Why and How to Use Encrypted Emails

The Problem

Privacy (often misunderstood as secrecy) is recognised as a fundamental human right in almost all modern civil societies, and is a cornerstone of democracy. However, it goes without saying that all major free email service providers, such as Gmail, Yahoo, Outlook.com etc., do not adhere to the highest standards of privacy protection. Although they have made their systems top notch in terms of convenience and security (from external attackers), your email communications are not private from them. Since you do not pay them for their service, they get their revenue elsewhere such as from advertisement companies to whom your data is the product. Anyway, even if they decide to stop using your email conversations for targeted advertisements, they still have the ability to read your personal correspondences at their convenience. They do not even need a warrant. A rogue top-level employee could read your emails for malicious purposes, for instance. Also, what about the idea of mass surveillance of whole populations by governments (for example, to suppress dissent or activism)? Are you comfortable with that kind of snooping (which is very different from a targeted search and seizure upon warranted suspicion of a crime)? Of course, all of this happens with your permission because you agreed to their privacy policy when you signed up for the free account.

Ways to resolve

The solution to this email privacy issue is simple: end-to-end encryption, which means your communications are in an encrypted state on the email server and only you have the private key necessary to locally decrypt the emails on your computer. You will only need to worry about the physical security of your local machine, but that's it. Your personal emails are private.

There are privacy-focused email service providers as well, such as Posteo, Tutanota and Protonmail among others, which offer seamless encryption technology to less tech-savvy users. I personally like Posteo the most because it supports IMAP (which means you can use it with a regular email client such as Apple Mail or Microsoft Outlook or Thunderbird) on top of offering complete server-side encryption of all email data (including attachments and metadata) with your chosen password which is known only to you (the server stores a salted hash, not your actual password). Optionally, you can add another layer of security by using end-to-end encryption for individual emails with either S/MIME or PGP. Posteo costs a nominal 1€ per month but I think it's worth it. Tutanota and Protonmail offer limited free tiers as well, but since they do not offer IMAP support as of yet, I personally do not prefer them.

Anyway, if you still want to use the same email service as you are currently subscribed to, then the only solution for you is to employ end-to-end encryption yourself. There are two standards in this route, one is called S/MIME and the more popular one is PGP (or GNU's open source version known as GPG). I have personally used GPG for quite a while, but the adoption rate seems to be rather low. I can digitally sign every email I send, but in order to encrypt them as well, I need the public cryptographic key of my recipient who therefore must have set up a key pair in the first place. Since there seems to be some difficulty in learning how to generate and use GPG keys for signing and encrypting communication, I gave S/MIME a shot. For what it's worth, I think it is easier. Let me explain how you can use S/MIME to encrypt your communication with other S/MIME users. There are various tutorials online on how to set up GPG.

How to set up S/MIME?

The idea is to get a digital certificate issued by a trusted Certifying Authority (CA) which contains a pair of digital keys, one called the Public key which you will be automatically sharing with everybody when you digitally sign your emails, and another one called the Private key which you are supposed to share with no one but yourself. You can get a basic (class 1) certificate for free from Comodo, for example. A class 1 certificate certifies the authenticity of your email address. Let us follow along in a modern browser like Firefox to obtain such a certificate.

Generate encryption keys on Firefox:

• Step 1: Go to the Comodo website and click on "Sign Up Now" and follow the on-screen instructions to request a free certificate for your email address. Note that the revocation password is used to invalidate your certificate in case of emergency, such as loss or theft of your private key.

• Step 2: You will receive an email saying that your certificate is ready for collection. Open the suggested link in Firefox to automatically create your key pair and store it in Firefox's own Certificate Manager.

• Step 3: Open "Preferences", then select the "Privacy and Security" tab and find the option to "View Certificates" at the bottom of the page.

• Step 4: In the "Your Certificates" tab, you will find your new certificate from COMODO CA Limited. Select it and click Backup to save the certificate in your local storage as a PKCS12 file with a name of your choice like "My_Secret_Certificate.p12". You will be asked to secure your backup with a password.

Use the certificate with Apple Mail:

• Step 1: Import the "My_Secret_Certificate.p12" generated in the previous step to Keychain Access by double-clicking on it and entering the password you selected for the backup in the previous step. 

• Step 2: You are done! While composing emails with Apple Mail, you will find buttons to encrypt and/or sign on the right side of the subject banner. (If not, enter your login keychain, find your certificate within "My Certificates", right-click to select "New Identity Preference" and enter your email address. Then click "Add".)

• Step 3: Always digitally sign your emails and encourage your correspondents to use S/MIME technology. This allows them to install your public certificate and send you encrypted emails. You will be able to encrypt outgoing emails if the recipient has ever sent you an email digitally signed with his/her own S/MIME certificate and, therefore, allowed you to install and trust his/her public certificate sent alongside the signature.

• Step 4: To be able to use the same technology in your iPhone, simply AirDrop your confidential "My_Secret_Certificate.p12" and then install it. Then navigate to your account settings, go inside the "Advanced" option, and enable S/MIME to encrypt and sign your emails.

Use the certificate with Thunderbird:

• Step 1: Import the confidential "My_Secret_Certificate.p12" to the Certificate Manager of Thunderbird (which you will find inside Preferences, then the Advanced tab).

• Step 2: Go to "Account settings" and then "Security" for your email account and select the key pair you have just imported in the "Digital Signing" and "Encryption" sections. Place a tick next to "Digitally sign messages (by default)".

• Step 3: While composing emails, click the down arrow next to the "Security" button and select "Encrypt message" from the drop-down menu. This will work if the recipient has ever sent you an email digitally signed with his/her own S/MIME certificate and, therefore, allowed you to install and trust his/her public certificate sent alongside the signature. Therefore, encourage your correspondents to use S/MIME technology. 

That's it. It wasn't that hard, was it? Please regain your own privacy. It is your right!