When you think about it, it's ridiculous: almost all of those billions of e-mails that find their way around the globe every day are sent in the clear with no encryption of any kind applied to the message. There are two ways to encrypt e-mail: with S/MIME, built into Apple's Mail application—but this requires getting (read: buying) a certificate—and GPG.

GPG is a command line utility and GPGMail is a plugin that lets Mail.app use GPG to create and check digital signatures and to encrypt and decrypt messages. Unfortunately, as the GPGMail team has put it, "GPGMail is a complete hack, relying on Mail's private internal API. Use it at your own risks!" One of these risks is that Apple brings out OS X 10.4 or 10.5 and it takes many months or even more than a year for an update to come out that supports the new OS. (But complaining is easy; GPGMail is open source, so don't complain too much. Help with coding instead.) Anyway, fairly recently, GPGMail 1.2.0 was released. Leopard users can finally read and write encrypted mail again. Yippee!

For those of you who have no idea what I'm talking about but are still reading:

These days, simply encrypting something is pretty easy. There are several strong algorithms around and computers are plenty fast to run them. The problem is: how do you make sure the intended recipient and nobody else is able to decode the message? This is where public key cryptography comes in. There are several algorithms that have two different keys: a public one for encryption or checking signatures, and a private one for decryption and creating signatures. Simply generate a pair of keys, keep the private one and publish the public one, and you're in business.

Well, not entirely. The problem that remains is how to be sure that a public key belongs to a certain person. For HTTPS/SSL, this issue is handled by "trusted third parties" (I'm sorry, I can't say those words with a straight face) such as Verisign or DigiCert, who provide a certain level of assurance that a public key (in the form of a certificate) belongs to the party the certificate says it belongs to. However, that's not free—not as in beer (certificates cost money) and also not as in speech, because only organizations that can bribe Apple, Microsoft, the Mozilla Foundation, et cetera get to be "trusted" third parties.

This is where GNU Privacy Guard (GPG) comes in. GPG is an open source tool that encrypts, decrypts, signs, and checks signatures. It also manages a "key chain" of public keys and a web of trust. The idea is that, rather than having a list of trusted third parties and trusting them when they say that someone is who they say they are, everyone manages their own trust relationships and exports these for use by others. So, if I trust Jacqui and Jacqui trusts Clint, just attaching her signature to his public key wouldn't ensure me that this public key is indeed Clint's. But if David and Eric also sign Clint's key, that's good enough for me and I'll trust Clint's key, too. (Note that "trust" just means "knows that this is indeed that person's key." It's perfectly reasonable to sign a stranger's key after checking his or her ID.)

GPG is a command line tool, but after installing it and generating a public/private key pair and uploading it to a key server, it's generally not necessary to use the command line—GPGMail adds a bunch of menu items to Mail that make it possible to use GPG from within Mail.