Do you use Zoom? Most of us started using the platform since the pandemic began. And though Zoom went from 10 million daily users in December 2019 to 300 million daily users in April 2020, its security and privacy practices came under sharp scrutiny when the experts discovered Zoom's end-to-end encryption was not quite end-to-end! People discovered that their private conversations were never private in the first place. And pranksters and bored teenagers were easily able to "Zoom bomb" public meetings with shocking content.
It was ultimately discovered that Zoom was using point-to-point encryption (P2PE) system instead of end-to-end encryption (E2EE). Now, both encrypt the data exchanged by the users, but there is a difference. With P2PE, the server can access users’ messages, while E2EE encrypts information on the sender’s device and decrypts it only on the recipient’s end.
This brings us to the importance of end-to-end encryption as a platinum standard for protecting private conversations, data, files, and messages. Let us take a deep dive into how end-to-end encryption ensures the protection of your data.
As the name suggests, end-to-end encryption protects your data right from the time you send an email to someone till it reaches your recipient’s inbox and they read it. Essentially it means that when you use E2EE to send an email or a message to someone, no one in the middle – for example, no one monitoring the network can see the content of your message. Not hackers, not the email providers, and not even the government!
Most email clients or service providers use encryption methods that protect your data only in transit (traveling from one destination to the other). In such cases, the email providers can access the content of the messages (not necessarily for malicious purposes) because they hold the encryption keys. The end-to-end encryption method removes this possibility because the email service provider does not have the decryption keys to decrypt your message, which makes it more powerful.
It is like receiving a message intended for you in a box with a lock that only you can open with a unique key!
End-to-end encryption uses asymmetric encryption, also called public key encryption, involving the use of two keys - a public key and a private key. While anyone, including the email client, can view the public key, only the recipient knows the private key. In E2EE, your data is encrypted with the public key but can only be decrypted with the private key, which is unique to each recipient.
It means in E2EE, encryption occurs at the device level before the messages are sent and are not decrypted until it reaches the recipient. This way, hackers or any other third party cannot decrypt or access the message at the server level because they do not have private keys.
For example, picture a scenario where Alice wants to send a private message to Lucas. Using E2EE, Lucas shares a public key with Alice, which will encrypt the data Alice sends over a server. Now, there is a possibility of this data getting hacked if someone, let us say, Bob gets hold of the public key in transit.
But because Alice and Lucas decided to use public encryption, it doesn’t matter whether Bob makes a copy of the public key or not. He still cannot read or access the message sent to Lucas because he does not have the private key to decrypt that message. Only Lucas has the private key. This way, end-to-end encryption ensures only Lucas can read Alice’s message.
The obvious advantages aside, the impenetrable end-to-end encryption does have some limitations that remain a source of potential exploitation.
So, should you use end-to-end encryption? Definitely, yes. There is no downside to you introducing more cybersecurity. But the question now is are there any email security solutions that can offer all the advantages of E2EE and also rise above the limitations imposed?
RMail – a global email security solution from RPost is one such solution.
Protection against threats is of course one of the primary objectives of email and message encryption but there is only one way to ensure that more users adopt it. The encryption must be easy and simple to use for the sender as well as the recipient. RMail accomplishes this seamlessly by adapting smartly to the encryption modes offered by the users’ email clients and switching the email encryption accordingly.
RMail uses a double-layered encryption protocol to protect your messages and content:
It is the default encryption mode for encrypting emails. The transmission level encryption feature transmits the message encrypted using a configurable level of TLS or Transport Layer Security and auto decrypts the email and attachments for the recipients. TLS is nothing but a form of security protocol designed to facilitate privacy and data security with its primary use case being encrypting the communication between web applications and servers. Your recipients do not need to enter any password, click any link, or install any software to decrypt the message. And they can see the “Registered Encrypt” markings in the email body and subject line, which makes the message stand out in their inbox and tells them that it is encrypted.
This is another unique aspect of RMail’s encryption. At any point, if the RMail server senses that the recipient’s email client does not have TLS or has a lower level of TLS than the minimum TLS threshold, the email will automatically revert to RMail’s “message level” encryption option. All this happens behind the scenes without bothering either the sender or the recipient. RMail automatically wraps the email content and attachments inside an AES 256-bit encrypted PDF to guarantee 100% end-to-end encryption. What this means is that the message and all attachments remain encrypted within the recipient’s email inbox, and are encapsulated inside a PDF file. These can be read only after decrypting in the recipient’s PDF reader (outside of the inbox). If the recipient saves the file, it would remain saved in the encrypted file format, unless the recipient extracts the attachments and chooses to use them as normal files.
RMail offers several features that make its E2EE unique.
On top of these, with Registered Encryption, senders receive a certificate of encryption with all the email forensics for court-admissible proof of encryption.
It is believed that it was Leonardo da Vinci who pioneered the concept of cryptography and encryption by inventing one of the first rudimentary forms of public-key encryption centuries ago - a portable container to safeguard documents.
Encryption has come a long way since then. Speaking of that, despite its limitations, end-to-end encryption is widely considered the go-to for any email client or messaging app. And yes, even Zoom switched to E2EE.
RMail is simple to use, easy to install, and does not require any extra training for your teams. It not only raises cybersecurity awareness for your staff but also delivers in-the-moment secure email recommendations and prevents important emails from going out unencrypted, which could be a bigger risk in terms of fines and reputation.
Plus, it is much more affordable at scale, which means you can use it as much as you want without worrying about a dent in your wallet. Try it to send secure emails for free!
