 loud and clear - interoperable end to end encryption (E2EE) across email providers is critical for privacy and security online. We have taken this feedback to heart. We are proud to announce support for PGP encryption inside Skiff mail starting today for all users across all tiers, including Free.

We built Skiff Mail to provide the best privacy, performance, and usability in a modern email product. This means making highly opinionated decisions to improve privacy, using modern cryptography to ensure performant mail clients, and not burdening users with key management. We are confident that this remains the correct decision today as over one million users today have trusted Skiff Mail for their communications in under 18 months since launch. All Skiff to Skiff messages are unchanged and still remain completely private, including content and headers.

PGP is the opposite. PGP has weaker privacy standards because it lacks subject line encryption. Modern PGP is not performant because it requires downloading all attachments to read. Imagine downloading all your attachments before you can read a few sentences in an email. PGP key management is byzantine with very little clear documentation and tooling accessible to non-technical users. PGP simply has not adapted to modern standards preventing larger commercial deployments without considerable time and effort.

However, PGP does have a dedicated community working tirelessly to improve the protocol and is one of two interoperable standards for E2EE email. Simply put, PGP is a viable way to send private messages when communicating between mail providers. We hope to launch additional encryption options in the future so that every email can be sent end-to-end encrypted.

With these limitations, our team has worked tirelessly to ensure that our expectations of simple, private, and performant mail client is applied to PGP. For existing aliases, users can generate a new PGP key with a single click, and every new address added to Skiff Mail will automatically generate a PGP key. All PGP keys are generated using secure defaults: ECC with Curve25519. PGP keys can also be imported, if you want to use an existing key from another mail provider. Users can also seamlessly send PGP encrypted mail to mail providers that publish key directories - such as ProtonMail - as well as many other domains.

On the Skiff end, this interoperability is also critical. We’ve implemented PGP standards to allow automated sharing of our users’ public PGP keys via the Web Key Directory (WKD) protocol. In many email clients, this key lookup process can leak your IP address. With Skiff, however, we prevent this data leakage because all key lookups leverage the same technology that masks users’ IP addresses when downloading remote content in an email. If Skiff cannot find the PGP key via the WKD protocol, you can import a PGP key into any Skiff contact.

We’ve implemented custom protocols to optimize PGP content to make sure mail clients stay performant while preventing accidental data loss by preventing key deletion if a PGP message is still encrypted with that key. Even with the limitations of PGP, users should expect the same simplicity, privacy, and performance they expect with Skiff.

Looking forward, we hope to launch WKD support for custom domains and all other domains on Skiff, which will enable seamless PGP encryption with other mail providers. If you have any suggestions or feedback, please don’t hesitate to reach out to the team on 

Full PGP support in Skiff

On April 3rd, Hosting Advice published an interview with our Director of Security, 

, on how Skiff pushes the envelope in providing end-to-end encrypted, privacy-preserving products. Skiff offers four products - Pages, Drive, Calendar, and Mail - for end-to-end encrypted collaboration and communication. Skiff is continuing to make privacy-preserving advancements, from end-to-end encrypted real-time collaboration to client-side search algorithms, to improve the next generation worksuite.

Today, individual users can take advantage of our collaboration suite for free or gain access to custom domains and additional storage on our Essential plan for just $3/month. For teams, Skiff products offer a feature-complete solution to the Google and Microsoft style productivity suites for communicating and collaborating on Pro and Business Plans.

Larger teams can also take advantage of custom domains, shared teams, and shared links for collaborating externally. We also launched 

 with Pro and Business tiers for individuals, families, and teams. Skiff’s paid tiers offer more storage space (up to one terabyte per user), extra email aliases (up to fifteen per user), additional version history, and shorter email aliases.

To learn more about how Skiff works, check out our technical whitepaper at 

. Our whitepaper details technical specifications of how end-to-end encryption protects your data across all Skiff products.

If you’re looking to learn about how Skiff does real-time collaboration with end-to-end encryption - an industry first - check out 

. We also wrote a detailed technical blog on how Skiff performs 

 over your data - keeping it private at all times.

, allowing others to review and inspect the product codebase. Please don’t hesitate to contact us with any questions.

 to ask questions, propose new features, or try out beta releases early.

Total Privacy - No Ph.D. Required

Despite the continuous evolution of instant messaging apps, email is an irreplaceable part of our daily communication. It’s also the one we use to share lots of private information, so comprehensive security measures are crucial for ensuring confidentiality.

This article will provide actionable advice on keeping your email protected from third parties and staying safe online.

Choose a security-oriented email provider that guarantees data protection

Take control of your sensitive data with Skiff

Types of email attacks you must protect yourself from

Email is the most common vector for cyberattacks, with 

 being at the highest risk. The number of phishing attacks 

, and hackers are getting more sophisticated with their manipulation tactics.

The following table explains phishing and other 

 so that you can familiarize yourself with dangers online:

As daunting as these attacks seem, most are preventable if you follow the right 

Set strong passwords and enable two-factor authentication (2FA)

Tread carefully with suspicious links and 

 is bothersome and risky, so people tend to set the ones they can remember easily. This is a common mistake that may lead to numerous breaches.

To keep your account secure, make sure the password doesn’t contain:

Personal details (name, birthday, street)

Easy-to-guess keystroke patterns (asdfgh, 1qaz2wsx)

Your password should be a complex combination of random alphanumeric and special characters.

 There’s a high chance you won’t remember it, so you can use a reliable password manager to keep all your login credentials in one place.

If your email client supports 2FA, take advantage of this option, as it can be an excellent security layer. Not every email service provider (ESP) offers it, in which case you can use a third-party solution. Even if someone breaches your password, they won’t have access to your account without the one-time code sent to your 

Think twice before following a link or downloading files

As explained, phishing entails the attacker manipulating the user into taking action. In most cases, you’ll get an email saying you must log into an account to avoid suspension. The email might seem legit at first glance, but the link will take you to a spoof page designed to steal your credentials.

That’s why you should never click on a link unless you’re certain the email is coming from a trusted source.

 Pay attention to the phrasing the sender is using or any visual signs, like strange logos. Another good idea is to look at the email address rather than only the sender’s name, as closer inspection often uncovers a fake account.

The below screenshot is a perfect example of a phishing attack. It’s an 

 email received from an attacker impersonating Amazon Prime and asking for billing information. 

There are four obvious signs the email isn’t genuine:

“Prime” isn’t written as a proper noun, and the sentence construction is incorrect

Some phishing attacks might be harder to spot, but there’s almost always a tell-tale sign you’re dealing with a scammer. When in doubt, 

it’s best to reach out to the company in question

 and confirm the request you received is genuine before taking any action.

Email attachments should also be approached with care, as they might contain malware. 

Don’t download email content from an unknown sender, and use malware detection to scan attachments before opening them.

Skiff's zero-knowledge login feature supported by end-to-end encryption prevents all unauthorized access from the moment you log in

Get a safe email environment

The risk of data breaches through unsecured networks increased with the rise of remote work. If you tend to take your correspondence outside of the office, make sure you have the right security measures in place.

Despite the convenience of public Wi-Fi, you should stay away from open networks as much as possible. There’s a high chance you’ll need to connect to them at some point, so you might consider investing in a VPN (Virtual Private Network) solution. It encrypts your connections and masks your IP address, making it harder for attackers to intercept your mail and 

not all VPNs are reliable, and the solution is not bulletproof

, so your best chance of staying safe is avoiding public networks completely.

you should still secure them to minimize the attack surface

, especially if you work from home. The simplest way to do this is by setting a strong password, but you can add extra security layers by enabling the firewall and using Wi-Fi network encryption.

Choose an email service provider with end-to-end encryption

. As the name implies, it protects your emails from the moment they leave your device until they reach the recipient. E2EE turns readable plain text into cipher text using an encryption key, and the only person who can access them is the recipient with a decryption key. Even if someone intercepts the email, they won’t be able to access its contents without the decryption key.

 or Yahoo don’t offer this level of security.

. TLS protects your email while it’s in transit but does nothing to secure it when it’s resting on the provider’s 

Even providers claiming to offer E2EE don’t always provide as much 

 as advertised. This is because they store decryption keys on their server, which gives them access to users' emails. 

To gain full control over your data, you should opt for a solution that lets you create and store the key without sharing it with the provider.

 ensuring complete confidentiality and privacy, 

Protect your correspondence and data with Skiff Mail

 uses advanced E2EE to safeguard users’ data and give them full ownership over the information shared via email. The platform ensures 

 from the get-go, as you don’t even need to leave any personal information to sign up. Skiff supports zero-knowledge login powered by the Secure Remote Password algorithm, so the account won’t be tied to any PII (Personally Identifiable Information).

When you sign up, you can enjoy robust E2EE combining two separate keys:

Even Skiff’s team can’t access your data, as the keys are created by the user. You’ll have complete peace of mind knowing that all information you share online stays private.

Standout features separating Skiff from the competition

Skiff isn’t the only privacy-first email service, but it offers a comprehensive set of features most providers can’t match. The rich 

 gives users everything they need to fortify their online identity.

You get 10 GB of storage, which is enough to store all your important files without worrying about security breaches. You can also take advantage of free unlimited email and text search, a feature that most competitors place 

Skiff supports login with various crypto wallets for 

All the features are packed in a carefully designed user interface to let users of all skill levels send protected emails effortlessly. You don’t need to install any additional software or go through complex configurations to get started—E2EE on Skiff is automatic and takes place the moment you sign up.

Skiff is open source, so anyone can review the code and security measures.

 For more information on how the platform implements its encryption practices, check out the 

Collaborate safely with Skiff’s product suite

If you’re looking for a secure alternative to popular cloud workspaces, explore Skiff’s privacy-first platforms:

—Create unlimited docs and share them with your team to streamline your workflow without privacy concerns. From a rich text editor to intuitive collaboration features, Skiff Pages provides everything you need to stay productive

—Take advantage of secure storage for any type of 

. Skiff offers optional InterPlanetary File System (IPFS) integration, so you can opt to store your files in a decentralized environment

—Stay organized and schedule events with an end-to-end encrypted calendar. You can customize the platform’s features to adapt the interface and actions to your needs

You can sign up for Skiff in three quick steps:

To avoid losing your previous correspondence, you can migrate 

The platform doesn’t store unencrypted copies of your emails or files, so you can transfer them without risks.

If you need to scale up or want more features, you can upgrade to Skiff’s 

How to keep your email protected and safeguard your sensitive data

Phishing protection is a security measure designed to protect individuals and organizations from phishing attacks. Phishing is a type of online scam in which an attacker poses as a legitimate entity (such as a bank, government agency, or well-known company) in order to trick the victim into giving away sensitive information, such as passwords, login credentials, or financial information.

There are several different types of phishing protection available, including:

Email filters: These scan incoming emails for known phishing patterns and block or flag suspicious messages.

Web filters: These block access to known phishing websites or redirect users to a warning page if they try to access one.

Anti-phishing software: This type of software is installed on a device and helps to protect against phishing attacks by analyzing web pages and emails for suspicious content.

Training and education: This can involve teaching individuals how to recognize and avoid phishing attacks, as well as providing them with resources and protection solutions to reduce risk.

Overall, phishing protection is an important aspect of online security, as it can help to protect individuals and organizations from falling victim to these types of scams.

How can you protect against phishing attacks?

There are several steps you can take to protect yourself and your organization against phishing attacks:

Be cautious of emails and websites that ask for sensitive information: Be wary of emails and websites that ask for sensitive information, such as login credentials, financial information, or personal details. If you receive a suspicious email or visit a malicious website, do not click on any links or enter any information.

Use anti-phishing software: Install anti-phishing software on your devices to help protect against phishing attacks. This software analyzes web pages and emails for malicious content and can block access to known phishing websites or flag potentially malicious messages.

Use strong, unique passwords: Use strong, unique passwords for all of your accounts, and consider using a password manager to help you generate and store them securely.

Enable two-factor authentication: Two-factor authentication (2FA) adds an extra layer of security by requiring you to enter a code in addition to your password when logging in. This code is typically sent to your phone or email, so even if someone else has your password, they will not be able to log in without access to your phone or email.

Keep your software and devices up to date: Make sure to keep all of your software and devices up to date with the latest security patches and updates. This can help to protect against known vulnerabilities that could be exploited by attackers.

Educate yourself and others: Learn about phishing attacks and how to recognize and avoid them. Share this information with your colleagues and encourage them to be cautious as well.

By following these steps, you can help to protect yourself and your organization against phishing attacks and other online threats.

Phishing is a type of online scam in which an attacker poses as a legitimate entity in order to trick the victim into giving away sensitive information, such as passwords, login credentials, or financial information. Here are some of the most common phishing techniques:

: This involves sending a fake email that appears to be from a legitimate source, such as a bank, government agency, or well-known company. The malicious email may contain a link or attachment that, when clicked, downloads malware onto the victim's device or directs them to a fake website where they are asked to enter sensitive information.

: This is a targeted form of phishing that involves sending a personalized email to a specific individual or group, often with the aim of tricking them into divulging sensitive information or access to an organization's systems.

: This involves sending a fake text message that appears to be from a legitimate source, such as a bank or government agency. The text message may contain a link or phone number that, when clicked or called, leads the victim to a fake website or phone line where they are asked to enter sensitive information.

: This involves an attacker posing as a legitimate representative over the phone and asking the victim to disclose sensitive information.

By being aware of these common phishing techniques and knowing how to recognize and avoid them, you can protect yourself and your organization from falling victim to these types of scams. Here are a couple more detailed examples:

An attacker sends an email claiming to be from a well-known bank, stating that the recipient's account has been compromised and requesting that they click on a link to reset their password. The link actually leads to a fake website where the victim is prompted to enter their login credentials and financial information, which the attacker then uses to access the victim's account and steal their money or credit card number.

A scammer purchases a domain name and creates a fake website spoofing the login page of a popular social media app. They then send emails to a large number of users, claiming that their account has been compromised and directing them to log in to the fake website in order to reset their password. When the victim enters their login credentials on the fake website, the attacker is able to use them to gain access to the victim's sensitive data. This could lead to identity theft, bank account compromise, credit card theft, or impersonation of the victim.

Social engineering attacks refer to the use of psychological manipulation and persuasion to influence individuals to take actions that may not be in their best interest. In the context of phishing, attackers use social engineering tactics to create a sense of urgency or fear in the victim, making them more likely to take the bait and fall for the scam.

One common tactic used in phishing attacks is the creation of fake websites or emails that look legitimate, but are actually designed to steal personal information or install malware on the victim's device. These fake sites or emails may be made to look like they are from a legitimate company, government agency, or financial institution, and may contain logos and branding that appear authentic.

Another tactic used in phishing attacks is the creation of fake social media profiles or online profiles on dating or job websites. These profiles are used to build trust with the victim and gather personal information or persuade them to click on malicious links.

In addition to these tactics, hackers and phishers may also use pretexting, which involves creating a fake identity or situation to obtain sensitive information from the victim. This may involve pretending to be a co-worker or supervisor, a customer service representative, or a member of a trusted organization.

Overall, social engineering is a powerful tool that is often used in phishing messages to manipulate and deceive victims into divulging sensitive information or taking actions that they would not normally take. It is important to be aware of these tactics and to remain vigilant in protecting personal information online.

Ransomware is a type of malicious software that encrypts a victim's files, making them inaccessible until a ransom is paid to the attackers. Ransomware attacks can be financially devastating for businesses, as they can disrupt operations and lead to financial losses. To protect your data from ransomware, it is important to take the following precautions:

: This way, if your files are encrypted by ransomware, you will have a copy that you can restore.

Keep your operating system and antivirus software up to date

: This will help protect your computer from new threats.

Be cautious when opening email attachments or clicking on links in emails

: Ransomware is often delivered through malicious email content, including attachments and links. Do not open attachments or click on links from unfamiliar sources.

Avoid downloading software from untrustworthy websites

: Be sure to download software only from reputable sources.

: A firewall can help block incoming connections that may be malicious.

: Macros can be used to deliver ransomware. Disabling macros in office documents can help prevent this type of attack.

Ransomware can be some of the nastiest cybersecurity risks as hackers may charge millions of dollars for recovery. The tips above can protect you from these attacks.

If you believe that you have received a phishing email or have encountered a phishing campaign, there are several steps you can take to report it:

: Most email providers have a dedicated email address for reporting phishing scams. You can typically find this address by searching online or by contacting your email provider's customer support. Forward the suspicious email to this address to report it. Gmail and Apple products have spam filters and such functionality built in to their email clients.

Report the website to the Federal Trade Commission (FTC)

: If you have encountered a phishing website, you can report it to the FTC by visiting their website (

) and clicking on the "Report a Scam" button.

: If you are using a web browser like Chrome, Firefox, or Safari, you can often report suspicious websites directly through the browser. Look for a report phishing option in the browser's security or privacy settings.

Report the email or website to the company or organization being impersonated

: If the phishing email or website is pretending to be from a specific company or organization, you can report it to them directly. Many companies have a dedicated email address or webpage for reporting phishing scams.

By reporting phishing scams, you can help protect others from falling victim to these types of attacks and assist in the efforts to combat them.

If you think you may have been a victim of a phishing attack, there are several steps you can take to protect yourself:

: If you provided your login credentials as part of a phishing attack, it's important to change your passwords immediately. Use strong, unique passwords for all of your accounts, and consider using a password manager to help you keep track of them.

: Keep an eye on your accounts for any unusual activity, such as unexpected charges or login attempts from unfamiliar locations.

: If you received a suspicious email or visited a fake website as part of a phishing attack, report the incident to the company or organization that was impersonated in the attack. You should also report the attack to your email provider and to the authorities, such as the Federal Trade Commission (FTC) in the United States.

: This is an extra layer of email security that requires you to enter a code in addition to your password when logging in to your accounts. This makes it more difficult for attackers to gain access to your accounts even if they obtain your password.

: Stay vigilant and be on the lookout for other phishing attacks in the future. Use anti-phishing tools, such as browser extensions that can help identify fake websites, and continue to educate yourself about the tactics used by phishers.

Anti-phishing training is a type of security awareness training that teaches individuals how to recognize and avoid phishing attacks. Phishing is a type of cybercrime in which attackers send fake emails or websites that appear to be from legitimate sources in order to trick people into divulging sensitive information, such as passwords or financial information. Anti-phishing training helps individuals identify and protect themselves from these types of attacks by teaching them to recognize common tactics used by phishers and to be cautious when receiving emails or visiting websites that request personal information. This type of training can be provided through a variety of methods, such as online courses, in-person training sessions, or simulations that test individuals' ability to identify phishing attempts.

With email as a primary threat vector today, we recommend switching to 

 for private, end-to-end encrypted, and secure email. Here are some tips for using Skiff securely:

: By keeping your aliases random and private, hackers, cybercriminals, and scammers will have no idea who you are and how to find out real identity information. Skiff offers unlimited aliases (using dots and plus signs), even on the 

. Paid plans can access more aliases, shorter aliases, and custom domains.

: Skiff Mail reduces security threats and tracking by proxying remote content inside emails. This significantly increases user privacy by hiding your IP address and device information.

: On Skiff Mail, only you have access to your data. Even if a cyberattack were to compromise your network or data storage, all data is encrypted with keys that only you own - not the case on Microsoft or Google email products.

If you’re looking for robust email protection for yourself, your family, and your colleagues, you should switch to 

Email phishing protection

Nishil is the Director of Security and a Founding Security Engineer at Skiff. Previously, Nishil was a Staff Application Security engineer at Coinbase working to secure payments, identity, and user privacy.

Nishil Shah