PGP and Gmail

Now that I have Thunderbird as my main email client (see my previous post), I started thinking about PGP.

Now, why would I be doing this?

At work, we received this memo from the Ministry of Education:

Some schools have recently received phishing emails with requests to change employees’ bank accounts, pay invoices or purchase gift cards. The email will appear to come from a known sender’s email address, such as the principal of the school, but the reply address may be a public email such as gmail or yahoo. You may then receive an apparent email confirmation. Phishing emails lure victims into disclosing sensitive information, releasing money or installing malware. They appear to be from a legitimate source and often request the recipient to click on a link or provide additional information. These types of scam emails are often difficult to spot as they appear to be coming from someone you know.

Which got me thinking, how do my recipients know that the email that purports to come from me ... actually is from me?

Which, of course, got me on to PGP. Basically, I wanted to be able to send emails using a PGP signature so that recipients would know it's from me. Then, if any spam arrives looking like it's from me, my contacts would know it's not.

Using Thunderbird, this is very easy. I installed an add-on called Enigmail, which is absolutely brilliant. It allows you to create your keys, publish the public ones to key servers, and encrypt and/or digitally sign your emails.

Which is all well and good, but I also access my mail through the Gmail web interface, and the Gmail Android app. What I wanted was a seamless workflow, so that all email that I send or receive that is encrypted can be decrypted anywhere.

What I've settled on (after much testing!) is FlowCrypt.This comes as a web extension for both Chrome and Firefox, and as a stand-alone mail app for Android. This allows me to use TB as my main email app, but also gives me the freedom to be off the laptop and still able to access and send encrypted email. The setup was fairly straightforward, as I was able to export my keys from Enigmail and import them into FlowCrypt.

The last app I installed was OpenKeychain. This is a stand-alone encryption/decryption app which I can use without having to be writing an email. I can encode text or files and email them without any hassle. It also decrypts the PDP attachments in the Gmail app by simply clicking on them, which is nice.

The next step, of course, is to get my colleagues and other email contacts to start using PGP. That will be the real challenge ...

• Add to Sketchpad
  • No word lists for English -> English...
  • Create a new word list...
• Copy

• Add to Sketchpad
  • No word lists for English -> English...
  • Create a new word list...
• Copy