Almost every mail provider now calls itself encrypted. The word covers very different things: the connection to a website, the link between mail servers, the way messages sit on disk, or true end-to-end encryption where only the recipient can read a message.
Knowing which one you are getting is the difference between real privacy and a line on a pricing page.
Encryption in transit
When your browser shows a padlock, the connection between you and the provider is encrypted with TLS. Mail servers usually use TLS when passing messages to each other as well.
This stops someone on the network, such as a public Wi-Fi operator, from reading your mail as it travels. It does nothing once the message arrives. Each provider along the way receives the message in readable form.
Nearly every provider does this. It is the baseline, not a feature.
Encryption at rest
Encryption at rest means messages are encrypted on the provider's disks. The important question is who holds the key.
- The provider holds the key. This protects against a stolen hard drive, but not against the provider itself, a rogue employee, or anyone who can compel the provider to decrypt.
- The user holds the key. Mail is encrypted to a key only the user can unlock. A copy of the database is useless without it.
End-to-end encryption
End-to-end encryption means the sender encrypts the message for the recipient before it leaves their device, and only the recipient can decrypt it. No server in between can read the body.
This is what most people picture when they hear "encrypted email". For ordinary email between different providers, it only happens when both people use a standard like OpenPGP. No provider can turn a message that arrives from Gmail or Outlook into an end-to-end encrypted one after the fact.
What Neir does, precisely
We would rather be specific than impressive.
- In transit: connections to Neir use TLS, and mail clients cannot connect without encryption on any port.
- At rest: the webmail copy of every message body and attachment is encrypted to your own OpenPGP key before it is stored. That private key is itself encrypted with a key derived from your Account Key, and decryption happens in your browser.
- End-to-end: available with anyone who uses OpenPGP (see below).
And the limits, which we publish on How Neir works:
- Incoming email arrives over SMTP like all email, so our mail server handles it in readable form while receiving, filtering and scanning it.
- A standard copy is kept for IMAP and POP3, so mail clients work.
- Sender, recipients, subject and timestamps stay readable, so mail can be routed, listed and searched.
Neir is not end-to-end encrypted for ordinary email. Any provider that claims otherwise for mail arriving from Gmail or Outlook is describing something it cannot do.
Getting real end-to-end encryption
If a message must be unreadable to every provider, the sender has to encrypt it for the recipient before sending. Neir supports this with OpenPGP:
- Download your public key from webmail settings and share it with the people you write to.
- Save their public key on their contact in Neir.
- When you write to them, webmail offers to encrypt the message to their key, in your browser, before it is sent.
Only they can read the body. The subject line and addresses stay visible, as they do with all OpenPGP email.
Questions to ask any provider
- Who holds the key to my stored mail?
- What can the server see, and at which moment?
- What is logged about my connections, and for how long?
- What do you need from me to create an account?
If a provider cannot answer these as plainly as it uses the word "encrypted", treat that word with care.
Photo: Estormiz, Wikimedia Commons, CC0.