Updated 02/28/2020
Introduction
If you’ve been following along, then you know I’m on a quest to increase privacy across my digital life. The next stop on that journey is email. This system of communication has become so ubiquitous that we hardly give it much thought. We communicate over it with service providers, friends/family, random blogs, and any number of other entities. Since it’s a digital form of communication some get a false sense of its security, but that couldn’t be farther from the truth. Let’s take a moment to look at the current state of email in 2019.
How It Works
It’s sometimes easy to take for granted how digital communication works these days. We assume that what we’re writing is only being seen by ourselves and the intended recipients. But that isn’t necessarily true, especially in the case of email. In fact, it might be helpful to visualize email as more akin to its physical cousin, snail mail. A friend of mine once said it’s best to consider any email you send to be like a postcard. When you send a postcard it is secure in your house, and therefore somewhat safe. You then place it in the mailbox and send it off through the post office routing system. Along that route it passes through many hands. Those who have malicious intent, or are just nosy, could read it any time they want. Eventually it comes to your recipient’s house, where it is then again somewhat safe due to being in their residence. The same is true with email. Your mail provider places a lot of effort into securing their servers with encryption and other measures. However, once your email leaves there and is being routed to the recipient’s mail it is open and vulnerable. Once it arrives there are measures that keep it safe on the destination as well, but in between it’s basically completely open. Besides all of that, your mail provider likely uses data mining on your emails in order to serve you targeted ads. So even when the email is “safe” it is still being accessed by other parties.
The lesson here is that email should NEVER be considered private. Don’t put anything in email that you wouldn’t put on a postcard.
Safeguarding Email
There are some options for locking down your email and making it secure. Mostly this means using an encrypted service. Providers such as ProtonMail (great review here) offer end-to-end encryption, meaning that even they can’t see your email. There is a web client to securely access the service, or you can download their mobile apps. There are shortcomings in comparison to the convenience you’re used to (such as searching for a subject), but overall it’s a great way to secure your email.
The Downside
If it’s so great, why isn’t everyone using it instead of data vacuums like Gmail? Well, there are reasons. Remember our postcard scenario? Imagine if you sent someone a postcard and they received it just fine but couldn’t read it. With secure email services your recipients cannot read your emails unless you provide them with a password or public key to decrypt the messages. There aren’t a lot of friends that would do that just so they can receive email from me, much less people I barely know.
Also, your email is now sitting on their provider’s servers. Even if ProtonMail takes steps to ensure they can’t read your email it doesn’t mean your friends’ service lives up to the same standard. And any email they send to you will definitely have all of the same pitfalls of normal email. Plus, if someone forwards the email on then all bets are off.
Lastly, if you forget your password then all of your email is lost to you. This is the blessing and curse of ProtonMail not having access to your mail. They can’t snoop on you, but they can’t recover it for you either.
Conclusion
So, what’s a privacy-focused nerd to do? Even though services like ProtonMail aren’t as easy to use as traditional ones that doesn’t mean you should ignore them. As the funny taco commercial once said “Por que no los dos?”. Use ProtonMail for sensitive business emails or personal ones containing identifying information, and keep your usual service for all the spam you get from Old Navy and emails coordinating pot lucks. If you want to keep those from being data mined, swap to something like an iCloud address. It’s run by a major corporation too, but they don’t scan your email the way Google or Microsoft does.
Personally, I already stay away from putting anything in email I don’t have to. I prefer to use secure messaging systems for personal contacts (iMessage or Signal). If secure information needs to be emailed, you can always place it on a cloud storage service that is encrypted and then send them its link. This reduces the amount of storage being used on both email services (sender/recipient), lets you configure the link to only be accessible to certain individuals (either read or write), and lets you bypass the insecure digital postal system already discussed.
Be mindful of what you’re sending and how. And choose the option that works best for your situation.
Update (02/28/2020)
After more consideration I decided to go all in on ProtonMail. And you know what? It was completely painless. At the moment I’m using the free tier, but will likely bump up to the paid one soon (Same with their ProtonVPN service). Everything is working great, but there are some nice perks when you upgrade. Also, you help support their mission by being a paid subscriber, and creating a web where we are free to communicate privately is a mission I believe in.
I’ve forwarded my other data-hungry accounts to it and started swapping services one at a time. So in the end not only is my email more secure but I’ve also achieved a secondary goal of consolidating the mass of email accounts I’ve collected over the years.
You don’t have to use ProtonMail (well, you don’t have to do anything) but I would advise joining the private email movement. It’s really very little effort for the return you and the rest of the internet community receive in return.