Email encryption

Hi everyone. I have some questions about email encryption. I don’t understand concept of E2E encrypted mail, and just encrypted mail, as privacy policy of some services says.

For example, Tutanota says:
all user data is stored end-to-end encrypted in Tutanota (except for email addresses of users as well as senders and recipients of emails)

and Disroot says:
All emails, unless encrypted by user (with gpg for example) are stored on our servers in plain-text.

But also they say:
We use disk encryption on all data to prevent data leak in cases where servers are stolen, confiscated, or in any way physically tampered with.

And privacytools says, that on both this providers encryption is “Built-in”

So, how my Email encrypted when I send it from Tutanota account to Gmail account, for example? And how my disroot emails encrypted, if when servers stolen nobody can access data, and emails stored in plaintext?
I clearly understand E2EE in XMPP or Signal, for example. But when data is accessible from cloud at any time, it doesn’t look like E2EE.

your email on their server (tuta) will be encrypted but not end to end encryption it just encrypted and your copy on gmail will be not

Yes because first its encrypted and because they said they encrypt the full disk

you are right, E2EE needs to exchange keys to encrypt but your friend does not using same app so there is no way to exchange keys (thats why you can lock email with password to protect it while sending it to other company (gmail)) but your email from your company (lets say tuta) will be encrypted so tuta will not (or can’t) access it otherwise google can :smiley: (fuck google)

If you want end-to-end encryption, there are at least two possibilities:

  1. You use Tutanota’s feature that allows your recipient to access your encrypted e-mail via a web form in the web browser. You need to send a password to the recipient but your recipient doesn’t need any public OpenPGP key. This works because the e-mail content never actually leaves Tutanota but stays encrypted there until accessed by the recipient. Google only learns about the fact that there is some encrypted e-mail waiting for the recipient on Tutanota servers, but Google can’t access it.
  2. Your recipient creates an OpenPGP key pair and sends you the public key. This allows you to encrypt your message using the public key of the recipient. Then, the recipient can use the corresponding private key to decrypt the e-mail.

Besides, there is transport encryption (TLS) between e-mail servers. However, transport encryption only protects data in transit (data that is sent between servers). Transport encryption doesn’t protect data at rest (e.g., stored on a hard drive) or data in use (data in the main memory of a computer). On the other hand, full-disk encryption only protects data at rest.

In theory, your e-mails are secure if somebody steals the servers. However, in reality, this isn’t the common scenario. Commonly, attackers compromise databases and copy their contents. In this case, your e-mails are likely exposed.

Security in XMPP is quite similar to e-mail security.

Thank you for the answers, it much more clearer now. But I still don’t understand a few things

But if somebody can encrypt something, he can decrypt it as well. If I send email to gmail, for example, it need to exit tutanota’s servers in plaintext. But OK, messages stored on their servers encrypted. What key do they use to encrypt it? My password, hash or something else?

Yes, PGP is really powerful thing, I need to learn how to use it.

Generally, I need email only for registration and notifications. I want to choose service, that will provide good security and will store my mail encrypted on servers. If necessary, I will encrypt message myself with PGP. Also, I want to use email apps like K-9. Is it possible?
I don’t need much from email, so I prefer free plan.
Also, there is other email services like Dismail or Riseup, but they isn’t in the list. Can I use them, or there’s something wrong with them?

As far as I am aware of, they are using full disc encryption and in case the servers reboot, they have to physically visit there to give the password.

In case of Riseup, they are an invite-only service with a goal of people knowing the people they are inviting and thus hopefully avoiding abusive users, so I view listing them as a disservice towards everyone.

The email list in general is pending a rewrite.

i guess they use your password (at least im sure protonmail does) and most of big websites your password is hashed so yeah its harder to decrypt your emails (on protonmail’s\tuta’s servers) but do not be happy because maybe in someday your email provider be evil and send that little JS file to steal your decryption key and decrypt your emails (its long story but yeah be sure you not safe 100%)

When you use Tutanota’s feature to send password-protected e-mails, then Tutanota 1) encrypts your text using this password and stores the encrypted message on its servers + 2) sends an additional notification to the recipients that contains a link to 1). So, yes, there is a plaintext e-mail sent to Gmail, however, it just contains a link. Then, the recipient has to open the link and enter the password you set up before. This decrypts the message in the web browser of the recipients. In this case, an attacker who somehow got the password and the link can also access the message.

Most services like forums, warehouses etc. don’t support OpenPGP. So if you don’t have any recipients/senders that support OpenPGP, you don’t have to learn it. For friends and family members, it is considered best to use a modern end-to-end encrypted instant messenger.