Dear Posteo users and interested parties,

It is our desire to make the exchange of public keys for end-to-end encryption easier and more secure. Today we have taken a first step to this end: You can now publish your public PGP or S/MIME key in our new Posteo key directory and thereby also securely in the DNS, the internet’s so-called telephone book. In the coming weeks we will be progressively activating further options for the new Posteo key directory.

Background:
For a while now, various players in the area of internet security have been working on making the exchange of keys for end-to-end encryption easier and more secure. Public keys are to be securely stored and made available in the DNS. To this end, new, free standards will soon be adopted. For a long time, behind the scenes, we have worked on simplifying the key exchange process in multiple steps, to occur in line with the new standards. So far, the standards remain in draft format, but we consider them advanced enough that we have begun to use them.
#more#
The technical designation for the upload of PGP keys was determined some months ago. Over the last few months we engaged ourselves in the responsible working group, such that the DNS parameters for S/MIME keys also be determined by IANA, which is responsible for administration of the DNS in the internet. For us, S/MIME is an equally worthy and just as important encryption standard.

On Tuesday, the organisation also determined the technical designation for lodging S/MIME keys in the DNS.

Your public S/MIME or PGP key used to encrypt emails can therefore now be securely added by us to the DNS. There, others can find your key and use it to encrypt emails to you. Your key is stored in the key directory secure against falsification with standards OPENPGPKEY and SMIMEA, which are soon to arrive. This process corresponds to DANE technology: DANE secures TLS server certificates in the DNS, while OPENPGPKEY and SMIMEA secure (against falsification) public keys used for email communication, in the DNS. Keys for end-to-end encryption that are published in the DNS are also secured with DNSSEC, as for DANE.

Through the use of security technologies such as NSEC3, we also prevent the mass-collection of email addresses and keys from the DNS: A key can only be retrieved for a specific email address known to the person searching. This actively prevents the misuse of the DNS as a source of email addresses for spammers.

OPENPGPKEY and SMIMEA are to constitute an alternative to previously widespread key servers, which exhibit multiple problems:
Until now, anyone can upload your public key to worldwide key servers, even if you personally do not want this. In addition, anyone can upload a falsified key for you. Keys that are uploaded there can no longer be deleted. This results in multiple as well as outdated or incorrect keys for an email address being found in key searches on the worldwide key servers. On the key servers, a multitude of valid email addresses are saved, and can be found by spammers who request email addresses from key servers on a mass scale in order to send spam to these addresses. Anonymity is also affected by the key servers: With OpenPGP, anyone can see who has declared their “trust”, similar to a social network. Thus social connections can be openly viewed for each person. The new process at Posteo is implemented without exhibiting any of these weaknesses.

The Posteo key directory is found in the settings of your Posteo account, under “PGP and S/MIME encryption”.

Before uploading your key to the Posteo key directory, please check whether it conforms to the Posteo guidelines. To protect your privacy, you can only upload a key that contains your Posteo email address or one of your aliases, among other things.

The new OPENPGPKEY technology is already implemented in the standard software GnuPG, and Verisign is working on an SMIMEA plugin for Thunderbird. We hope that the dissemination of OPENPGPKEY and SMIMEA proceeds quickly, so that the exchange of public keys becomes easier and more secure.

Best regards,

The Posteo team

Dear Posteo users and interested parties,

Moving to Posteo just became even easier. With the Posteo migration service, you can now transfer more than just your existing email accounts (including folder structures) to Posteo at the click of a button.

From now on, the migration service also transfers your previous address book from most large providers to Posteo. You can conveniently transfer your contacts to Posteo without requiring any special technical knowledge.
#more#
Because we do not use any third-party solutions at Posteo for the transfer of your personal data, we have developed individual solutions for the secure transfer of your data from each of the providers listed. In particular, your contacts’ sensitive data (e.g. name, address and phone numbers) are not transferred via a third party at any point. The data is collected by Posteo directly from your previous provider and transferred to your Posteo address book via an encrypted connection.

Posteo address book migration is available for the following providers:

AOL
Gmail
GMX
iCloud
Microsoft services such as Outlook.com, Hotmail, Office 365
Yahoo!
WEB.DE

The migration service is found in the settings of your Posteo account under “My account”.

You can decide yourself whether you would like to permanently delete your email and address book data from your previous provider.

The Posteo migration service is free of charge. It was developed in line with our principle of maximum data economy. Thus, for example, we do not save the email address from which you have transferred data to Posteo.

Tip: After migration you can individually encrypt all data you have saved with Posteo. Available for this purpose are Posteo’s address book and calendar encryption and Posteo crypto mail storage (for your email data). For both features you do not require any special technical knowledge; the encryption occurs at the click of a button. These encryption features are found in the settings of your account under “Encryption”.

Best regards,

The Posteo team