Email encryption has never been easy. The complexity of encrypting emails has frustrated the adoption of the PGP protocol in the decades since Phil Zimmermann released it to the world.
PGP doesn't work the way most people conceptualize encryption, and has been difficult for most to grasp. It's easy to fall back on the metaphor of a safe with a single combination that both locks and opens the safe. It's easy to think of knocking on a door, and someone asks "What's the password." If the password is correct, passage is granted.
If someone steals your password, then they can get into your stuff. A password that both opens and locks something is called a symmetric key password. If this password is weak and easily guessed, or if someone you have entrusted the password to isn't careful with it, then you have been defeated.
Open PGP works differently from symmetric key passwords. Open PGP is asymmetric.
There are two keys in PGP (actually, there can be subkeys, but lets not go there right now). One key is public and can be known to the world. The other key is private, and must be kept secure.
If you were going to send me a PGP encrypted email message, you would need to know my public key. You can use my public key to encrypt files and messages that you want me to see. My public is not a secret.
In fact, here is my public key. You can know it. I have published it to a well known key server so you don't have to keep asking me for my public key. If you want to send me a secure message, you can use my public key. My public key is not a secret.
If I want to open the encrypted message that you send me (the message you encrypted with my public key), I have to use my private key. Only my private key can open a message that has been encrypted using my public key.
It's like a safe with multiple combinations. One combination was published in the newspaper, and lets anyone open a door on the safe and put something in. The other combination is a secret and only lets me take something out of the safe.
First people need to be convinced that there is a benefit to complexity. It's easy to convince ourselves that we, "have nothing to hide," and that nobody would be interested in our email anyway.
An easy way to begin to dabble in encryption is to install and use Signal by Open Whisper Systems. It's free and easy to use. Signal is the best implementation for IM encryption that I have seen.
If you are a Microsoft Outlook user, you're welcome to use Encryptomatic Open PGP add-in. We've tried hard to make it easy to install and use, and it's free for personal use.
Thunderbird with the Enigmail add-in is an excellent choice.
Encryptomatic also operates Lockbin.com. Lockbin lets you send messages to anyone by email, securely, and puts a buffer between you and the technology.
We hope these tools will help you take back your privacy and allow you to communicate confidently.
PGP doesn't work the way most people conceptualize encryption, and has been difficult for most to grasp. It's easy to fall back on the metaphor of a safe with a single combination that both locks and opens the safe. It's easy to think of knocking on a door, and someone asks "What's the password." If the password is correct, passage is granted.
If someone steals your password, then they can get into your stuff. A password that both opens and locks something is called a symmetric key password. If this password is weak and easily guessed, or if someone you have entrusted the password to isn't careful with it, then you have been defeated.
Open PGP works differently from symmetric key passwords. Open PGP is asymmetric.
There are two keys in PGP (actually, there can be subkeys, but lets not go there right now). One key is public and can be known to the world. The other key is private, and must be kept secure.
If you were going to send me a PGP encrypted email message, you would need to know my public key. You can use my public key to encrypt files and messages that you want me to see. My public is not a secret.
In fact, here is my public key. You can know it. I have published it to a well known key server so you don't have to keep asking me for my public key. If you want to send me a secure message, you can use my public key. My public key is not a secret.
If I want to open the encrypted message that you send me (the message you encrypted with my public key), I have to use my private key. Only my private key can open a message that has been encrypted using my public key.
That is the beauty of Open PGP. Public keys can be shared openly. We don't have to worry that someone will overhear me sharing my public key with you.
It's like a safe with multiple combinations. One combination was published in the newspaper, and lets anyone open a door on the safe and put something in. The other combination is a secret and only lets me take something out of the safe.
How can private key unlock something encrypted with a public key?
Oh, so you're a math enthusiast? For open PGP to work, you really only need to accept the idea that the keys are mathematically related. You don't have to understand the math, but you should feel comfortable enough to trust it. It involves working with very large prime numbers. But if you're interested in elliptical curve cryptography, you read more about it here.Why don't more people use Open PGP?
Most people don't send encrypted messages because they don't have anyone who wants to receive an an encrypted message. Message encryption works best when it happens automatically, behind the scenes. Unfortunately, until recently many large companies that provided communication platforms did not take protecting your messages very seriously. There is no email encryption option in Gmail or Yahoo mail. It's difficult enough just to setup an email client like Microsoft Outlook or Thunderbird. Then, installing the special software to add email encryption is another level of complexity. Then, generating a PGP key pair (public/private) and sharing the public key.... well, you get the idea.First people need to be convinced that there is a benefit to complexity. It's easy to convince ourselves that we, "have nothing to hide," and that nobody would be interested in our email anyway.
An easy way to begin to dabble in encryption is to install and use Signal by Open Whisper Systems. It's free and easy to use. Signal is the best implementation for IM encryption that I have seen.
If you are a Microsoft Outlook user, you're welcome to use Encryptomatic Open PGP add-in. We've tried hard to make it easy to install and use, and it's free for personal use.
Thunderbird with the Enigmail add-in is an excellent choice.
Encryptomatic also operates Lockbin.com. Lockbin lets you send messages to anyone by email, securely, and puts a buffer between you and the technology.
We hope these tools will help you take back your privacy and allow you to communicate confidently.
No comments:
Post a Comment