Why Your Emails Aren't Private and How You Can Change That

Email privacy and security has been a topic of discussion for a long time. Unlike a lot of the technology being used these days, email has been around for a while. It's no surprise that companies such as Google that make their money from user data aren't the most privacy respecting of services. However, even supposed alternatives that are often discussed have shortcomings. For a deeper explanation on why this is the case you can watch my video above.

The easiest solution to this issue is just to use a different messaging service for any social communications. This is pretty much what people do already but it needs to be iterated. Messaging applications such as Matrix, Signal or XMPP are not only better performing and most secure but, with the exception of signal, can be self-hosted. A guide I made to setting up an XMPP server can be found here I highly recommend it over services like WhatsApp or Telegram.

Threat Modeling and CIA

First thing you should consider is what reasons do you use email in the first place. You'll find that there are plenty of different use cases such as public correspondence, social media sign-up, buying things online etc... . Most of these use cases require different considerations on what type of data you're willing to share, both publically and to private companies.

A good abbreviation to remember is CIA which stands for confidentiality, integrity and anonymity (sometimes authenticity is used instead). Confidentiality means that we don't want people to be able to snoop on our emails when we don't give them permission. Integrity means that we don't want our messages to be altered or changed in some way before the reciever gets them. Anonymity is pretty self explanatory in that we don't necessarily want our email service or messages tied to our physical identity.

Depending on a use case these three factors may be crucial, or they may not be at all. For example, you public email address that you willingly give out to your followers or friends is inevitably going to be tied to your physical identity so worrying about anonymity is nonsensical. However, if you use social media accounts it's always good practice to ensure that any data they do collect on you isn't necessarily tied to you. Similarly, with ecommerce sites and the ungodly amount of data they collect on individuals. It is always a best practice to ensure that the data they do collect is completely useless to them.

Shortcomings With Encrypted Email Services

Protonmail is a service that has been widely recommended both because it doesn't collect the same data that other emails do, but also because they use encryption for their messages. There have been some criticisms of their encryption standard on their web app which is beyond the scope of this video but can be listened to here. One glaring issue with Protonmail from an anonymity perspective is that when you sign up you need to verify your account with a phone number or a previous email. The reason for this is to stop people from creating spam accounts that they use for nefarious purposes. This not only ties your account to your physical identity but is also a huge red flag as data brokers love using phone numbers with datasets. Tutanota is another great email service that doesn't use this practice. Instead they make it so an account can't send emails for 48 hours to avoid it from being used for spam. It's the email I'd recommend people use, however like everything you should do your own research. In addition to this a user should always be weary of a service where the encryption keys are controlled and maintained by the service itself. There is a very simple way around this called PGP but I'll discuss that later in the article.

Separating Your Emails

Since none of the reasons we use email have the same requirements it makes the most sense to separate your email addresses. If you don't need to worry about integrity or confidentiality for social media then it is the best practice to use a separate email service to your personal account. For signing up to ecommerce sites retaining and saving emails isn't always necessary so using burner emails or aliasing is the best practice. The use case and recommended service can be seen below.

Personal Email Account

* Self-hosting an email server

Social Media

* Seperate email from your personal account

Ecommerce

* Burner emails

* Email aliasing service

Email aliasing is where you create many different email addresses and forward them all to one account. This is good as data from one service cannot be tied to another and if they start sending a lot of spam an alias can just be deleted. The best way to do this is to self-host an email server but if you want a good solution out of the box then SimpleLogin is a great company you should check out.

PGP Encryption

Anonymity is often covered by using privacy-respecting services discussed above. Confidentiality and integrity can both be covered by using public-key encryption such as PGP. PGP works by generating a Private key and Public key. The public key is given out to anyone and everyone who asks for it as it. Messages are encrypted using your private key and other people decrypt it with your public key, ensuring the integrity of your messages. Signing is a process that is used to ensure that only a certain person can read a message. This is done by using a persons public key to encrypt the message so that only they can decrypt it with their private key. Both encrypting and signing emails can be done if the email service has a PGP key from you (just upload it to the application). The easiest way (and best) to generate a PGP key if you're on Linux is to use GPG from the gnu foundation. If you're on windows or mac then your best bet is to check out the related tools on their website.

To generate a key in the Linux terminal you'll need to install the gnupg package.

For Arch Linux sudo pacman -Syu gnupg

For Debian/Ubuntu sudo apt-get install gnupg

Next thing you'll need to do is run the below command and your keys will be created. Simply input all the info it asks for such as name, the email you'll be using etc...

gpg --gen-key

That's about it. You can share the public key with others and upload your key to your protonmail or tutanota app so that you can use it for email. Never ever give someone your private key even if they ask.

Conclusion

If this article has demonstrated anything it's that email is a really ineffective way to message people online. Often times it's just used by companies and services as a proof of identity and to tie the data they collect to you. Your best bet is to use email as sparingly as possible, follow best practices and just use a different messaging application for personal communications.

Stay happy and stay private.