Home/ Questions/Q 6820079
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T21:22:55+00:00

I need to send a secure email to my web site users who are

  • 0

I need to send a secure email to my web site users who are using services like hotmail, gmail, yahoo etc. I am reading about sending secure email via PGP but I am confused it this can be done with users who are using these public email systems ( and not enterprise email systems).

  1. Can someone please elaborate what exactly is the workflow for setting up a secure email? My understading is that we will have to have PKI infra-strcuture on our end and the users will have to install certificates on their machines. Is this correct?
  2. Can these certificates be used with email services like hotmail, gmail etc?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I don’t believe there’s a way that you can have integrated end to end encryption in most consumer webmail services; I’ve never seen a provision for public and private keys in any one I’ve used and my gut feeling is that the computational overhead for doing encryption doesn’t make sense to be running on the server. I’d be happy to be corrected on this point, however.

    One solution might be to send them a plaintext email asking them to sign into your website to receive the information (provided your website connection is SSL-encrypted). This way, a potential email interceptor only sees that the target has received an email with a link to your website informing them that a message is waiting for them but not explaining the content of the message.

    If you’re absolutely sure that you want to send them encrypted email using PGP, you could try encrypting the mail on the server with the user’s public key and sending it to them and expecting them to decrypt it themselves. However, for that to work you’d have to potentially generate a public/private key pair for the user and inform them of what “their” private key is, which defeats the purpose. In that case, a PKI setup is not the best idea, and a different shared-secret encryption method could be used instead.

    Signing your email message automatically is not difficult, but automated signature verification would again rely on the webmail service providing it. Chances are that the users would have to verify the email signature against your published public key.

    • 0