diff options
[src] Removed manually placed heading anchors in all pages
1 files changed, 0 insertions, 12 deletions
| -rw-r--r-- | src/blog/encrypted-email/index.md | 12 |
diff --git a/src/blog/encrypted-email/index.md b/src/blog/encrypted-email/index.md index 8ef93da..d761557 100644 --- a/src/blog/encrypted-email/index.md +++ b/src/blog/encrypted-email/index.md @@ -13,7 +13,6 @@ That's why, after a fairly lengthy research process, I've decided to do just tha *Note:* What I'm referring to is end-to-end encryption, where you send an encrypted email, and the recipient decrypts it. Encryption between you and a mail server is practically a given and is setup by the mail server administrator. ## Contents -<div></div> 1. [Encryption and signature](#encryption-and-signature) 2. [OpenPGP](#openpgp) @@ -29,7 +28,6 @@ That's why, after a fairly lengthy research process, I've decided to do just tha ## Encryption and signature -[](#encryption-and-signature) Unless stated otherwise, all of the listed encryption (and signature) schemes work by utilizing [public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography). @@ -48,7 +46,6 @@ Every email you send can be [digitally signed](https://en.wikipedia.org/wiki/Dig This might sound a bit complicated, but all you need to worry about is you and the recipient generating these public-private key pairs, exchanging public keys, and your email client should handle the rest. And if you use a tool like [pEp](https://www.pep.security/en/), the creation and exchange of keys can be easily automated. ## OpenPGP -[](#openpgp) By far, the most popular way to encrypt your emails is with [OpenPGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy). PGP is the original program which implemented the encryption scheme, while OpenPGP is the standard/encryption scheme, which was created from PGP (so when I say OpenPGP, I mean a program that implements OpenPGP). @@ -59,7 +56,6 @@ OpenPGP divides the security community quite a lot, some [abolish it](https://re There are two main ways to encrypt an email with OpenPGP: ### PGP/Inline -[](#pgpinline) The first is called "PGP/Inline", with which you encrypt only the message itself. That's it. And there are [other limitations](https://josefsson.org/inline-openpgp-considered-harmful.html) too, to name a few: @@ -72,7 +68,6 @@ Though, it's not all bad. If you can survive only sending text to other people, 2. The other option, PGP/MIME, is much harder to implement properly and there have been cases where [it's implementation is flawed](https://web.archive.org/web/20180625054201/https://www.whonix.org/blog/pgp-inline-vs-mime) ### PGP/MIME -[](#pgpmime) "PGP/MIME" is the second option. As it's name suggests, you can encrypt [MIME](https://en.wikipedia.org/wiki/MIME) data with PGP, which by definition means it supports any content type. This includes: @@ -89,7 +84,6 @@ PGP/MIME is capable of a lot more, and is [generally preferred](https://www.mail 3. If your client doesn't support it, manual decryption takes a bit more work ## S/MIME -[](#smime) [S/MIME](https://en.wikipedia.org/wiki/S/MIME), roughly said, combines and extends the [Cryptograhic Message Syntax](https://en.wikipedia.org/wiki/Cryptographic_Message_Syntax) encryption scheme and [MIME](https://en.wikipedia.org/wiki/MIME) standard to create a singular, email-oriented standard. @@ -102,7 +96,6 @@ On the other hand, you can browse [Google's](https://support.google.com/a/answer Otherwise, it's email encryption capabilities are the same as those outlined in [PGP/MIME](#pgpmime). ## reop -[](#reop) [reop](https://flak.tedunangst.com/post/reop) is a very new, simple and "completed" system. The thing is, it's only a single command line utility that uses some encryption schemes (picked by the [nacl](http://nacl.cr.yp.to/index.html) library) for it's own unique system. Currently, there doesn't seem to be any email clients that support it. @@ -115,7 +108,6 @@ However, as explained in it's [article](https://flak.tedunangst.com/post/reop), The only reason for using reop is if you want a very small system with a very simple source code behind it. Nevertheless, it's still a viable alternative. ## Post-email systems -[](#post-email-systems) There is a somewhat old [document](https://github.com/OpenTechFund/secure-email), created by the [OpenTechFunc](https://www.opentech.fund/), which outlines very thoroughly all "next generation secure email or email-like communication" technologies. @@ -128,7 +120,6 @@ And outline zero trust and fingerprinting as the main advantages of these system Given that these projects aren't really email, I won't dive much deeper into it. But I will mention, almost all listed projects seem to have been abandoned. Those still under active development are [goldbug](http://goldbug.sourceforge.net/) and [retroshare](https://retroshare.cc/). Until 2021, zeronet *was* updated, but the [author](https://github.com/shortcutme) seems to have [disappeared](https://github.com/HelloZeroNet/ZeroNet/issues/2808#issuecomment-1132820787). ## Centralized non-email systems -[](#centralized-non-email-systems) "Centralized non-email systems" is another term, which as far as I can tell, is also coined by [this document](https://github.com/OpenTechFund/secure-email) from [OpenTechFunc](https://www.opentech.fund/). They define it as "centralized email-like messaging platform" and further divide it into: @@ -143,7 +134,6 @@ Out of the listed options, Enlocked doesn't work anymore and was [a bad system]( That leaves us with the two last-standing providers: ### Protonmail -[](#protonmail) Protonmail, or [proton.me](https://proton.me/) as they are called now, which uses good old [OpenPGP](#openpgp). That means they have end-to-end encryption and zero-access encryption by default for all protonmail accounts. They also [support encrypted conversations with non-protonmail users](https://proton.me/support/how-to-use-pgp). @@ -152,7 +142,6 @@ Funnily enough, Protonmail doesn't really fit in any of the listed categories, s Protonmail's services have a free tier, which should be enough for lighter usage, but restricts **heavily** storage, label and folder count, amount of sent messages per day, etc. At the time of writing, their second tier pretty much lifts all restrictions for 5 euro per month (without annual contracts). Check out their pricing [here](https://proton.me/pricing). ### Tutanota -[](#tutanota) [Tutanota](https://tutanota.com/) uses it's own special system for security. In brief, all of your emails are (zero-access) stored and end-to-end encrypted with (mostly) [AES 128](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard), and while they generate and hold your public and private keys, your password is needed to decrypt your private key (do check out their [security page](https://tutanota.com/security/) for more details). @@ -161,7 +150,6 @@ However, it's crucial to note that they are a type *2. Semi-closed system*. If y Finally, pricing. In general, they have a lot less features than [Protonmail](#protonmail), but their free tier is a lot more capable than [Protonmail](#protonmail)'s. Their pricing is extremely flexible, being able to buy specific features by themselves, like storage or mail aliases. Check it out [here](https://tutanota.com/pricing/). ## Conclusion -[](#conclusion) In brief, almost all email encryption systems use [public-key cryptography](#encryption-and-signature). The most popular of these systems for personal use is [OpenPGP](#openpgp), but in the business space, [S/MIME](#smime) is quite a bit more prominent. [reop](#reop) is a viable, but limited, very new and lightweight systems for encrypting your email messages. |