Operational PGP: A Guide to Secure Email Communication
2024-12-24
This guide isn't about installing or using PGP; it's about using it securely. It emphasizes operational security beyond just encrypting email content, covering email composition, storage, key management, and more. It recommends composing emails in a text editor, avoiding saving drafts in email clients; generating and destroying keys frequently; avoiding publishing keys to keyservers; keeping email subjects blank to minimize metadata leakage; using the `gpg --throw-keys` option during encryption; enabling encryption by default and explicitly choosing whether to sign emails. The goal is maximizing PGP's security potential.