Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am aware that I can access GMail securely using SSL however what I would like to learn or know is that once I send an email, does that email remain encrypted?

share|improve this question
4  
no, your connection to gmail is secure, the path the email takes from gmail to wherever it is going is not secure. –  MaQleod Aug 22 '11 at 20:40
add comment

2 Answers

up vote 8 down vote accepted

For the most-part, "no," because SMTP transactions are not encrypted by default. If both sites do support encryption, and share the same mechanisms for encrypted transport, then this is possible, but it can't be guaranteed.

To be sure that your eMails are encrypted, encrypting them client-side can provide you with the assurance you need. Some eMail programs may have encryption features built-in (such as Pegasus Mail and some others), but chances are you'll need to use a third-party encryption tool like OpenSSL, GPG, or PGP (or rely on 7-Zip's AES encryption features to encrypt your message contents, file attachments, etc.), especially if your recipient isn't using the same eMail client software that you are. A challenge you may also run into with such third-party client-side preparations is that your recipients will also need to know how to perform the decryption.

Also, there are some portions of your eMail messages that cannot be encrypted for practical reasons, such as the destination address (otherwise how will the mail servers know where to send your message?).

Additional information

Many web-based eMail solutions, and also some POP3/IMAP4/SMTP servers, are accessible with encryption enabled. This is client-to-server communications, which is not the same as server-to-server communications (which is what is being asked about).

Although having client-to-server encryption is great, it's only securing one aspect of eMail transportation. The other places where your eMail could potentially be available to third-party observers in an unencrypted form are:

  • The mail server queue
  • Temporary files (on the mail server and/or your local computer)
  • During server-to-server message transport (in an unencrypted SMTP transaction)
  • Recipient's "inbox" directory
  • Hardcopy format exists (because the recipient printed the eMail)
  • SpyWare secretly sends a copy to a third party

It is usually assumed, however, that the recipient has taken reasonable measures to protect their system from basic security threats, and so the focus is typically on encryption between the sender and the recipient. Using client-side encryption technologies can certainly eliminate administrative issues with mail servers (e.g., untrustworthy staff at the ISP who like to snoop around in other people's eMail inboxes).

For a message like "Hi honey, I'll be picking up some groceries on he way home," encryption often isn't needed at all. For a message like "The password for the VPN is TunaBreath42," encryption is clearly beneficial. Weighing the importance of encrypting your eMails is only something that you can judge.

share|improve this answer
    
Thanks Randolf. Could you please elaborate on what you meant by client-server? –  PeanutsMonkey Aug 22 '11 at 21:03
    
The client-side is what the end-user typically deals with. The server-side is the back-end system that the client-side communicates with behind-the-scenes. For example, when you send an eMail, your client application (which can be a web page or a full-fledged eMail program) communicates with an SMTP server to send the messages; this is a client-server communication. The server-to-server communication is when one SMTP server sends a message to another SMTP server (which then stores it for the recipient to receive using their client-side interface). –  Randolf Richardson Aug 22 '11 at 21:07
    
Thanks. So if I wish to protect any information I email without knowing the type of security employed by SMTP servers, I take it it is best to use tools such as GNUPGP? –  PeanutsMonkey Aug 22 '11 at 21:14
    
Yes. Using client-side tools, such as GNUPGP (which I believe is the same as GPG), will also eliminate the potential server-side risks I mentioned. Make sure that your recipients also know how to decrypt your messages. –  Randolf Richardson Aug 22 '11 at 21:22
add comment

The SSL encryption only pertains to your web session with GMail, not the email itself. This means people cant snoop and see your login and password information.

Email can be encrypred on transport, however there is no guarantee that it is available at both ends.

If you want to truly have private email, look into 3rd party encryption tools, such as GNUPGP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.