Take Back Your E-mail (Part 1)
(It’s been a while, but I’m back. Thanks to the folks at Brazen Careerist for inviting me aboard; I’m honored to be a part of such an interesting community.)
E-mail is not private.
Every message you send travels as plain text over the Web, with no safeguards to prevent some malicious person from intercepting it. It’s more or less like sending a postcard. In terms of your privacy, it’s actually even worse - a postcard can be shredded, but even if the sender and recipient both delete any given e-mail, chances are a copy still exists on the Internet in some form.
The solution is public-key cryptography. With software like GnuPG, you can create a keypair consisting of a public key and a private key. Publish the public key as widely as you can… e-mail it to your friends, for instance, or post it on your Facebook. Guard the private key with your life.
When someone sends you an e-mail, they encrypt it with your public key. You, and only you, can decrypt the message with your private key (assuming you’ve kept it safe).
You can also use a variant of your private key to sign messages you send. The recipient can check the signature against your public key and confirm that the message is really from you.
You should encrypt your e-mail whenever possible. If you habitually encrypt even innocuous messages, then any truly private encrypted mail won’t stick out like a sore thumb.
My hope is that e-mail encryption will become commonplace. As Bruce Schneier put it recently, “Who controls our data, controls our lives.” And data, gentle readers, is a slippery thing. It gets away from us all too easily, and once it does, there’s no way to tell where it will wind up… with spammers? With our employers? With the government?
In my next post, I’ll explain exactly how to set up PGP encryption, but in the meantime, here are some links to get you started.
- GnuPG.org - project homepage for GNU Privacy Guard, encryption software built on the OpenPGP standard
- Public-key cryptography on Wikipedia
- Gpg4win - software package containing GnuPG (GNU Privacy Guard) and other handy software, including a plugin for Outlook 2003
