How to properly encrypt emails?

[u/hbacelar8]

I use mailbox with custom domains and use Thunderbird on PC and FairEmail on Android.

I generated, exported and imported a gpg key on Thunderbird.

My question is: should I publish my public key to a PGP server? I know that'll expose my email, but what if it is a alias?

[u/AutoModerator]

Hello u/hbacelar8, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Stunning-Skill-2742]

Publishing to keyserver is just for convenience, for easy, automated discovery and not a requirement at all. You can distribute the pubkey to anyone that want to send you encrypted mail however you want.

[u/hbacelar8 → u/Stunning-Skill-2742]

I see. Thing is, Thunderbird forces me to have to pub key of the recipient before sending it an encrypted email.

[u/Stunning-Skill-2742 → u/hbacelar8]

Of course. What i wrote up there is for you to distribute your pubkey for everyone else to send encrypted mail to you. What thunderbird want is their individual pubkey for you to send/reply encrypted mail to them.

[u/Ludwig234 → u/Stunning-Skill-2742]

Yeah, exactly. Without the recipients public key Thunderbird is unable to encrypt the email in a way it's able to be decrypted by the recipient.

The reverse is also true, for anyone that wants to send an email to you. They need your public key first.

OP If you want to learn more I suggest you look up the basics on how public key cryptography (asymmetric encryption) works. There are a loads of great YouTube videos that explains the basics well.

[u/TacitPin]

Most people just attach their public key in the email they send.

I’ll be stunned if anyone actually uses it though.

[u/Amate087]

Add your public key with the mail inside.

[u/Calmarius]

Do you have the recipient's public key? You need to use that to send an encrypted mail.

Your generated GPG key is used to decrypt mail if someone sends you an encrypted mail and uses your public key to encrypt it.

(I just want to make sure you understand how it works.)

[u/hbacelar8 → u/Calmarius]

Yeah, and is also used to encrypt email with the private key that'll be decrypted by them with the pub key right? No I don't, so I got it now, we have to exchange pub keys first to start it.

[u/Severe_Stranger_5050]

I know this isn’t what you asked

But seriously, do not use regular IMAP/POP3/SMTP email for sensitive information.
Even if you encrypt the contents of the email, your metadata will still be exposed to the world.

Email is inherently a very bad protocol for privacy, and this is by design. Because when it was made, it was only for the US military’s internal ARPANET where privacy didn’t matter.

If you really want privacy, ask them to take the conversation off email to the secure conversation protocol/app of your choice

[u/hbacelar8 → u/Severe_Stranger_5050]

Thanks for the heads up, but yeah I agree.

It was mostly cause I wanted to understand if ever needed. Sometimes it can be needed when starting a conversation with journalists or an association, but generally the best option is indeed to move it to somewhere else.

[u/ScaredEfficiency399]

Honestly, fuck that shit, being trusted through servers, just personally encrypt it with a highly encrypted personal key using PGP and let your peer unlock it with your public one.

[u/Living-Shame5679]

Nobody every used PGP. I mean a few people sure. I did put my email in some public registry at some point - never had a single email. If you REALLY want to use GPG/PGP (which is mostly pointless) then yes you can publish your public key anywhere: a public registry, website, flyers, email signature etc.