Filtered Allows You to Encrypt Select Gmail Messages
Since the revelation of NSA access to Google Gmail servers, it’s clear that Gmail is readily browsable by authorities without a warrant. Furthermore, using PGP encryption with your contacts is difficult to set up and get both parties to use – it’s also not integrated well into smartphone email clients.
But, here’s a middle way approach…
The new Filtered Open Source IMAP application offers the capability (with an advanced module extension) to route individual messages and mail from specific contacts into a secure folder. When mail is detected in the secure folder, it’s encrypted and stored on your Filtered server – and deleted from gmail.
Filtered offers a straightforward installation guide for any Linux-based server, including a ready made solution for inexpensive cloud host Digital Ocean.
Here’s how it works:
Drag Messages to the Secure Folder to Encrypt Them
Once you’ve installed Filtered and configured your gmail account, you’ll see a +Filtering/Secure folder in Gmail.
Drag a message to the Secure folder. Filtered will scan the Secure folder and encrypt it on your server. In the open source release, scanning the secure folder currently occurs every three hours – but it’s easily changed in the code (see DaemonController.php -> actionHourly() and remove the %3 from the function that calls scanPrivate).
You can also train any email sender/contact to automatically route to the secure folder. Visit the Senders page and find the specific contact you wish to route. Then, update the sender’s settings to route to the Secure folder. In the future, all emails form this sender will be routed to the secure folder.
Specific Senders Can Be Automatically Encrypted
You can browse secure messages on your Filtered server (as shown at the top of this post) and view them as shown below.
View Your Secured Messages
The subject, plain text and html messages are stored in your MySQL database using mcrypt, a standard encryption library provided with PHP. You can configure a custom salt key in your initialization file to increase the strength of the encryption. Warning: Message attachments are not supported in the current release and will be lost. Make a feature request here.
Once encrypted, messages will be deleted from your Gmail account. Currently, this just places the message in Gmail/Trash for scheduled deletion (usually 30 days). This can be modified in the code to purge immediately. Update Remote.php -> scanPrivate() so that after closing the imap connection, it reopens the [Gmail]/Trash folder and purges messages in there.
Keep in mind that if someone gains access to your Linux server or your account login into your Filtered web application, they’ll be able read and/or decrypt your secure messages. If they access your account_salt from your ini file, it’s trivial for them to decrypt your messages. The positive aspect is that the Yii Framework we use with Filtered does a good job at eliminating common attack scenarios such as SQL injection.
Here’s how the code encrypts and decrypts your messages:
Encrypt:
$td = mcrypt_module_open('tripledes', '', 'ecb', '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
$account_salt = Yii::app()->params['account_salt'];
mcrypt_generic_init($td, $account_salt, $iv);
$subject = base64_encode(mcrypt_generic($td, $m->subject));
$body_text = base64_encode(mcrypt_generic($td,$r->getPlainText($uid)));
$body_html = base64_encode(mcrypt_generic($td,$r->getHtml($uid)));
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
Decrypt:
$td = mcrypt_module_open('tripledes', '', 'ecb', '');
$iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
$account_salt = Yii::app()->params['account_salt'];
mcrypt_generic_init($td, $account_salt, $iv);
$str = mdecrypt_generic($td, base64_decode($str));
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
Share this: