Hacker News Reader

Comment by Johnny_Brahms | Hacker News Reader

I donated £50. I use GPG to encrypt every unencrypted incoming email in my inbox (I'm self hosted) so that nothing is stored unencrypted. I had one server breach a year ago (due to me not updating...), but thanks to gpg I knew my mails were secure from prying eyes.

I sore the mails unencrypted locally though. Being able to search them is too useful to give up.

View on HN

Did you use gpg instead of disk/partition encryption for that scenario?

Disk encryption only protects against physical theft of the drive, which is not the primary concern with most servers. If a server is up 24/7 and I hack into it, it doesn't matter that the drive is encrypted since I have access to the decrypted files anyway. Encrypting incoming emails works because the mail server doesn't really care what the content of the email is, so decryption keys don't have to be stored on the server.

Can you give some more information about your setup?

In which phase to you encrypt the email, what tools do you use, etc.

Just use a procmail rule to call gpg on every incoming email before it's stored using your public key, then your client (configured with your private key) can decrypt every email as normal.

Here's my over engineered setup: https://github.com/jakeogh/gpgmda It attempts to also store the metadata encrypted. Admittedly got a bit carried away trying to hide mtimes.

Reply on news.ycombinator.com