My point of view related to email security is: whenever possible emails should be protected with PGP/GPG while transporting, but it doesn't have sense to store encrypted emails in local mailbox (this doesn't add to security but make complicated searching in mailbox and processing it using scripts).

There is perfect tool for Windows: GPGrelay. It works like local POP3/SMTP relay server, encrypting outgoing emails and decrypting incoming (it can append to incoming email status information about used encryption/checked signature, so user able to see this information in decrypted email received by his MUA) and thus "add PGP support" for any MUA.

I need to find similar tool for Linux.

Running POP3/SMTP relay like GPGrelay is one option, but there are other possible solutions, like using some sendmail-wrapper script for encrypt/sign while sending emails from MUA and some other script executed by procmail or .qmail for decrypt/verify while receiving emails.

For now I've found only kuvert, which is able to encrypt/sign sent emails, but I didn't see any solutions to automatically decrypt/verify emails for GnuPG (I've only seen old procmail recipe for PGP).

I'm using mutt and qmail, so non-universal solutions compatible with them acceptable too. I managed to configure mutt to store in mailbox unencrypted copy of send email, and automatically decrypt email when trying to open it, but this way I see only decrypted email and don't know is it was signed correctly:

set fcc_clear=yes
message-hook '~h"Content-Type: multipart/encrypted"' 'push <decrypt-save>\cu^<Enter>'
  • I am also interested in this and tried to start with a procmail solution, would be great could make this approach work: superuser.com/a/261493/53616 – student Dec 12 '12 at 12:31

There is a new project having this kind of idea but a little more evolved. It is called STEED and is pushed by the maintainer of GnuPG

  • Correct me if I'm wrong, but looks like this is just an idea/proposal. Which is at least 1 year old, and I didn't see any real project (i.e. source code, yeah) behind it. – Powerman Oct 5 '12 at 19:11
  • You're totally right. Right now, no sources, just the concept. We should ask Werner where is it now if he has worked on it yet – Dolanor Oct 6 '12 at 13:21
  • Seems like STEED is inactive. – serv-inc Nov 19 '18 at 4:15

In transport, decently set up mail transport will only ship mail over SSL/TLS. If you don't want prying eyes en route, you don't want them on stolen notebook/backups/discarded disk/...

  • 1
    Using SSL for SMTP/POP3 doesn't provide same security guarantees as using PGP. – Powerman Jan 16 '13 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.