Aotearoa IMC : http://indymedia.org.nz
Aotearoa IMC

LOCAL Commentary :: Miscellaneous

Privacy not Privatization - Using PGP to encrypt email

Danyl Strypes provides a brief introduction to why encryption might be a useful tool for activists and some fairly simple, step-by-step instructions for sending encrypted email using open source software you can download for free.
The best way to keep something private is not to communicate about it through email, or any digital media. The Waihopai station is keyword scanning all email that passes in and out of New Zealand, and if the spooks are taking an interest in you, any kind of encryption you use can be broken with a powerful enough computer and enough time.

However, if you want to keep things like admin passwords away from casual crackers, or keep some info private temporarily until it becomes public anyway, it might be useful to set up email encryption. One of the most common ways to do this is using PGP or Pretty Good Privacy:
en.wikipedia.org/wiki/Pretty_Good_Privacy

What is PGP encryption?

Encryption refers to any method of turning a message into gibberish, so that is can only be read by somebody who has the correct code to decrypt it. PGP uses public key cryptography, where people who want to exchange encrypted messages have both a public key, and a private key, which contains the code used to decrypt messages encrypted with the public key.

Imagine that a person's public key is a lock box that only their private key can unlock. If I want to send you an encrypted message, I put it in your lock box and send it to you. Other people may be able to get their hands on the box, but they can't open it unless they have your private key.

So how can you use PGP? First, you will need a few software tools. Then you'll meed to create your key pair, and learn about acquiring public keys and applying encryption to your message. I recommend finding an encryption buddy to learn about PGP with. If you both follow these instructions, you can help each other if you get stuck, and you have someone to exchange encypted emails with and see if it works.

Step 1) Install software

I havn't yet discovered a way to use PGP with webmail, so this method uses a desktop email program called Mozilla Thunderbird, a cousin of Firefox, which is available free for Linux, Mac, Windoze etc although these instructions are orientated towards Windoze users. Download it and install it from here:
getthunderbird.com

You will also need to install PGP software. I recommend installing the latest version of GNUPG:
www.gnupg.org/

Finally, you will need to install the Enigmail add-on for Thunderbird
addons.mozilla.org/en-US/thunderbird/addon/71

If you are using Windoze, always restart your computer after installing new software or it may get unhappy and crash on you.

If you get stuck getting GNUPG or Enigmail installed, this FAQ may help:
enigmail.mozdev.org/documentation/gpgsetup.php

Step 2) Create your encryption keys

Open thunderbird.

Click on "OPenPGP" from the top menu.

Then click "Key Management" from the drop down menu.
lick "Generate > New Key Pair"
(Leave the defaults in place just choose a thunderbird account to
associate with the key and choose a passphrase)

More help on key management can be found here:
enigmail.mozdev.org/documentation/keyman.php

Step 3) Obtaining public keys

For your buddy to send you an encrypted email, they first need to acquire your public key. There are two ways to do this:

a) email it to them. Start a new message by clicking the 'write' button. Then, go to OpenPGP > Attach My Public Key. Write your email and send.

b) You can upload your public key to a keyserver. Go to OpenPGP > Key Management. Then, go to Keyserver > Upload Public Keys.

To acquire your key, your buddy will need to open Thunderbird and go to OpenPGP > Key Management. Then, go to Keyserver > Search for Keys. They enter your email address where it says 'search for key', select one of the keyservers you uploaded to, and click ok. When it finds your key, they tick the box and click 'ok.

Obviously you will follow the same process with roles reversed to obtain your buddy's public key.

Step 4) Send an encrypted email

Click on the 'write' button.

Write out your email as normal.

Before you click 'send', click the two buttons at the bottom right of the screen. The one with the pen digitally signs your email. The one with the key encypts it.

Happy encrypting!
 
 
Comment on this article
Title
Author Anonymous
  Create a new account ?
Text Format

Comment

Anti-spam Enter the following number into the box:
To add more detailed comments, or to upload files, see the full comment form.

Comments

Re: Privacy not Privatization - Using PGP to encrypt email

Thanks for that mate
 

Re: Privacy not Privatization - Using PGP to encrypt email

"I havn't yet discovered a way to use PGP with webmail" - which happens to be what most people use...
 

Re: Privacy not Privatization - Using PGP to encrypt email

Some webmail clients (I think Horde? but am not positive) allow for PGP. Also, you can use something like WinPT (for Windows, I'm sure there are Linux alternatives) to encrypt any text, then just paste it into an email. Same goes in reverse. Clumsy, but its better than nothing...

Asher
 

Re: Privacy not Privatization - Using PGP to encrypt email

Winzip supports AES envryption, I'd recommend that for people using webmail or who just find pgp a bit difficult or cumbersome.

Just zip up your file, send it along and give the passphrase to the recipient out of band (say in person, or via a discreet note, or even possibly via phone if you can slip it in somehow - phone conversations generally being safer than txt messages for giving/recieving information.)

One thing to be aware of in this is file names - change the names in the zip archive to something plain, as the files themselves will be encrypted, but the filenames will still be displayed.

Daniel X
 

Re: Privacy not Privatization - Using PGP to encrypt email

Just one problem Danyl - it doens't work with Windows Vista. Also if you don't buy an authorized version of PGP there is a very high chance all the free versions have nasty backdoors hidden in them by the (un)kind people who make them available on the net. It's true what they say, nothing is free. It is worth scrimping and saving to buy an authorized version from the makers. I wouldn't trust any freeware. Also you can use PGP as much as you like but if you've been attacked by a key logger, you're stuffed. But good on you for trying.
Robbie D
 

Re: Privacy not Privatization - Using PGP to encrypt email

"it doens't work with Windows Vista."

Yet another good reason not to use it ;) But seriously, if this is true, it'll only be temporary, until updated versions of Thunderbird, Enigmail and GnuPG are tweaked by their developers to work with Windows Virus... er... I mean Vista.

"Also if you don't buy an authorized version of PGP there is a very high chance all the free versions have nasty backdoors hidden in them"

This may be true of versions of PGP which are freeware (proprietary software given away at no cost). This is why all the software I suggest in this article is open source, free as in speech, as well as free as in beer. This means that any 'backdoors' can be found by code-literate users auditing the source, the news would be all over the web in minutes, and the reputation of the Mozilla Foundation and the GNU project would be in tatters.

Find me some evidence of backdoors in these programs and I will help you spread the word. Otherwise you are just propogating FUD (Fear, Uncertainty, and Doubt), for the benefit of commercial PGP suppliers.
 

Re: Privacy not Privatization - Using PGP to encrypt email

For goodness sake, do not do what Daniel X suggests. If your email is being actively intercepted, it's highly likely your phone will be as well. Recording devices may be a possibility, if they're really out to get you.

For those of you afraid of backdoors in proprietary software, just use GnuPG. It's free, open-source and best of all, compatible with PGP.
 

Re: Privacy not Privatization - Using PGP to encrypt email

It took 10,000 computers running 24 hours a day for 549 days to brute force the encryption on a single 109bit encrypted message which is why raiding your house is still the most used and practical technique the cops use to get to ur encrypted stuff either all nicely unlocked in your desktop or just a passcode or two away from being unlocked.

If you dont hand over the passwords you could go to jail on that alone.
 

Re: Privacy not Privatization - Using PGP to encrypt email

Why is "Scheduled tasks" called "cronjob"? Its being different just for the sake of being different. And why does it take 35 hours to install an application? Is there a reason?
 

Re: Privacy not Privatization - Using PGP to encrypt email

For those in Poneke who are interested in further discussion of security for activists, and perhaps some hands-on workshops, there is a session at Crossways in Mt Vic, on Sunday July 27. Check out the July Magnetic Fridge Diary for more details.
 

Account Login

Media Centers

Syndication feeds

 

This site made manifest by dadaIMC software