The quiet success of Autocrypt and Deltachat

PGP has been around for about 35 years, more or less, and the single reason emails are rarely OpenPGP-encrypted is most people don’t know how to use OpenPGP. To get it right, we need to know what asymmetric encryption is, which algorithms and key sizes to use, how to include the correct key in our email signatures and how to make backups of our private keys. OpenPGP requires effort to use, and most of us invariably choose convenience over security.

Autocrypt, which is an abstraction layer for OpenPGP, goes a long way to solving this, almost to the point we can have end-to-end encryption effortlessly between certain email clients. K9, Thunderbird, Mutt and Emacs, and a few others, already implement Autocrypt, so it’s very much a standard.

In Thunderbird, this can enabled in the ‘End-to-end encryption’ configuration menu. In there, we just need to enable OpenPGP support, add an end-to-end key and set the Autocrypt mode. Thunderbird can then send an Autocrypt Setup Message in the header of outgoing emails, so the recipients’ email clients should detect it

Delta Chat

This is where secure messaging comes in: Delta Chat looks and functions very much like any messaging app, but the messages being sent and received are actually emails that are encrypted using Autocrypt and OpenPGP. The encryption is configured without the user needing to be aware of it.

Delta Chat is ‘federated’ in the sense it will work with any email service that supports IMAP, and virtually anyone with their own domain will have their own email server. It’s unlikely to work with GMail and Outlook accounts, though, as Google and Microsoft generally don’t like that sort of thing.

A major advantage Delta Chat has over most other messengers - and why I recommend it more - is no phone number is required to register a profile. In fact, users don’t even require an existing email address.

To get started, the user sets up a profile in the app. By default the app will register a new email address on the testrun.org messaging server, but existing email accounts can also be added.

The email address and password for the testrun.org account can be viewed in the Advanced options, but they can’t be changed currently.

There are a few limitations.

Delta Chat is designed primarily to encrypt emails and present them as messages, and is not designed to provide anonymity by default. But, again, most ‘secure’ messaging apps are manifestly not anonymous either, because a phone number is required to use them.

We can still use Delta Chat anonymously, if we register an email account and used Delta Chat exclusively over a VPN connection. It also has built-in support for HTTPS, SOCKS5 and Shadowsocks connections.

Delta Chat doesn’t allow the importing of OpenPGP keys generated by another application. I think the reason for this is to protect users from badly-chosen algorithms and key lengths. I also haven’t found a way of exporting the OpenPGP keys from the app.

In summary, I can see this becoming a messaging app of choice for those who want privacy, and it’s definitely worth seeing how things work with Autocrypt enabled in our email clients.