2

There are many stories of leaked e-mails making news, and we know that repressive governments read emails to suppress dissent.

It would probably be possible to have CiviMail check a public PGP server for each outgoing email address, and if it found a public key, use it to encrypt the outgoing message by default. Perhaps there could be also be a user-requested preference to NOT encrypt as an exception.

Is this on the wish list ?

Improve this question
1

Not yet!

This could potentially be done from an extension in a hook like hook_civicrm_alterMailParams(), alongside a scheduled task to fetch GPG keys from keyservers (to avoid slowing down delivery with HKP lookups).

Another approach might be to handle this at MTA level with something like Zeyple (a PGP filter for Postfix).

Improve this answer
3
  • Think carefully about what it means to have GPG automated - there's a layer of trust with GPG that comes from the expectation that the sender was present to enter their GPG key on sending, for example ... Automating GPG encryption would sidestep this, but might still be beneficial in providing a layer of encryption to protect message content in transit. – Chris Burgess Mar 24 '17 at 18:27
  • That would be the point - to protect messages in transit, and in Inboxes that can be hacked. I don't understand about trust. If someone puts their public key on a key server, doesn't that imply that they are willing to accept encrypted incoming mail ? – InterestedGuy Mar 24 '17 at 23:43
  • I mean that typically if you receive an encrypted email, you can trust that the sender was present to sign it on sending. But with a CRM plugin, presumably the CRM can sign the messages "unattended". What we can trust about the sender is reduced from "was present to sign key at send" to "had access to CRM at some point". – Chris Burgess Mar 25 '17 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.