How I kept my email secure

From the author himself.

All the steps I took to (try to) make my email more private.

Introduction

Hi people, this is Ana Chica. In this piece I’d like to show everything I’ve been studying and the tools I found to make my emails more secure. Remember that nothing here is a rule — I’m just sharing my strategies.

🚀 Your Job Search & Resume Builder in One App ✔ Find new job opportunities ✔ Create ATS-friendly CVs

• **📲 Download Now & Start Applying***

Understanding how email works

How does email work?

Well, this image illustrates the whole path an email takes when you press send:

• SMTP (Simple Mail Transfer Protocol) is the protocol responsible for sending, receiving, and relaying email messages over the internet;
• IMAP (Internet Message Access Protocol) is the protocol that lets you access that email on any device because the content isn’t downloaded to your machine — you read directly from the email service;
• POP3 (Post Office Protocol version 3) is the protocol where you download the service’s messages to your machine.

If you want to read the material I looked at, I’ll leave it linked below.

How Does Email Work? A Dummies Guide

Why is email insecure?

Even though this communication method is very popular, it’s quite insecure because there’s no encryption (yes, that’s complicated), emails can be easily intercepted, it’s very easy to create an account and impersonate someone else, among other problems that, if we dig too deep, would depress us with so much misery.

Given all these issues, IT’S VERY STUPID to send confidential information like passwords, credit card numbers, or bank account details by email — so please don’t do that, thanks. If you must send such data, use communication methods focused on privacy.

Why email is not secure

How to make email more secure

From what I researched, there are ways to make email communication more secure using OpenPGP (thinking about communication with other people), but honestly this method has many limitations compared to other real-time communication services like Signal, for example. In this case it’s ideal to use an email client (I use Thunderbird) to receive messages from services you sign up for online and use other channels to communicate with a friend, for example — I don’t even know why some people choose to communicate by email, honestly kskskskksskks.

Email Security

Email strategy

Checking

First of all, check whether the emails you currently have have already been exposed on this site:

Have I Been Pwned

I checked and one of my emails had been exposed some time ago, so I created a new one and started from scratch; I migrated all the services I had signed up for — it was work but worth it.

Have an account for each purpose

If you use a single account for everything (bank account, online services, games, etc.), if someone wants to hack your account it’ll be much easier for them to mess you up, right? After all, it’s one account for everything. If you “split” your internet service usage across several accounts you won’t lose everything at once; if someone tries to hack your gaming account, your banks will be safe because they’re on a different account. With that in mind, I decided to create 5 accounts, 4 on Gmail and 1 on Tuta Mail, for these uses:

1. Personal (Gmail): Apps I use daily, government sites, etc.;
2. Games (Gmail): All my game accounts;
3. Content creation (Gmail): Account for social networks and that stuff;
4. Dev email (Gmail): For programming studies and to put on my resume, LinkedIn, GitHub, to communicate with potential employers;
5. Secure email: I use a Tuta Mail account for recovery of the above accounts and to log in to banks and investment brokerages.

Google email

Security settings in Thunderbird

In Thunderbird we need to configure the program; I’m using this video as the basis for my settings:

Thunderbird Email Client

General

• Uncheck: When starting Thunderbird, open this page in the message pane;
• Change the Google search engine to DuckDuckGo. And that’s it — there isn’t much else to tweak here.

Privacy and security

• Uncheck: Allow remote content in messages;
• Uncheck: Remember sites and links I visited;
• Enable: Tell sites not to sell or share my data;
• Enable: Warn if the displayed message is a possible scam;
• Enable: Antivirus applications may quarantine a received message;
• Enable: Automatically enable encryption when possible. That’s it — not much in the settings, because just moving away from Gmail already solved a good chunk of the problems, not all, obviously, but a lot.

Private email

Tuta Mail

There are other privacy-focused email options but I chose Tuta and that’s it — I read the documentation and liked the philosophy; there’s no deep criterion.

Tuta

As I said earlier, this email will be focused on recovering the other Gmail accounts, banks, and brokerages. Obviously I’m doing all this with several accounts but the ideal would be to pay for Tuta — but do I have money for that? No, so I’ll do my best with what I can.

2FA/MFA

What is 2FA/MFA?

You’ve probably heard of it and may already have an extra authentication factor to access your Google account, for example. These authentication factors are additional checks to prove it’s really you trying to access your account, so you don’t rely solely on your password. This video explains and shows several authentication methods simply; I recommend watching:

Protect your Digital Identity: Discover the Power of Two-Factor Authentication

Some distinctions:

• MFA (Multi-Factor Authentication): multiple authentication factors, more than two;
• 2FA (Two-Factor Authentication): second authentication factor. There are various methods to validate access, from biometrics, NFC, facial recognition, authenticator apps, to physical security keys — each with pros and cons. For daily use I’ll focus on apps and physical security keys.

Authenticator app

The app I chose was Aegis:

Aegis Authenticator

It’s open source, local, and allows manual encrypted backups of my tokens — that backup option is exactly why I switched to it, since the one I used before didn’t offer that. In the content I made about my passwords I set up a sync system with Syncthing and Tailscale; just as I synchronized my passwords across my devices, I did the same with this backup file.

Pico Keys

I also want a physical security key but since I don’t have 600 reais to pay for a YubiKey I’ll skip it for now. There is the PicoKeys project:

Pico Keys

For that I’d need to buy one of their small modules.

If I’m more financially comfortable later I’ll buy one and make a specific tutorial.

Aliases

From what I researched, aliases are:

an additional email address, like a mask or disguise, that can be used for a special purpose, protecting your primary address. In this step-by-step guide, learn how to add alias addresses in Gmail, Outlook, Tuta Mail and iCloud Mail — quickly and easily. So that’s it. With this understanding of aliases, let’s do what we did with emails and create an alias strategy.

I’m basing this on a video that helped me structure the strategy:

How Email Aliases and SimpleLogin can Shield Your Emails from Spam and Phishing!

These are the categories I’ll use:

• For shopping sites (Amazon, AliExpress, etc.);
• For content creation (social networks I create content for — Medium, Instagram, etc., tools like Canva, Pinterest, etc.);
• Government sites (self-explanatory);
• For studies (study platforms for public service exams, course platforms, etc.);
• For general entertainment (games, streaming, reading platforms, etc.).

That’s it — for now I’ll use AliasVault through the website itself and later I’ll self-host on my server since it has an option to export the database.

If you want a video that explains more deeply how this tool works I recommend this one:

Email Aliases + Password Manager in ONE App | AliasVault: The Ultimate Privacy Tool

Since this tool functions as both a password manager and an alias manager, I’m only using the alias function, and the passwords sit there unused. I’m not going to delete the whole system I made with KeePassXC for this — I value the effort I put into all those configurations. Thanks, you’re welcome.

Finale

And that’s what I did.

If you liked it, like, comment, and share to boost this content.

Thank you for being a part of the community

Before you go:

👉 Be sure to clap and follow the writer ️👏️️

👉 Follow us: **Linkedin| [Medium](https://medium.com/codetodeploy)**

👉 CodeToDeploy Tech Community is live on Discord — **Join now!**

Disclosure: This post includes affiliate and partnership links.