Posted on

Stick it to the NSA: Encrypt Your desktop E-Mail

image

This is one of many articles in a series I’m writing to cover end-to-end encryption for everything you do in your digital life.  I’ll cover encrypting your webmail and mobile e-mail in other articles.

For a primer on encryption, please read my article “Understanding Encryption” as it teaches VERY IMPORTANT concepts that you need to know before moving forward here.

Did you know that ALL E-Mail goes across the open internet in plain, raw, NON encrypted text?  Well, all except e-mail that you explicitly encrypt, which this article will show you how.

Encrypting your E-Mail requires the following steps that we’ll cover individually to simplify the process:

  • Install the proper plugin for your E-Mail app.
  • Create your public/private key pair.
    • Store your private key in a VERY secure place.
    • Publish your public key for others to use.
    • Import your keys into your E-Mail plug in.
    • Import your friends public keys into your E-Mail plugin.

Since I obviously don’t have the resources to provide thorough instructions for every e-mail app out there and for every plugin available, I’ll cover 1 popular e-mail app and 1 popular plugin.  The e-mail app we’ll be using for this tutorial is Mozilla’s Thunderbird, available on Windows, Mac, & Linux.  You can download it here.  It’s free and open source.

Since you’re reading this article, I’m going to assume you’re already using an e-mail program on your PC, or you wouldn’t be here, so I’ll skip the tutorial on how to install and configure an e-mail app.  You should already have that up and going before continuing here.

First, you’ll need a plug in for your e-mail app that can handle encrypting and decrypting e-mail.  I recommend Enigmail for Thunderbird.  Click here to get it.  It’s also free and open source.

Once installed (I assume you don’t need a tutorial to install the plugin), open the new “OpenPGP” menu in Thunderbird and select “Key Management”.

image

It’ll look like this:

image

If you already have a public/private key pair, add them here.  You should have them in an .asc file.

If you do NOT already have a public/private key pair, inside the OpenPGP Key Management window, open the “Generate” menu and choose “New Key Pair”.

image

If you have more than one E-Mail address configured in Thunderbird, you’ll want to generate a new key pair for each e-mail address.  Choose your e-mail address from the drop down list at the top of this window.

Choose a passphrase and don’t forget it.  Also, for the love of all that is digital, DO NOT MAKE IT SIMPLE!!!!  If you’re going through the effort of generating public/private key pairs to make it difficult for eavesdroppers to see your communications, don’t drop the ball now and use a short or easy password.  I recommend using LastPass.com to generate long, complex passwords and to store them for you (fully encrypted, of course).

Choose an expiration date too.

Why choose an expiration date?

First, let’s explain what that is.  After that date, all software to all other users will inform them that this is invalid.

Why you want this:  If you forget your passphrase and your key becomes compromised, you’ll NEVER be able to revoke your key.  Put an expiration date on it so that it will eventually die on its own.

I recommend 1 to 2 years.  You can and should generate new keys when they expire and publish the new public key.

Once it’s all filled in the way you like it, click “Generate Key”.

Allow the software to generate a revocation certificate.

Now, backup and protect your private key.  Store it in a safe place.  I recommend storing it as a secure note in LastPass.com as well as inside of an encrypted virtual disk (I’ll explain this in a later article).

Publish your public key

Now, your public key is no good if no one has it.  Remember, in order for anyone to send you an encrypted message, they MUST encrypt it with your PUBLIC key.

Right-click your key(s) and choose “Upload public keys to key server”.  This makes your key available in search results on public key servers by anyone that knows your name or e-mail address.

If you ever accidentally expose your private key, you can revoke your key pair from this app by right-clicking your key and choosing to revoke it.  Be sure to upload the change to the key servers so others know your key is revoked and they stop sending you important information encrypted with your old, public key.

You’re now ready to begin using encrypted E-Mail.  BTW, click the “Display All Keys by Default” check box to see your key(s) listed there.

I recommend setting this up for all the members of your household on each of their PCs.  Set each member up with their own private/public key pair and show them how to properly manage them or point them to this article and let them do it.  Let THEM come up with the key phrases and ENSURE they don’t forget them!  Then, you can start E-Mailing your family members securely.

Get public keys of your contacts

You can’t send encrypted mail to anyone until you have their public key.  So, in the Key Manager app, open the key server menu and choose “Search for keys”.  You can type partial or whole e-mail address or user names.  It will search public key servers for any matches.  There are 3 or 4 key servers provided in the key manager.  If you don’t find your contact in one, try another.  Of course, call your contact and make sure they even HAVE a public key.  They can also e-mail it to you.  Note:  While testing the search while writing this article, none of the key servers found any address that I knew was there.  Note that you can copy the URL from the search window and paste it into your address bar in your web browser and really search directly on those key server sites to find your contact’s keys.

image

Once found, add them to your key list (called a “key chain”).  That makes them available to you when you send encrypted E-Mail.  Speaking of which, let’s send some encrypted E-Mail now.

Send your first encrypted E-Mail

Close your key manager.  Start a new e-mail message in Thunderbird.  Address it to someone for whom you have a public key.  Click the “OpenPGP” button.  The first time you send an e-mail message, encrypted, from your e-mail address, Enigmail will prompt you if you want to enable OpenPGP for this identity.  Be sure to check that box.  I recommend checking the “Encrypt messages by default” check box too.

image

Click OK, then the dialog box pops up that you’ll likely see before sending each messages:

image

Click “OK” and your message will be encrypted and sent.

Side Note:  “Signing” a message is important if you want to prove to the recipient that it’s from you.  This is explained in my “Understand Encryption” article, which you should be familiar with.

Note that Enigmail will encrypt the message with the public key associated with the RECIPIENT’S E-Mail address, not YOURS.

See these images?

image

You’ll find actual working versions of them at the top and bottom of this article. Please click the appropriate buttons in it to let your friends know about this article.

Posted on

Understanding Encryption

Encryptoin

The topic of encrypting is wide and deep, so I’ll narrow this discussion to the basics of what you need to understand about E-Mail encryption and I’ll be as concise as possible.  This also begins a series of articles on encryption I’ll be writing over the next week or two explaining everything you need for end-to-end encryption for everything in your digital life from files on your mobile device to phone calls to everything on your PC.  All software in my series will be free and open source.

Encryption and Decryption

When you send an encrypted message to someone else, you must have that person’s public key.  This is an encryption key that they publish on public key servers for anyone and everyone to have access to.  These public keys can only encrypt messages.  They cannot decrypt messages.  If you encrypt a message with a friend’s public key, there is NO WAY you can decrypt it, not even with the public key you just used to encrypt it.

Why?  Because the public key was created with a complex mathematical formula that actually created TWO keys that work together.    Anything encrypted with ONE key can ONLY be decrypted with its pair key.  When you use your friend’s public key to encrypt a message before sending it to them, ONLY your friend can decrypt that message and they must do it with their private key.

Conversely, when someone sends YOU an encrypted message, they MUST encrypt it with YOUR public key.  ALL encrypted messages YOU receive MUST have been encrypted with YOUR public key.

YOU create a public/private key pair with a key generator.  There are many apps that can generate key pairs.  OpenPGP is a popular standard for keys.  That simply means that software designed to encrypt or decrypt has been written for standardized encrypting algorithms.  OpenPGP is a very popular algorithm.

When your friend sends you an encrypted message, encrypted with YOUR public key, only YOU can decrypt that message and ONLY with your private key that was created along with your public key.

Your public key is meant to be shared.  That’s how people encrypt messages intended for you.  Your private key is exactly that:  Private.  You MUST protect is and never, EVER give anyone access to it.  This means do NOT store it on a cloud drive.  Do NOT EVER e-mail it to anyone, not even yourself, because as soon as you hit “send”, it’s now passing through the internet, unencrypted.  If you ever make the mistake of e-mailing your private key or storing it on a cloud drive, you should consider that key compromised.  You’ll have to revoke the key and create a new pair.  It’s now well known that the NSA intercepts all e-mail traffic.  If you EVER e-mail your private key, there’s a nearly 100% chance that the government now has your private key and has the ability to decrypt any and all content encrypted for you with your public key.

Digitally Signing content.

A neat side effect of having public/private key pairs is that you can reverse how you use them.  For example, instead of encrypting a message with people’s public keys, you could encrypt a message with your PRIVATE key.  Under normal circumstances, you’d NEVER do this because 100% of the population has access to your PUBLIC key and ANYTHING encrypted with your PRIVATE key can be decrypted with your PUBLIC key.

So, why would you do this?

Simple, if you want to PROVE that a document was actually created or sent by YOU.  Encrypting data with your PRIVATE key (instead of your public key) is called “Digitally signing” the content.  Even though, mathematically, it’s the same thing as encrypting, in practice, that encryption is useless for secrets because the decryption key (your public key) is well known.  But, just like data encrypted with your public key can only be decrypted with your private key, data encrypted with your private key can ONLY be decrypted with your public key.

So, if you ever want to prove you’re the sender of an e-mail message, you will digitally sign it before sending it (or encrypt it with your private key).  The receiver can get your public key from any number of public key rings and decrypt your message, proving that it had to have been encrypted (or “signed”) with ONLY your private key.

Let me reinforce that “encrypting” with your private key is NOT considered “encrypting” since anyone can decrypt it.  It’s considered “digitally signing”.

Got it?  Good!  Now, go encrypt all the things!

See these images?

image

You’ll find actual working versions of them at the top and bottom of this article. Please click the appropriate buttons in it to let your friends know about this article.

Check back later for updates too!

Next, be sure to read the next article in this encryption series:

Posted on

Stick it to the NSA: How to Encrypt your WebMail

If you access your email from your desktop web browser, then follow these instructions to get email encryption working.  This is an initial draft.  I’ll expand some of the steps very soon.

  1. Install the Google Chrome  or Firefox browser if you haven’t already and install the extension named “Mailvelope” from https://www.mailvelope.com
  2. Once installed, there’ll be a new lock icon on the top right of your browser.  Click it and a menu opens.  Choose “options”.
  3. If you haven’t, at some time in the past, already created a private and public key pair, you’ll need to do that now.  If you don’t know what I’m talking about, you haven’t and you’ll need to do it now.  Click “Generate Key”.
  4. Once generated, it’s critical that you back up your private key, encrypted, to a place that no one can get it and that will last longer than your current hard drive and PC.  If you lose it, you’ll NEVER be able to read ANYTHING you’ve encrypted with your keys!  Install LastPass.com, create a secret note, and put your private key in there for long term, encrypted, safe storage.  Mark the note as “must reprompt for password”.  NEVER, EVER give anyone your private key.  NEVER send it unencrypted over the internet.  NEVER email it in an unencrypted e-mail message!  NEVER send it unencrypted over a wireless network, especially an open or public one.
  5. No one can send you encrypted e-mail unless they have your PUBLIC key.  Publish your PUBLIC key to a key server.  DO NOT PUBLISH YOUR PRIVATE KEY!!!!!!!! EVER!!!

Now, when you use GMail or most any of the other popular, free e-mail services in a  desktop browser, you can send and receive encrypted e-mail.  NOTE!  Just because you have the ability to send and receive encrypted e-mail does NOT mean that all your e-mail will be encrypted.  You MUST understand the following:

  1. Nothing you did here encrypted any of your old email.
  2. New email that comes in will usually be in clear text (NOT encrypted).
  3. When you start a new email message, Mailvelope will recognize this and provide you an icon, overlayed in your new email window.  Click it to write your email, then click “encrypt” to encrypt the email.
  4. You CANNOT send encrypted email to people that aren’t already set up, like you are, to send and receive encrypted email.
  5. You can’t send encrypted e-mail to anyone from whom you’ve not acquired their public key.
  6. You acquire public keys by searching on a key server.  MIT’s key server is here:. https://pgp.mit.edu
  7. Use the Mailvelope menu to import the public key of each individual with whom you wish to send encrypted email to.  You’ll find that most people have NOT registered a public key, so  you cannot participate in encrypted email with them.
  8. Once you encrypt and send an email message, you won’t be able to read it from your sent box.  It’ll be there, but encrypted with THEIR public key.  Only THEIR private key can decrypt it.  So, send it to both them AND yourself, THEN you can read it.
  9. Encrypted email is unreadable even by Google’s servers, which means you CANNOT use the Google email search feature for words in encrypted mail.
  10. ONLY the BODY of the email is encrypted, not the subject line, not the TO address, not your FROM address, not any part of the headers.

Things to note about HOW the keys work:

  1. When you generate keys, you only do it once, unless you have multiple email addresses.  In which case, generate a key pair for each of your email addresses you wish to send and receive encrypted email for.
  2. Keys are  created in pairs:  One is public.  The other is private.
  3. Feel free to give away your public key to ANYONE, ANYWHERE, ANYTIME.  Shout it from the mountain tops.
  4. Protect your private key with your life.  Well, don’t die for it, but it’s critical you protect it!  If anyone EVER acquires it, they can read EVERYTHING you’ve ever encrypted with your public key!
  5. Your public and private keys are intimately, mathematically connected.  Anything encrypted with your public key can ONLY be decrypted with your private key and  vice versa.
  6. Nothing is safe if you encrypt it with your private key, because everyone has your public key and can easily decrypt it.  A side benefit is you can do this to prove YOU are the one that created the message.  This is called “digitally signing” your document.
  7. If you want to encrypt something that ONLY YOU can decrypt, encrypt it with your PUBLIC key.  Decrypt it with your PRIVATE key.
Posted on

Sick of the NSA Spying on you?

imageSetting aside the tin foil hat and paranoia jokes, no one likes being tracked or their private text messages being scraped up by the U.S. government’s massive computers, nor their phone metadata being logged, nor even the possibility of someone being able to listen in or record your phone calls (the NSA denies they listen to calls, but others with even FEWER ethics CAN).

 

Here’s what you can do to protect yourself on your Android SmartPhone

  • Encrypt your text messages.  There are 2 good options:

Install the TextSecure app.  This app will automatically detect which of your contacts also has this app installed and will automatically encrypt your SMS text messages with those individuals.  TextSecure is available on iOS too!  This means you can have encrypted texting sessions with both iOS and Android users!

Root your phone and install CyanogenMod 11 (or higher).  CM 11 has built-in support for TextSecure encryption, coded directly INTO the Operating System.  This means, you don’t have to install the TextSecure app.  Automatically, ALL SMS apps on your phone suddenly support TextSecure encryption.  But, you have to turn it on.  The feature is called “WhisperPush”.  Simply find the WhisperPush app on your phone, run it, and follow the instructions.  It’s the simplest setup you’ll ever experience.

  • Encrypt your voice phone calls (yes, you can do that)

This used to be stuff of only fiction in spy movies, but it’s a reality today and YOU can do it within minutes of reading this article.  First, install the app RedPhone from the Google Play Store.  This app is made by the same people that make TextSecure.  Both you and the person you’re calling (or receiving a call from) have to be using this in order to have a secure, encrypted phone call.  When you install the app, the first time you run it, it’ll ask you to register your phone number.  Now, anyone else with the app, when they call you’re number, the app knows you have it and will offer the caller the option to make the phone call encrypted.  Note that this uses your DATA connection and NOT your phone connection.  You’re not actually making an actual phone call.  It’s more of an internet audio chat.  But you don’t need to know that other than if you have a data cap, this will use your data.  As far as you and the other caller are concerned, for all practical purposes, it’s a phone call.  But your carrier will have no record of it AND anyone trying to listen in will only see a stream of random bytes streaming.  It’s totally encrypted… just like in the spy movies! Smile

  • Encrypt your E-Mail

This is a bit more difficult.  I’ll provide another article on how to do this.  The short version is you need to install djigzo from the Google Play store to manage your keys.  Then you’ll need an e-mail client that can use those keys to encrypt and decrypt your e-mail.  K-9 Mail is supposedly one of those apps.  For the record, I’ve NEVER gotten this to work.

  • Encrypt your phone

Android can encrypt your entire phone.  Don’t confuse yourself.  This does NOT encrypt ANY internet traffic to or from your phone.  It encrypts the files on the phone itself.

Go to Seetings –> Security –> Encrypt Phone

Warning!  This can take an hour or so!  Make sure your phone is plugged in AND has at least an 80% charge.  You do NOT want this failing in the middle of  it.  It will also require you to set a lock screen PIN or password, if you don’t already have one.  Once you do this, you CANNOT flash anymore ROMs on your phone (if you’re rooted).  So, make sure you’re good to go with the ROM you have.

  • Add a PIN or password to your phone

This one is obvious.  You need to set a PIN or a Password on your lock screen, otherwise, anyone can use your phone and see your data.

  • Add extra PIN for individual apps

Install the app AppLock from the Google Play store.  Open it up and set your settings.  You’ll set a PIN and you’ll select the apps you want to have an extra layer of protection.  Hint:  DO NOT use the SAME PIN here that you’re using for your phone lock screen.

This app will pop up a PIN prompt whenever someone tries to open one of your extra protected apps.  For example, you may want to enable your backing apps and credit card apps via AppLock so that you have to know that extra PIN in order to lauch them.  This way, if you let someone borrow your phone, they can’t go snooping into your financial data.

  • Hide apps and/or files on your phone

Maybe you have some apps that you don’t want other people to know or use.  Go to the Google Play store and download an app called Hide It Pro.  When you install it, it’ll show up on your phone as “Audio Manager”.  It’s deliberately deceptive.  The purpose of this app is to hide apps and/or files on your phone.  You protect them with a password of your choosing.  If someone’s snooping around on your phone, all they’ll see for this app is a music icon with a label, “Audio Manager”.  And if they launch it, it’ll even have working audio controls.  Those controls are totally for faking out people snooping on your phone.  Long press on the app title at the top of the screen (inside the app) and you’ll be prompted for a password, which then takes you into the real app where you can select apps and files to hide.  They won’t even show up anywhere on the phone with the regular phone interface.

  • Hide your browsing and internet traffic

Your ISP can see all the sites you go to, and so can the NSA, and so can anyone else snooping on your wireless connection (or even your wired connection).  And websites know what IP address you’re using, which means they can ask the ISP that own’s that IP address who is using it, and they’ll give them your name, address, and phone number.  What you need is something that bounces your web page requests to random computers all over the world.  Yes, this is exactly what you see “hackers” doing in hi-tech spy movies and YOU can do it too… VERY EASILY.  Install the app Orbot on your phone.  Follow the directions.   It’s super simple.  If your phone is rooted, it can obfuscate ALL of your internet traffic.  If your phone is NOT rooted, it can work with a few apps on your phone (web browser and e-mail, in particular) and bounce all your traffic from those supported apps all around the world.  It’ll slow down your connection a little, but it’ll also protect you against nosy, 3 letter acronyms including ISPs.

Click here to follow me on Google+.

Follow me on Twitter @CSharpner.

See these images?

imageimage

You’ll find an actual working versions of them at the top and bottom of this article. Please click the appropriate buttons in it to let your friends know about this article.

Check back later for updates too!