Email Security for Every Taste
Email Security for Every Taste
As someone who has read plenty of discussions about email security (some of them in this very community), including all kind of stuff (from the company groupie to tinfoil-hat conspiracy theories), I have decided to put too many hours some time to discuss the different threat models for email setups, including the basic most people have, the "secure email provider" one (e.g., Protonmail) and the "I use arch PGP manually BTW".
Jokes aside, I hope that it provides an overview comprehensive and - I don't want to say objective, but at least rational - enough so that everyone can draw their own conclusion, while also showing how certain "radical" arguments that I have seen in the past are relatively shortsighted.
The tl;dr is that email is generally not a great solution when talking about security. Depending on your risk profile, using a secure email provider may be the best compromise between realistic security and usability, while if you really have serious security needs, you probably shouldn't use emails, but if you do then a custom setup is your best choice.
Cheers
Nice post. My two cents:
- Can you make the images clickable? They're impossible to read at that size.
- This paragraph should probably mention that this won't work if the provider uses E2EE: "Using secure email providers means that a lot of trust is placed into the provider itself. A failure or a breach of the provider can result in the content of your emails being disclosed, which means you should choose a provider you trust, ideally with a good track record and some formal certifications that attest at least basic security. However, the attacks that are specific to this setup are complex and expensive. Unless you are a high profile target, it's very unlikely they will ever be relevant to you."
Thanks!
Can you make the images clickable? They’re impossible to read at that size.
I will look into it, there might be a zola option for it. If there is, sure!
This paragraph should probably mention that this won’t work if the provider uses E2EE
That paragraph is in the context of what I call "transparent encryption", which means E2EE works until the provider is not compromised and the E2EE is effectively broken by delivering malicious software or disclosing the key. E2EE is as resilient as the security of the provider, which is why picking a trusted one is important. Of course, compromising the provider and breaking the E2EE is quite complex.
Thanks for all the effort. Looks really nice :)
Thanks a lot! Hopefully at least someone finds it helpful!
At the end you ask people to email you, but after just talking about PGP, you don't provide a PGP key for people to use when they email you.
Yep, I am aware of the contradiction. I used to, but since then I moved to an alias as it was not worth wasting a domain for a single address. I may spend eventually the time to setup PGP for the alias itself, but I just didn't. It's a Proton alias, so I get anyway PGP encryption, though (obviously without all the features, but good enough for the near-zero volume I currently have).
It’s a Proton alias, so I get anyway PGP encryption
That's only true if you're talking to other Proton users. Proton does encrypt emails at rest, but that's basically the same as TLS + trusted server. Whether they use PGP on the BE or not is irrelevant.
Publishing your PGP public key next to your email doesn't require "wasting a domain" or anything like that, it merely gives others an option to contact you w/ PGP encryption. Since you already get near-zero volume, you probably would get even nearer-zero PGP volume (the few that would email you probably won't bother using your PGP key), but it would at least show that you're open to E2EE. You can even generate a special key that's only used publicly, and Proton should handle decryption automatically for you.
Anyway, I'm part of that group that probably wouldn't bother using your PGP key anyway, I just thought it was amusing that you didn't seem to actually follow your own advice. Perhaps that's just more evidence that email should simply be avoided.
Nice article!
You seem to be missing the word "by" in the table introducing threat T04. Also, the threat summary table uses ✅ and ❌ in a way that was counterintuitive to me: initially I thought ✅ meant the encryption approach protects against the threat.
A bigger issue IMO is how you describe email encryption in transit as a matter of fact, but according to Google transparency report[1] there are still domains that do not support in transit encryption, and, what's worse, when you send an email you can't tell if it will be encrypted or not.
[1] https://transparencyreport.google.com/safer-email/overview?hl=en
Thanks, I will go and double check, I am sure there are more typos!
I honestly didn't think at all about the use of checkmarks/crosses and the fact that it can be misinterpreted, I will add a disclaimer.
A bigger issue IMO is how you describe email encryption in transit as a matter of fact, but according to Google transparency report[1] there are still domains that do not support in transit encryption, and, what’s worse, when you send an email you can’t tell if it will be encrypted or not.
you are right. The reason why I took that for granted is because I assumed the scenario in which people use the "mainstream" providers. I was looking at data and I think Outlook and Gmail alone make up more than 50% of the market share. I made an assumption which I considered fair, as 99%+ of the users do not need to worry about this at all. However, this is interesting data and I might add a note about it as well, so thanks!
An attempt to a comprehensive threat model for emails
That's the subtitle, is it missing a word?
I don't think so, does it sound weird? Not a native speaker, so maybe it does :)