Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automatically Encrypting all Incoming Email

grepular.com

Post reply on HN
Print view View original

1–10 of 23 posts

Re: Automatically Encrypting all Incoming Email

#2

Post by cwoac »

A nice approach, I will look at implementing it on my setup at home; Probably worth noting that if you are taking these steps then running it all out of an encrypted filesystem is probably a sensible addition. Although if you are looking at doing this you probably have an encrypted filesystem already.

Re: Automatically Encrypting all Incoming Email

#4

Post by FedRegister »

cwoac wrote: post #2

A nice approach, I will look at implementing it on my setup at home; Probably worth noting that if you are taking these steps then running it all out of an encrypted filesystem is probably a sensible addition. Although if you are looking at doing this you probably have an encrypted filesystem already.

And likely have plain-jane, no TLS SMTP mail being delivered which means it's trivial for your upstream provider to read your (unencrypted) email.

Re: Automatically Encrypting all Incoming Email

#5

Post by [deleted] »

FedRegister wrote: post #4
cwoac wrote: post #2

A nice approach, I will look at implementing it on my setup at home; Probably worth noting that if you are taking these steps then running it all out of an encrypted filesystem is probably a sensible addition. Although if you are looking at doing this you probably have an encrypted filesystem already.

And likely have plain-jane, no TLS SMTP mail being delivered which means it's trivial for your upstream provider to read your (unencrypted) email.

[deleted]

Re: Automatically Encrypting all Incoming Email

#6

Post by agwa »

nilved wrote: post #3

How could this be translated to Postfix, for a Postfix novice?

If you're using procmail as your delivery agent, then adding this to your procmailrc should work:

  :0fw
  | /path/to/gpgit.pl you@example.com
Be sure to also enable opportunistic transport-layer encryption in Postfix (it's pointless to encrypt mail upon receipt if it just traveled in the clear on the Internet) by putting this in main.cf:

  smtp_tls_security_level = may
  smtpd_tls_security_level = may
  smtpd_tls_cert_file = /path/to/cert
  smtpd_tls_key_file = /path/to/key
You need a SSL cert for this, but it can be a self-signed cert. If you're on Debian (probably Ubuntu too) you can use the snakeoil cert (/etc/ssl/certs/ssl-cert-snakeoil.pem and /etc/ssl/private/ssl-cert-snakeoil.key).

Re: Automatically Encrypting all Incoming Email

#9

Post by [deleted] »

agwa wrote: post #6
nilved wrote: post #3

How could this be translated to Postfix, for a Postfix novice?

If you're using procmail as your delivery agent, then adding this to your procmailrc should work: :0fw | /path/to/gpgit.pl you@example.com Be sure to also enable opportunistic transport-layer encryption in Postfix (it's pointless to encrypt mail upon receipt if it just traveled in the clear on the Internet) by putting this in main.cf: smtp_tls_security_level = may smtpd_tls_security_level = may smtpd_tls_cert_file =…

[deleted]

Re: Automatically Encrypting all Incoming Email

#10

Post by agwa »

frank_boyd wrote: post #8

Wouldn't it be way easier to just encrypt the partition? Ubuntu for example has an easy-to-use feature for that. The idea of email encryption is not least to avoid interception in the clear. Or am I missing something?

The problem with filesystem-level encryption is that it allows the mail server to decrypt the messages. With PGP, the server is only able to encrypt messages; messages can be decrypted only by clients which have the private key.
Post reply on HN