most of my real-life friends. They are incredibly smart people, but they are not familiar with key concepts about BTC and don't wanna wrap their minds around it when we're hanging out having fun.
        borplk 12y ago
        I see what you're saying I think the same argument is being overly used to justify a lack of basic effort to learn anything about computing beyond 'click this shiny red button'. People just cry out to the programmers to "just make it easier". Well there's only so far you can go on the easy scale until you start sacrificing security and integrity. People need to learn some of the fundamentals and basics you can't run away from it forever. It's like someone saying "Mehh I don't like calculus ... why don't these mathematicians make it just easier? Why do I have to learn about differentiation? Make it so easy my grandma could differentiate this equation" Instead we force every kid to take the pain a bit and learn some damn basics. Same should go for computing. Schools could teach the kids the basics of protecting their communications on the internet. Give that 10 years and Public/Private key encryption is a piece of cake for every reasonably educated adult in the society and they are no longer buzzwords because everyone grew up with it and remembers their 8th grade when they learned all about it.
- sp332 12y ago
  It's true, Glenn Greenwald said that he almost gave up on Snowden's information because it was too hard to set up GPG correctly!
  - tptacek 12y ago
    He did give up on GPG, and instead used Cryptocat, at a time during which it appears to have been possible to decrypt Cryptocat conversations from network traces due to key generation bugs.
  - Create 12y ago
    http://vimeo.com/56881481 http://vimeo.com/56881481
- tptacek 12y ago
  I have walked non-technical people through the process of setting up GPGMail on Macs without much problem. I buy that GPGMail is hard to use reliably, and that its user interface is cryptic in ways that make it likely that users will slip up. I do not buy that GPG is particularly hard to get started with. Unfortunately, all the glamour and the money and the code seems to track vanity crypto projects, and not so much of it goes to projects that make GPG more usable for normal people. Kudos to Google for taking a stab at correcting this.
- hershel 12y ago
  Currently , the most practical way for secure communications looks like textSecure, which is a mobile IM app that is easy to use and install , and relatively easy to convince others to communicate in.
- belorn 12y ago
  A possible solution to this is private mail servers that encrypt and decrypt automatically for you. The idea that you go to the store, pick up a small box, and it will do all the security for you is the stated goal of freedom box (https://freedomboxfoundation.org/ https://freedomboxfoundation.org/). Once transparent end-to-end encryption that avg joe can use get traction, mail encryption will hopefully become default.
- warcode 12y ago
  Keybase.io is doing good work in making public key encryption more easily available. Except for the part where they want you to upload your private key to them. But that is optional.
- vog 12y ago
  I configured my parents' email program (Thunderbird/Enigmail) to automatically encrypt emails they send to me. Also, I encrypt all emails to them. They still don't really care, but at least my communication with them is encrypted. Also, they see that using encryption is not hard (once set up), except that they have to type in a password from time to time.
mapgrep 12y ago
The very first step, assuming you already have an email account, for all platform pages: >INSTALL THE ENIGMAIL PLUGIN FOR YOUR EMAIL PROGRAM I Googled Enigmail as I was not familiar with it. It is "a security extension to Mozilla Thunderbird and Seamonkey." This seems incredibly shortsighted. Tons of people out there are on Outlook, Apple Mail, Gmail, etc. and not interested in Thunderbird. There are other options, for example the surprisingly EXCELLENT gpgtools.org installer for Mac, which makes it super-easy to add signing and encrypt/decrypt and key management to OS X and Apple Mail. A quick Google reveals the nicely packaged gpg4win.org (I haven't used it). There's also Google's new Gmail GPG plugin (although yes it's beta) https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/ I know this is the FSF, but I'd hope in the interest of defeating the surveillance state they could set aside dogma. (Also, that page shouldn't default to the Linux options when I'm visiting from a Mac browser.)
- Tyr42 12y ago
  There's also Mailvelope[1], if you use gmail or other webmail. [1]: https://www.mailvelope.com/ https://www.mailvelope.com/
- tptacek 12y ago
  GPGMail for OS X (what you recommended here) works quite well, and I recommend it too. That team also does a good job of keeping up with Mail.app versions (which is a hard job).
  - zenojevski 12y ago
    I found the GPG tools on Mac quite good as well. But I thought I'd do things the "right" way. Use master/sub keys, linked identities, with masters kept offline... The friction was _immense_, especially managing the identities, mucking with the keyring files, then deleting the master key from the online keyring, and so on. I still have my off-site db secure, but I don't look forward at all to opening it again. I don't want to remember the precise series of steps involved before everything worked correctly. How can I solve this? I just want to manage a few identities (personal, as a citizen, work account, "stuff", etc.), some of them trusting each other. Common sense makes me think I'm way over-complicating. But I was always told that any other way wouldn't really be secure. I though I would just be very pro-active with key revocation and that would eliminate most of the problem...
brechmos 12y ago
It will be more helpful when GMail has it built in... Google?
- fintler 12y ago
  They already published a stepping stone. https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/
  - brechmos 12y ago
    Sure... but that is hardly ready for the masses! :-)
    - niels_olson 12y ago
      steps in the right direction happen one step at a time.
- iak8god 12y ago
  Google makes money on GMail by reading your email and serving related ads. They will never support built-in encryption.
  - schoen 12y ago
    I have worried about this incentive too, but they've just yesterday released some software that moves in this direction (though characterizing it as a special case for people who need extra security). But in the past I feared that they would even periodically update Gmail in ways that would break compatibility with browser-based encryption; I think the fact that they're publishing their own end-to-end browser-based e-mail encryption software shows that they're at a minimum willing to accept it as a supported feature.
    - iak8god 12y ago
      Well, good. I'd probably even pay a reasonable monthly fee for that to offset their lost ad revenue.
feralmoan 12y ago
I'm still constantly surprised that this feature isn't ubiquitously built into mail clients by default and users don't get a big 'enable encryption' button which automates sane defaults/manages the keychain transparently. It doesn't seem like such a complicated abstraction that it needs so much manual setup
- arjie 12y ago
  I remember it being built-in to clients in the past. Certainly Evolution (Ximian, Novell, Gnome) did when I last used it half a decade ago. You could encrypt your message, sign it, and the other side would (if they had your public key) see a nice 'Signature verified' on the other side. It was a fairly smooth workflow except for having to type in your passphrase in for everything.
gabriel34 12y ago
Email is insecure at it's design, yet we trust our digital lives to it and use it as proof of identity. Security should be at the protocol level for it to be universally used.
AlexMax 12y ago
If you're using a Mac, the excellent MailMate mail client supports GnuPG natively. http://manual.mailmate-app.com/preferences#openpgp_and_smime http://manual.mailmate-app.com/preferences#openpgp_and_smime I can't speak to any shortcomings in its PGP support, as it's not something I personally use, but I've been using it as a MacMail/Thunderbird replacement since last September and have been quite satisfied.
- cyphunk 12y ago
  This looks great but it is closed source. Perhaps that will change with his crowd finding? Until it becomes OSS there is no way I can use it
  - m4x 12y ago
    Does being OSS actually matter for this app? It would still be running on a proprietary OS, and you won't be personally inspecting the code closely enough to know that it's secure anyway. If you were concerned about what was being sent and to where, you would probably be better off to capture all traffic originating from your computer and verify that nothing extra is being sent, and that the destination is appropriate. Whether it was sent by open or closed source software is utterly irrelevant
zobzu 12y ago
infographics are nice but as long as all platforms and commonly used clients (not just email ones) have an EASY to use GnuPG implementation this seems bound to fail. Google's initiative seems like a good idea of course. The command line utility itself could use some MAJOR love tho. And even the best GUI clients are very confusing for new users. When I explain the concepts behind the trust model they get it. When they have to use the UI they dont find what they need.
887 12y ago
For Android you can use APG and K9-Mail. You will learn to love it if you have multiple accounts and 'get' the interface. Recommended use is with Thunderbird and Enigmail on desktop, where you should also have your mail filters sorting your mail to the IMAP folders. To install use F-Droid. F-Droid ist the Open Software Repository for Android. https://f-droid.org/ https://f-droid.org/ This is/feels like the recommended way to use PGP at the moment or at least the most useable.
- knitatoms 12y ago
  Agreed - I'm using this setup and it works really well.
  - mkesper 12y ago
    How do you treat PGP/MIME E-Mails? PGP-Inline is dead.
    - knitatoms 12y ago
      Good point - that's the only issue I have with K9 and AGP on Android. I'm happy to live with only being able to view encrypted attachments on the desktop at the moment. There's an open issue to add PPG/MIME: https://code.google.com/p/k9mail/issues/detail?id=5864 https://code.google.com/p/k9mail/issues/detail?id=5864 There's also an open bounty which can be contributed to: https://www.bountysource.com/issues/815255-pgp-mime https://www.bountysource.com/issues/815255-pgp-mime
      - 887 12y ago
        Small Update: You can get the latest K9 Alpha from here: https://github.com/k9mail/k-9/releases/tag/4.904 https://github.com/k9mail/k-9/releases/tag/4.904 ..and should use OpenKeyChain instead of APG, since its no longer maintained. http://openkeychain.org/ http://openkeychain.org/ (also available on F-Droid) This at least removes the need to push decrypt on every Message although thee might be Bugs.
esbonsa 12y ago
This doesn't appear to solve the metadata problem which is what the NSA seem to think is the most valuable (or at least that they have the least difficulties to get and process).
patrickdavey 12y ago
I do miss firegpg http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/ http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/ FireGPG was super easy to use with Gmail (that said, I suppose Google would have grabbed the cleartext in the interim draft state anyway)

148 points by tjr 12y ago

I get and send ~ 10 to 15 emails per week. Not even 1 of my regular 'correspondence' uses GnuPG. It's too complicated to setup and even harder to use for avg Joe, like bitcoin, he has to spent time understanding totally new concepts. And no one is willing to do that, unfortunately :-(

sssbc 12y ago
ok, get info-raped by any and all then.
- pyre 12y ago
  Consider this: 1. It's probably better to remain civil in your discourse if you want people to take you seriously, and not just dismiss you as a troll. If you really do feel so strongly about your position, then you're probably doing more harm than good to your cause by firing off such remarks. 2. I doubt that you personally communicate with everyone using encrypted email. If you do, your world is probably fairly insular (and you should probably consider expanding your experience to include communicating with people outside of your comfort-zone). 3. The most constructive response to the parent post would probably be a suggested plan of action. I'm sure that many here would be all-ears to even a decent framework for convincing the average person to use encrypted email.
  - dllthomas 12y ago
    It seems like teaching people to use GPG for the authentication is probably the first step. Sending to someone who doesn't use GPG then is still readable, and if you want to push the point with a particular person then every time they email you call them and say "I got an email, I wanted to be sure it was from you, since there was no signature..." Once you can count on contacts using GPG, the path to encrypting is much easier.
    - amirmc 12y ago
      I'd argue that getting address books to understand what keys are and how to use them would be more impactful. If I put public keys in my address book, which is nicely integrated with my mail client anyway, then sending encrypted mail should be far more straightforward. The problem then is getting people to use new address books.
      - XorNot 12y ago
        Making the Thunderbird address book not suck would be a good firsr step in this regard.
    - atmosx 12y ago
      IMHO the problem is the NOT infrastructure per se, it's the theoretical part that is cumbersome. If you now why you are doing something, it's easy to understand why you should not save the 'key' in the "Keychain" or sign random emails. To use GnuPG correctly you need explain to average Joe concepts like: * PKI * Key signing * Web of trust * Revocation key The problem is that, as Einstein said: Everything should be made as simple as possible, but no simple. Same problem I can't talk bitcoin with most of my real-life friends. They are incredibly smart people, but they are not familiar with key concepts about BTC and don't wanna wrap their minds around it when we're hanging out having fun.
      - borplk 12y ago
        I see what you're saying I think the same argument is being overly used to justify a lack of basic effort to learn anything about computing beyond 'click this shiny red button'. People just cry out to the programmers to "just make it easier". Well there's only so far you can go on the easy scale until you start sacrificing security and integrity. People need to learn some of the fundamentals and basics you can't run away from it forever. It's like someone saying "Mehh I don't like calculus ... why don't these mathematicians make it just easier? Why do I have to learn about differentiation? Make it so easy my grandma could differentiate this equation" Instead we force every kid to take the pain a bit and learn some damn basics. Same should go for computing. Schools could teach the kids the basics of protecting their communications on the internet. Give that 10 years and Public/Private key encryption is a piece of cake for every reasonably educated adult in the society and they are no longer buzzwords because everyone grew up with it and remembers their 8th grade when they learned all about it.
sp332 12y ago
It's true, Glenn Greenwald said that he almost gave up on Snowden's information because it was too hard to set up GPG correctly!
- tptacek 12y ago
  He did give up on GPG, and instead used Cryptocat, at a time during which it appears to have been possible to decrypt Cryptocat conversations from network traces due to key generation bugs.
- Create 12y ago
  http://vimeo.com/56881481 http://vimeo.com/56881481
tptacek 12y ago
I have walked non-technical people through the process of setting up GPGMail on Macs without much problem. I buy that GPGMail is hard to use reliably, and that its user interface is cryptic in ways that make it likely that users will slip up. I do not buy that GPG is particularly hard to get started with. Unfortunately, all the glamour and the money and the code seems to track vanity crypto projects, and not so much of it goes to projects that make GPG more usable for normal people. Kudos to Google for taking a stab at correcting this.
hershel 12y ago
Currently , the most practical way for secure communications looks like textSecure, which is a mobile IM app that is easy to use and install , and relatively easy to convince others to communicate in.
belorn 12y ago
A possible solution to this is private mail servers that encrypt and decrypt automatically for you. The idea that you go to the store, pick up a small box, and it will do all the security for you is the stated goal of freedom box (https://freedomboxfoundation.org/ https://freedomboxfoundation.org/). Once transparent end-to-end encryption that avg joe can use get traction, mail encryption will hopefully become default.
warcode 12y ago
Keybase.io is doing good work in making public key encryption more easily available. Except for the part where they want you to upload your private key to them. But that is optional.
vog 12y ago
I configured my parents' email program (Thunderbird/Enigmail) to automatically encrypt emails they send to me. Also, I encrypt all emails to them. They still don't really care, but at least my communication with them is encrypted. Also, they see that using encryption is not hard (once set up), except that they have to type in a password from time to time.

mapgrep 12y ago

The very first step, assuming you already have an email account, for all platform pages: >INSTALL THE ENIGMAIL PLUGIN FOR YOUR EMAIL PROGRAM I Googled Enigmail as I was not familiar with it. It is "a security extension to Mozilla Thunderbird and Seamonkey." This seems incredibly shortsighted. Tons of people out there are on Outlook, Apple Mail, Gmail, etc. and not interested in Thunderbird. There are other options, for example the surprisingly EXCELLENT gpgtools.org installer for Mac, which makes it super-easy to add signing and encrypt/decrypt and key management to OS X and Apple Mail. A quick Google reveals the nicely packaged gpg4win.org (I haven't used it). There's also Google's new Gmail GPG plugin (although yes it's beta) https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/ I know this is the FSF, but I'd hope in the interest of defeating the surveillance state they could set aside dogma. (Also, that page shouldn't default to the Linux options when I'm visiting from a Mac browser.)

Tyr42 12y ago
There's also Mailvelope[1], if you use gmail or other webmail. [1]: https://www.mailvelope.com/ https://www.mailvelope.com/
tptacek 12y ago
GPGMail for OS X (what you recommended here) works quite well, and I recommend it too. That team also does a good job of keeping up with Mail.app versions (which is a hard job).
- zenojevski 12y ago
  I found the GPG tools on Mac quite good as well. But I thought I'd do things the "right" way. Use master/sub keys, linked identities, with masters kept offline... The friction was _immense_, especially managing the identities, mucking with the keyring files, then deleting the master key from the online keyring, and so on. I still have my off-site db secure, but I don't look forward at all to opening it again. I don't want to remember the precise series of steps involved before everything worked correctly. How can I solve this? I just want to manage a few identities (personal, as a citizen, work account, "stuff", etc.), some of them trusting each other. Common sense makes me think I'm way over-complicating. But I was always told that any other way wouldn't really be secure. I though I would just be very pro-active with key revocation and that would eliminate most of the problem...

brechmos 12y ago

It will be more helpful when GMail has it built in... Google?

fintler 12y ago
They already published a stepping stone. https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/
- brechmos 12y ago
  Sure... but that is hardly ready for the masses! :-)
  - niels_olson 12y ago
    steps in the right direction happen one step at a time.
iak8god 12y ago
Google makes money on GMail by reading your email and serving related ads. They will never support built-in encryption.
- schoen 12y ago
  I have worried about this incentive too, but they've just yesterday released some software that moves in this direction (though characterizing it as a special case for people who need extra security). But in the past I feared that they would even periodically update Gmail in ways that would break compatibility with browser-based encryption; I think the fact that they're publishing their own end-to-end browser-based e-mail encryption software shows that they're at a minimum willing to accept it as a supported feature.
  - iak8god 12y ago
    Well, good. I'd probably even pay a reasonable monthly fee for that to offset their lost ad revenue.

feralmoan 12y ago

I'm still constantly surprised that this feature isn't ubiquitously built into mail clients by default and users don't get a big 'enable encryption' button which automates sane defaults/manages the keychain transparently. It doesn't seem like such a complicated abstraction that it needs so much manual setup

arjie 12y ago
I remember it being built-in to clients in the past. Certainly Evolution (Ximian, Novell, Gnome) did when I last used it half a decade ago. You could encrypt your message, sign it, and the other side would (if they had your public key) see a nice 'Signature verified' on the other side. It was a fairly smooth workflow except for having to type in your passphrase in for everything.

gabriel34 12y ago

Email is insecure at it's design, yet we trust our digital lives to it and use it as proof of identity. Security should be at the protocol level for it to be universally used.

AlexMax 12y ago

If you're using a Mac, the excellent MailMate mail client supports GnuPG natively. http://manual.mailmate-app.com/preferences#openpgp_and_smime http://manual.mailmate-app.com/preferences#openpgp_and_smime I can't speak to any shortcomings in its PGP support, as it's not something I personally use, but I've been using it as a MacMail/Thunderbird replacement since last September and have been quite satisfied.

cyphunk 12y ago
This looks great but it is closed source. Perhaps that will change with his crowd finding? Until it becomes OSS there is no way I can use it
- m4x 12y ago
  Does being OSS actually matter for this app? It would still be running on a proprietary OS, and you won't be personally inspecting the code closely enough to know that it's secure anyway. If you were concerned about what was being sent and to where, you would probably be better off to capture all traffic originating from your computer and verify that nothing extra is being sent, and that the destination is appropriate. Whether it was sent by open or closed source software is utterly irrelevant

zobzu 12y ago

infographics are nice but as long as all platforms and commonly used clients (not just email ones) have an EASY to use GnuPG implementation this seems bound to fail. Google's initiative seems like a good idea of course. The command line utility itself could use some MAJOR love tho. And even the best GUI clients are very confusing for new users. When I explain the concepts behind the trust model they get it. When they have to use the UI they dont find what they need.

887 12y ago

For Android you can use APG and K9-Mail. You will learn to love it if you have multiple accounts and 'get' the interface. Recommended use is with Thunderbird and Enigmail on desktop, where you should also have your mail filters sorting your mail to the IMAP folders. To install use F-Droid. F-Droid ist the Open Software Repository for Android. https://f-droid.org/ https://f-droid.org/ This is/feels like the recommended way to use PGP at the moment or at least the most useable.

knitatoms 12y ago
Agreed - I'm using this setup and it works really well.
- mkesper 12y ago
  How do you treat PGP/MIME E-Mails? PGP-Inline is dead.
  - knitatoms 12y ago
    Good point - that's the only issue I have with K9 and AGP on Android. I'm happy to live with only being able to view encrypted attachments on the desktop at the moment. There's an open issue to add PPG/MIME: https://code.google.com/p/k9mail/issues/detail?id=5864 https://code.google.com/p/k9mail/issues/detail?id=5864 There's also an open bounty which can be contributed to: https://www.bountysource.com/issues/815255-pgp-mime https://www.bountysource.com/issues/815255-pgp-mime
    - 887 12y ago
      Small Update: You can get the latest K9 Alpha from here: https://github.com/k9mail/k-9/releases/tag/4.904 https://github.com/k9mail/k-9/releases/tag/4.904 ..and should use OpenKeyChain instead of APG, since its no longer maintained. http://openkeychain.org/ http://openkeychain.org/ (also available on F-Droid) This at least removes the need to push decrypt on every Message although thee might be Bugs.

esbonsa 12y ago

This doesn't appear to solve the metadata problem which is what the NSA seem to think is the most valuable (or at least that they have the least difficulties to get and process).

patrickdavey 12y ago

I do miss firegpg http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/ http://blog.getfiregpg.org/2010/06/07/firegpg-discontinued/ FireGPG was super easy to use with Gmail (that said, I suppose Google would have grabbed the cleartext in the interim draft state anyway)