{"id":4100,"date":"2017-06-22T21:09:07","date_gmt":"2017-06-22T21:09:07","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2017\/06\/22\/easy-email-encryption-with-thunderbird-and-enigmail\/"},"modified":"2021-09-17T11:28:54","modified_gmt":"2021-09-17T15:28:54","slug":"easy-email-encryption-with-thunderbird-and-enigmail","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/email\/easy-email-encryption-with-thunderbird-and-enigmail\/","title":{"rendered":"Easy Email Encryption with Thunderbird and Enigmail"},"content":{"rendered":"
\"Email<\/figure>\n\n\n\n

In this article, you will learn how you can use email encryption in your hosted email accounts. With email encryption, your messages will be unreadable by anyone except the intended recipient. This is valuable when using a shared hosting account for which email is controlled from one cPanel. Anyone with access to the cPanel can see the content of the email messages. Follow along with the steps in this article to learn more about email encryption with Thunderbird<\/strong>.<\/p>\n\n\n\n

Email encryption is great for exchanging private business plans, organizing surprise parties, or virtually hundreds of other applications that may require secret messages. Even if you have nothing to hide, encryption is a fun, free, easy way to learn about cryptography and establish your own \u201cweb of trust\u201d with friends and coworkers.<\/p>\n\n\n\n

Basics of email encryption with Thunderbird<\/h2>\n\n\n\n

In order to start using email encryption, it is recommended that you use a free, non-proprietary email client that you can modify. We recommend using Mozilla Thunderbird, because it is popular, well supported, and allows us to modify it. Also, this process requires a sender and receiver both using public and private keys (or, \u201ckeypairs\u201d) to encrypt and decrypt messages.<\/p>\n\n\n\n

For our encryption, we\u2019re going to be using GnuPG. This program sets up a secure pair of keys we will use to encrypt and decrypt messages. A good analogy of how the whole system works is a safe belonging your email recipient. Imagine the recipient of your message has a safe that you can put messages into, and only the recipient has the key to open the safe and see your message. To complete the picture, the safe would be your recipient\u2019s \u201cpublic key\u201d and they will use their \u201cprivate key\u201d to decrypt the message.<\/p>\n\n\n\n

Installing GnuPG<\/h2>\n\n\n\n

If you use a GNU\/Linux operating system, it is most likely that GnuPG is already installed in your system, in which case you can skip down to the steps below to install the Enigmail plugin in Thunderbird.<\/p>\n\n\n\n

For mac users, you can install GnuPG via GPGTools<\/a>. If you use Windows, you will just need to download Gpg4win<\/a>. Once you have completed this installation, proceed to the steps below.<\/p>\n\n\n\n

Adding Email Account and Installing the Enigmail Addon<\/h2>\n\n\n\n

Using GnuPG takes some reading and a lot of practice. But since we are only concerned with email encryption in this article, we can use a plugin called Enigmail to set up a secure keypair without having to leave Thunderbird.<\/p>\n\n\n\n

We will also be adding an email account to Thunderbird. If you already have an active email account in Thunderbird, you can skip the first two steps.<\/p>\n\n\n\n

  1. Find your email account settings<\/a><\/li>
  2. Add your email account to Thunderbird<\/a><\/li>
  3. Under Tools<\/em> select Addons<\/strong><\/li>
  4. Search for the Enigmail<\/em> addon and Install<\/strong> it<\/li><\/ol>\n\n\n\n

    Now that we have Enigmail installed, we will just need to follow a few simple procedures to create our public key and private key and begin sending encrypted emails.<\/p>\n\n\n\n

    Using Enigmail in Thunderbird<\/h2>\n\n\n\n

    After installing Enigmail, you will prompted to go through the setup wizard. If you are not prompted, click Enigmail from the toolbar, and choose Setup Wizard<\/strong>.<\/p>\n\n\n\n

    Over the course of the keypair setup, you will be asked to provide a secure passphrase. It is best to take some time now to determine this passphrase. It should be highly unique and highly secure. If you have any trouble creating a super secure password you can remember, use a Diceware passphrase<\/a>.<\/p>\n\n\n\n

    1. Choose the beginner options, unless you are an expert, and then click Next<\/strong>
      \"Email<\/li>
    2. On the key selection screen, indicate you want to create a new key and click Next<\/strong>
      \"Create<\/li>
    3. Select the account you want to use and provide you secure passphrase:
      \"Select<\/li>
    4. Be patient, it will take a while to generate a secure keypair
      \"It<\/li>
    5. After the key generation is complete, save your \u201cRevocation Certificate\u201d to a secure location; you will be prompted to do this; further explanation follows<\/li>
    6. Click Next<\/strong> to proceed and Finish<\/strong><\/li>
    7. To upload your public key to a keyserver, choose Enigmail from the toolbar and Key Management<\/strong>
      \"Choose<\/li>
    8. Right-click your key and choose upload public keys to keyserver<\/strong>
      \"Right-click<\/li><\/ol>\n\n\n\n

      Enigmail has a list of available keyservers already loaded and will automatically submit your key. Allowing your public key to be hosted on a public keyserver allows other to easily find your key to send you encrypted messages.<\/p>\n\n\n\n

      Even though your public key is registered with a keyserver, this does not mean that strangers will sign your key without taking special care to make sure it is legitimate. Likewise, you should only trust and sign keys from users you trust.<\/p>\n\n\n\n

      Testing Out Your Encryption<\/h2>\n\n\n\n

      You must be excited to start sending encrypted messages now. But wait, you may not have anyone in your address book who is using encryption. In order for the process to work correctly, you have a recipient who is also using encryption. You will need a public key from your recipient in order to send an encrypted message that they can decrypt with their private key.<\/p>\n\n\n\n

      The Free Software Foundation has a bot named Edward whom you can communicate with to test your keys. Enigmail lets you draft an email with your public key included. This means Edward will have your public key and will reply with an encrypted message.<\/p>\n\n\n\n

      1. Under Enigmail<\/em> choose Key Management<\/strong><\/li>
      2. Right-click your key and select Send Public Keys by Email<\/strong>; this will draft a new message<\/li>
      3. Address your message to edward-en@fsf.org<\/code><\/li>
      4. After a few moments, you will receive an encrypted reply from Edward<\/li>
      5. You may be prompted for your passphrase to decrypt it, otherwise, the message should come through clear<\/li><\/ol>\n\n\n\n

        Now that your keys have been tested and are working correctly, you can always send an encrypted test message to Edward, and, in a few moments, he will reply. You can also practice signing Edward\u2019s key and view it under Enigmail<\/em> -> Key Management<\/strong>.<\/p>\n\n\n\n

        Using the Revocation Certificate<\/h3>\n\n\n\n

        You may remember, earlier in the key generation process, you were asked to save a \u201crevocation certificate\u201d. If you saved the file to your computer earlier, it would be to wise to move it to a secure place. This key can be used to revoke and nullify your keypair. It should be used if you decide to longer use your current keypair or if you believe your private key has been compromised. Suggestions for a safe hiding place include an encrypted drive or a thumb drive in a locked vault. You may use your own discretion in choosing a safe place for this key.<\/p>\n\n\n\n

        How to use the revocation certificate in order to nullify your key is not covered in this article.<\/p>\n\n\n\n

        Important Points to Remember<\/h2>\n\n\n\n

        As you are enjoying sending encrypted messages to friends, there are a few things you must remember to keep up best security practices.<\/p>\n\n\n\n