Matkoya's Blog

In the old time, before we had computers, internet and cell phones, how did we communicate? We were writing letters for birthdays, Christmas or just to let the other person know, we are still thinking on him. We wrote the letter and sealed it well in an envelope. The letter was dropped in the postbox and transported over several hops to its recipient. This was save in most countries a save way to transmit personal information to someone else. In some countries there have been sitting man in grey coats with sunglasses in the post office, opening the letters over steam and checking out, what people write. In countries based on law and justice an order from of judge was necessary to do so in some other countries this was a standard procedure implemented for persons opposing the local regime. In the so called “free world” this was seen as an intrusion into personal privacy and thus the privacy was protected by law.
For quick communication we have been using a phone, which was attached by a wire to the wall 😉 The same procedure applies as to letters. Listening to private communication requires a court order. This hasn’t changed much, besides, well we use cell phones and at least their location can be tracked down easily today. Additional we use today application to chat quickly and to ensure privacy most chat apps, like Threema, Telegram , Signal or WhatsUp are using end to end encryption. This means the message is put into an envelope on the sender side and only the recipient can open it and read the massage. To intercept such a message, the agent has to install some kind of spy-software on the phone or the computer of the sender or of the receiver. That process is similar to when spies wire tapped the home of a potential target. Although this process was again a standard procedure for enemies of the state in certain countries, it requires a court order in most other countries. The process to do so is work intensive and was done only in connection with severe crimes. Although installing spy-software can be done from remote today, it’s still not a simple process and usually requires the “cooperation” of the target. After security authorities found a way to intercept Telegram chats it can be assumed that this security hole will be fixed in the near future. Usually we can assume that our private conversation through a chat application using end to end encryption is quite save as long as the information thief doesn’t get hold of the hardware used. Mass surveillance is not possible as long as we use end-to-end encryption for our communication.
But what’s about our e-mail?
Most mail-servers are using encryption we might assert, so it should be save, right?
Let’s have a look onto the transport way of an e-mail. We write it and send it to our mail-server. This connection is usual encrypted. But now the mail-server decrypts the e-mail and stores it in a readable format, before it encrypts the e-mail again to send it to the mail-sever of the recipient, this server again will decrypt the mail, store it in the inbox of the recipient until he fetches the e-mail. If we compare it with the old fashioned way of sending letters, it’s like the letter gets opened and closed again on every post office on the way to the recipient. Huh? Yes, everyone with access to the post office or the mail server can read the mail! This is the way how free-mail services, like gmail are working. They use scan the e-mails stored on their servers in order to present the sender and recipient personalized advertising. What else they are going to do with the information obtained this way, we don’t know. We also don’t know, who else is able to get access to our personal messages stored on the mail server. This opens the door to mass surveillance. Well, of course, we already share a lot of personal information today on social media, like Facebook. Therefore anything, we don’t want to see being published about us in a newspaper, we should’t share on these social media. This information is public, accessible at least for any security agency. Sacrificing our privacy might therefore also sacrifice under certain circumstances our personal security, like many examples about bloggers or posters on Twitter or Facebook have shown in the past. Some countries still don’t appreciate free speech, they are afraid of it and jail people instead. The sentence, “I don’t have anything to hide” can be considered just plain ignorant, everyone has his private secrets, everyone has his privacy and it’s worth to be protected. So, what’s the best way to do so with e-mails?
So what we can do to reclaim privacy in our e-mails?
Sure, we can run our own mail-server and make sure the potential recipients have mail accounts on our mail server. But this requires not only to run a computer 7/24, but also a reachable address, like a fixed IP-address or the use of a service, like DynIP. As mail-servers are popular targets for hackers, we need to harden the server against attacks. This requires at least some advanced technical knowledge, most people don’t have. In some cases, like for companies, this might be the solution of choice, it’s not a choice for everyone.
The answer would be, we use end-to-end encryption, like with our chat-apps.
How does end-to-end encryption work?
It basically works with a key-pair: a public-key and a private-key. As the names already indicate the public-key is public and thus accessible to everybody. The public-key is usually also used to sign an e-mail and it is sent as an attachment. The e-mail is encrypted with the private-key of the sender and the public-key of the receiver, who then is able the decrypt the e-mail and read it.
Today there are two methods around for signing and encrypting emails and they are not compatible.
S/MIME works with certificates, like SSL encryption used to secure traffic between a computer and an internet-server. The certificate can be bought from a certification authority, which guarantees the identity of the owner of the certificate. Some certification authorities issue free certificates, alternatively one can also create so called self-signed certificates. Most operating systems will only trust certificates for which you have to pay money. Thus S/MIME is often used by companies, as they can also distribute the public part of the certificates through an Active Directory Service. So if you ever receive an e-mail with an “smime.p7s” signature, then the sender is using S/MIME.
OpenPGP or PGP is the other method used for signing and encryption. This is the most common method as it does not require any authority. The public keys are stored together with the e-mail address on key-servers. PGP is a commercial product-line offered by Symantec, OpenPGP is, as the name already implies a free and open source solution for signing and encrypting e-mails and is the preferred solution to sign and encrypt mails. Mails with an attachment, like “signature.asc” are signed with OpenPGP, the signature is also the public key of the sender, but you should verify it through a key server. Both solutions, the commercial one from Symantec and the OpenSource one are compatible.
In the next post, I will explain, how to really encrypt and decrypt e-mails as comfortable as possible.