Secure Your Communications with This Guide to Email Security

Protecting your communications is critical for your privacy, safety, and security. Email is so widespread that hackers rely on it as a primary attack vector. Use email to talk to friends or coworkers about personal information, store important documents, share passwords, or remain in contact with family members. This guide to email security will help protect your confidentiality and could even save your life.

This guide is divided into three parts: email security basics, choosing a service, and encryption.

Part 1: Email Security Basics

If you aren’t already familiar with the concepts of confidentiality, integrity, and authenticity in information security, read this short glossary of common terms before continuing to learn how secure your email communications are.

Confidentiality is keeping information secret from unauthorized parties, including governments and corporations. For example, if you delete an email without shredding the contents first, anyone with access to your computer can recover it later by simply pressing the undelete button. Your email might also contain sensitive information that you’d prefer not to be disclosed to ordinary mail carriers or the company hosting your email service.

Integrity ensures that information cannot be modified by unauthorized parties, whether accidentally or deliberately. Emails can contain executable code, so if an attacker gains access to your computer and can cause your web browser to execute it, they could gain control of the entire system. Your email provider might also modify messages for their purposes, like displaying messages differently depending on the type of device you read them with.

Authenticity ensures that messages come from known senders and haven’t been modified by hackers. Even if you encrypt your messages to keep them secret, an attacker could still intercept them and fake their origin or modify their contents without detection using a technique called “replay attacks.”

Part 2: Choose a Secure Email Service

If you don’t use an existing secure email service, you should choose one. Whether you host your server or use a commercial service, this section will help you make the best choice to protect your communications.

Choosing a Secure Email Service

All major providers that offer secure email services also provide insecure alternatives, but you should use their secure versions when sending sensitive information to ensure confidentiality. Many services only allow users to access their website over HTTPS, which is not enough to keep your communications secret. Others may appear secure at first glance but can compromise your security if you aren’t careful. This section will help you choose a secure email service that meets your other requirements.

Host Your Own Email Service

If you host your own email server, you’ll have complete control over the security configuration, and no third party can see your emails without direct access to your computer. However, this means that if attackers gain access to your system, they can access every email ever sent from your domain. If you’re concerned about attackers gaining physical access to your computer, then hosting your secure email service isn’t for you.

Commercial Email Providers

If you don’t want full control over the security of your email communications, or if it’s just more convenient to use a commercial email service, then this section will help you choose a secure provider that meets your other requirements.

Choose a Provider That Handles Security for You

If you don’t want to manage security on your own or pay the cost of hosting an email server, then choosing an email service with automated security features is the way to go. Many providers also handle the various interoperability issues involved with encrypting messages, so you can focus on using encryption appropriately instead of being an expert in cryptography.

Choose a Provider That Offers Open Standards

For encrypted email to be compatible with other programs and services, all security-related functions should be handled by open standards. However, if you only use email on a few specific applications, then interoperability isn’t an issue, and you can save some money by choosing a provider that uses nonstandard encryption implementations.

Part 3: Encrypt Your Communications

You can use several methods to encrypt your communications, but you should be aware of the strengths and limitations of each one. If you’re already familiar with common encryption methods like TLS (which HTTPS uses), GPG, SSH, and PGP, you can skip the next section. Otherwise, this section will help you understand the available different encryption methods, both in general and for emails specifically.

Encrypting Traffic on Your Computer

One of the easiest ways to keep your communications secure is to use an encrypted connection when browsing the web or sending email from your computer. This section explains how HTTPS helps protect websites and mail servers and the limitations of using HTTPS.

Encrypting Traffic on Your Smartphone

If you use a smartphone to send and receive an email, then there’s a good chance that it has been configured with insecure defaults. This section will help you understand why this is a problem and work around those issues.

Encrypting Files for Email

Unless you only use the same computer to send and receive email, then it’s unlikely that your computer is physically secure enough to store sensitive information. There are several ways to encrypt files to be safely attached to an email message without risking the loss of confidentiality.