Activate the mailbox Guard

Activating the mailbox Guard

Activating the Guard automatically generates a PGP key pair for you, which mailbox stores securely. A PGP key pair consists of a public key (for encryption) and a private key (for decryption). The Guard protects access to your private key with a separate password.

In the key management section (under All settings | mailbox Guard | Your keys), you can download the keys (or key pairs) created on our server and – if available – import them into your local PGP installation or your local mail client. This allows you to use the same PGP keys in both the web client and your mail client, and access emails encrypted with them.

If you want to learn more about PGP, we recommend the following links as a starting point:

• PGP on Wikipedia: https://en.wikipedia.org/wiki/Pretty_Good_Privacy
• A somewhat older but still accurate introduction by Netzpolitik.org (in German)
• A good introduction as a video crash course on YouTube (Part 1)
• The Guided Tour in mailbox Office itself: in this Knowledge Base article
• The online help and documentation for Guard: in this Knowledge Base article

Requirements for the mailbox Guard

• Active mailbox account
• Access to the web client at https://office.mailbox.org
• (Optional) An existing PGP key pair

Activating the mailbox Guard – Step-by-step setup

The mailbox Guard allows you to encrypt your emails securely directly in the web client – without additional software. Thanks to the server-side PGP integration, messages can be encrypted and decrypted conveniently.

Step 1: Open the web client

1. Log in at https://office.mailbox.org using your mailbox account.
2. Click the gear icon in the top right to open All settings.

Step 2: Activate mailbox Guard

We provide you with a step-by-step guide:

1. In the Admin area, navigate to mailbox Guard.
2. Click on Start.

Figure 1: Start the mailbox Guard.

You will now see a pop-up window welcoming you to the Guard and guiding you through the initialization with a setup wizard. Click on Start and enter a password in the following dialog.

After setting up the Guard, you will be presented with an overview of the Guard settings.

Figure 2: Our mailbox Guard-Default settings.

mailbox Guard – Explanation of default options

In the mailbox Guard default settings section, you define how the web client behaves when composing and sending encrypted emails.

Composition options

• Encrypt email drafts when composing encrypted emails
  Saves drafts of encrypted messages already encrypted on the server.
  → Recommended for maximum security with sensitive content.

• Send emails encrypted by default when composing
  Automatically enables encryption when possible (e.g., when a valid public key of the recipient is available).
  → Convenient for users who regularly use PGP.

• Add signature to outgoing emails
  Automatically signs emails with your private key.
  → Allows recipients to verify the authenticity of the message.

Options

• Remember password default setting
  Defines if and when the password for the private key is requested:
  • Always ask: Highest security – password is required every time it is accessed.
  • Remember for session: More convenient – no re-entry needed during a session.
  • Never ask: Only suitable if the device is fully protected.

These settings can be adjusted at any time and apply by default to all new messages.

Step 3: Set up key pair

In the new mailbox Guard environment, you will find the menu item Your keys.

Figure 3: Your personal Key-list.

Create a new key pair

• Please select the Create new button under the menu item Your keys.
• Assign a secure password for the private key.
• Confirm the creation.
• The key pair is stored server-side and is ready for immediate use.

Import existing key pair

• You can choose to upload a private key and/or a public key.
• Enter the corresponding password.
• Confirm the import.

The private key is stored encrypted and can only be decrypted with your password.

Step 4: Encrypting and decrypting emails

After activating the mailbox Guard, an integrated PGP function is available in the web client:

• A lock icon appears when composing a message.
• If recipients have a valid public key, encryption is automatic.
• Received encrypted messages are decrypted on the server, provided you possess the private key.

Deactivating and resetting the Guard

If you want to deactivate the Guard, please create a support ticket at Support with the subject "Please deactivate Guard". Caution is advised: resetting the Guard deletes all stored key pairs on our servers. Without PGP keys (and access to them via the PGP password), you will no longer be able to open emails or files encrypted with this key. The only way out would be if you have created a backup of the keys; otherwise, you will no longer be able to read or open the encrypted emails and data afterward (see also article Guard password forgotten – what to do).

Important notes about the Guard password

The Guard password protects access exclusively to your private PGP key. Please note the following:

• The password is not stored by mailbox and cannot be recovered.
• Losing the password means permanent loss of access to encrypted emails.
• Be sure to back up the created key pair after setup (export and local storage) to avoid data loss.

Keep your password and private key in a secure place – ideally offline and encrypted.

General important notes

• The Guard can be deactivated or the key pair replaced at any time.
• mailbox has no access to your passwords or private keys.

For more information on managing PGP keys, see our article on PGP encryption in the web client.