When email first became widely available, and for many years thereafter, it was about as private as sending a postcard, with your message visible to everyone who handled it. More recently, Gmail transmits your messages over secure HTTPS connections (as do most other webmail services), but the service itself still has access to your message content. Businesses know this, and take steps to secure their email traffic, especially considering the requirement for compliance with the CMMC (Cybersecurity Maturity Model Certification) program, recently upgraded to version 2.0. PreVeil was invented to serve those big businesses, but it’s also available for free to me, you, and other consumers.
What Do PreVeil’s Competitors Cost?
PreVeil offers native applications for Windows and macOS at no cost, as well as free apps for Android and iOS. In addition, you can log into your account directly, without installing anything. And the benefits don’t stop with encrypting your email. Your PreVeil account also includes online storage for your most important files, storage that’s secure, encrypted, and flexibly shareable.
Totally free is a great price. Like PreVeil, SecureMyEmail lets you keep your existing email, and it’s free to use with a Gmail, Yahoo, or Microsoft account. You’ll have to pay its $29.99 per year subscription fee if you use an unsupported account type or want to protect multiple email accounts.
Private-Mail offers a free tier, but it limits email and file storage to 100MB and omits some premium-level features. If you want the full 10GB of encrypted file storage and access to those premium features, you pay $69.99 per year for Private-Mail.
There’s no limit on sending or receiving messages in Tutanota’s free tier, but your ability to securely search saved messages is limited. Paying the 12 euro ($13.62) yearly price lifts that search limit and lets you access premium-only features.
ProtonMail likewise has a limited free tier, with 500MB of storage and 150 messages per day. Paying the $48 per year subscription price raises those limits to 5GB of storage and 1,000 messages. It also unlocks some premium features. such as setting up auto-reply. With StartMail you don’t get free as a choice; it simply costs $59.95 per year.
Like PreVeil, Virtru is the free personal edition of a larger business-focused product. It’s free, yes, but it has some serious limitations. Virtru works only with Gmail, and it only functions if you log into Gmail through Chrome. On the plus side, you can set Virtru messages to expire after a fixed time and apply extra protection to attachments.
Wrapped Keys and No Passwords
Any serious encryption solution needs to operate with zero knowledge. That means that the provider has no possible way to access your data. Only you hold the key, and only you can decrypt your personal data. When the provider has zero access to your data, it can’t be legally enjoined to provide access, and a disgruntled employee can’t illegally dig into your private information.
Here’s a simplified rundown of how PreVeil works. When you sign up, it creates a large cryptographic key that resides only on your computer or mobile device. Other components of the encryption process have their own keys. For example, if you put a file in a folder shared with another user, the file, the folder, and the other user each have distinct keys.
It would be handy to store the file’s key on the server—handy, but insecure. Instead, PreVeil encrypts the file’s key using the key for the shared folder and stores that on the server. It encrypts the folder’s key with the keys belonging to each user and stores those. They call this system “wrapped keys,” and it ensures that any malefactor who breaches the system won’t have any access to data. All decryption happens on your local device, of course.
SecureMyEmail doesn’t need a master password, but you do have to supply a passphrase for your PGP keys. Preveil doesn’t require a password at all. Your key lives on the device. To use it, you first must log in to your device and then log into your email system. That’s two authentication steps already, plus the need to have physical access to the device, giving you a form of multi-factor authentication.
Private-Mail, ProtonMail, StartMail, and Tutanota all support multi-factor authentication using Google Authenticator or an equivalent app. Tutanota goes even farther, allowing authentication using a Yubikey or another U2F (Universal Two Factor) security key.
PreVeil has a lot of encrypting and decrypting to do, and most of these operations use secure Public Key Infrastructure (PKI) technology. That cryptographic key on your device? That’s your private key. For the nitty-gritty encryption of actual data, it uses a speedier symmetric encryption system. It breaks the data down into equal size blocks, encrypts each block with a different key, and stores the keys in encrypted form using PKI.
It’s worth noting that Private-Mail, ProtonMail, SecureMyEmail and StartMail all use PKI, specifically a key-sharing system called PGP, for Pretty Good Privacy. On the one hand, this isn’t nearly the hyper-thorough wrapped keys system used by PreVeil. On the other hand, it means these services can exchange secure mail with anyone who uses an email system that supports PGP.
ProtonMail, SecureMyEmail, StartMail, and Tutanota also offer the ability to send encrypted messages to people who don’t use the service (and don’t have a PGP key). However, communication with nonusers relies on simple password-based encryption, so it’s significantly less secure. Since PreVeil is free for individuals, there’s no problem with simply requiring each recipient to install it to decrypt a message you’ve sent.
Virtru, like PreVeil, doesn’t require a password. The company manages your keys, and you just use Gmail more-or-less like normal. There is the option to include a plaintext message along with the encrypted content, and the recipient must click to decrypt. It’s not quite as seamless at PreVeil.
Shared Secrets for Key Recovery
Consumer-side security products frequently come with a disclaimer. You must acknowledge that if you lose the encryption key, you lose access to your account and its data. An early version of one security product laid out its policy thus: “I understand that if I lose my encryption key, I will be hosed.”
That doesn’t fly in a business environment. Suppose only the CTO has the key to unlock the company’s essential documents, and further suppose the CTO dies, or decamps with the key. The company can’t just shut down, and yet sharing the key more widely is a security risk.
The solution is something called Shamir’s Secret Sharing. Perhaps you’ve heard of the ground-breaking RSA encryption algorithm, named for its inventors? Adi Shamir is the S in RSA—the other two being Ron Rivest and Len Adleman.
The actual sharing algorithm uses finite field arithmetic in multiple dimensions…I think. Even I, a one-time math major, find it hard to grasp. But this is how it works, in simple terms. You give a partial secret to a recovery group of, say, six people. And you set a recovery threshold so that, for example, any four of them can re-create your lost key. It doesn’t matter which four, and the members of the recovery group have no access to your key.
In a business setting, you might make the board of directors your recovery group. The personal edition suggests you name three friends and allow recovery with the help of any two. With all the mega-math happening under the hood, the recovery system seems simple.
Easy Start
After hearing about the high-end cryptographic technology embodied by this program, you might expect it’d require a PhD to operate. Nothing could be farther from the truth, as I found when I set it up.
On the PreVeil website’s home page, you find a big button titled Create a Free Account. When you click the button, the site serves up the appropriate download for your Windows, macOS, Android, or iOS device. There’s one minor exception—on an iPad it offers the macOS edition. To install PreVeil on an iPad, you must go to the App Store for your download, which is no great effort.
During the install process you create a PreVeil account and add PreVeil to your email client. PreVeil automatically connects with Gmail and Outlook on Windows and Apple Mail under macOS. It also integrates with the native mail app on your mobile devices. If you use Thunderbird or some other email client, the program explains how to set up a profile for your encrypted messages.
There’s also an option to create a recovery file (a QR code) as a last resort to recover your account if you lose all your PreVeil-equipped devices. Do go ahead and save that file, then store it in a safe place. PreVeil makes it clear that recovery using the shared secrets mode is preferable, but the recovery file could save your bacon if for some reason the other method doesn’t work.
That’s it. You don’t have to change to a new email address the way you do with StartMail, ProtonMail, Private-Mail, or Tutanota. You don’t have to do anything special. Encrypted mail comes to a Secure Messages folder and replies to secure messages are encrypted automatically. Sending a new encrypted message is just a matter of making sure the Encryption toggle is turned on.
Of course, your email recipients must also use PreVeil. A recipient who doesn’t yet have it gets a message containing a link and instructions for installation. As soon as the new account is set up, your encrypted message appears in the Inbox.
With the Chrome extension active and your Gmail account open, encryption is turned on by default when you have the Secure Messages folder open, off by default otherwise (you can turn it on, of course). When encryption is on, PreVeil marks recipients who are also PreVeil users with an orange stripe, those who aren’t with a gray stripe. There’s no more warning about sending to non-users; they just automatically get a notification email with a link to start using PreVeil.
For users of Outlook or Apple Mail, PreVeil doesn’t offer the same visual cues. Mail sent from your PreVeil account goes out encrypted. Mail sent from your regular account does not. But it’s simple enough. PreVeil actual makes a plugin for Outlook that has a banner for the current message’s encryption status, a toggle for encrypting or not, and so forth. However, at present that plugin is reserved for business customers.
Simple Account Access
When you launch PreVeil, it opens a page in your browser with the unusual URL http://127.0.0.1:4003/mail/inbox/1. Those with some network experience may recognize 127.0.0.1 as the address for localhost, meaning your own computer. The odd address shouldn’t be concerning, because what you see in the browser looks like any other webmail system.
You can click to compose an encrypted email, of course. A menu down the left offers access to Inbox, Drafts, Sent, Trash, and any email folders you’ve created. The main area of the screen lists the messages in the selected folder, and clicking a message gets you a view of the message body. Simple!
Add a Device
Since PreVeil integrates with your regular email process, you probably won’t use it to just read and compose email messages. But you do need to launch the full PreVeil app to do other things, such as manage devices.
I mentioned earlier that your lengthy cryptographic key resides on your device, nowhere else. So how do you ever use encrypted email on multiple devices? The answer is built right into the application.
Start by selecting Add a Device from the Settings menu. The program prompt you to install PreVeil on the device before continuing. On the new device, you choose Add Existing Account. Once you enter the email associated with your account, PreVeil on the new device generates an eight-character one-use password that you enter on the old device, at which point PreVeil loads your crypto key onto the new device.
In testing, I had no trouble on Windows, Android, or iOS. Linking PreVeil to a macOS installation also worked fine, but I couldn’t get it to install the plugin for Apple Mail. It turns out that a recent change by Apple disabled the automatic connection, so I had to manually link my PreVeil account to Apple Mail. Doing so really made me appreciate the missing automation, as it’s a complicated process.
If you lose your device, or if it gets stolen, PreVeil can deal with that. When you select Device Management from the Settings menu, you get a list of associated devices. Here you can rename the device, remove the software, or lock the account without removing PreVeil. That last option is handy if you just can’t find the device. You can unlock it when found or remove PreVeil when you give up looking.
Web Access, With Care
In the event you want to connect with your PreVeil mail without installing the app, you can log in to web.preveil.com. You enter your email account, as you might expect, and then enable access just as you would when adding a new device. This does mean that you can’t just log in on an unknown computer—you must also have at least one PreVeil-equipped device with you.
I worried about the security of this operation, so I checked in with PreVeil’s CEO. He explained that the handshake process described above shares a temporary copy of your all-important key. The copy lives in the browser’s cache and vanishes when the browser closes, or after 24 hours. He clarified that if you use a compromised PC to connect, there’s a possibility the key could be captured, but even then, it could only be used on that same device. “That is why users should not use the capability to log in on public computers,” he explained.
Secure, Sharable Cloud Storage
In addition to encrypted email, PreVeil account comes with 10GB of cloud storage for your most important files. That’s the same amount you get free from Box, and quite a bit more than Dropbox’s paltry 2GB. If you want 10GB of storage from Private-Mail, you need an expensive premium account. Of course, the security of your files is paramount with PreVeil, unlike with standard cloud storage services.
PreVeil gives you easy access to your cloud storage by creating a folder in Windows Explorer. I didn’t spot the folder at first because it doesn’t have a simple name like “Google Drive File Stream.” Rather, the folder name is PreVeil followed by your email address, for example, “PreVeil-neil_rubenking@pcmag.com.” You can treat this folder like any other, moving files into and out of it, creating and editing files, and so on. But the files reside in encrypted cloud storage.
You can also access your files by opening the PreVeil app and selecting the Drive tab rather than the Mail tab. This is the spot to set up and manage sharing folders. Just point to a folder and click the Share button that appears. As with the email system, a recipient who doesn’t yet have PreVeil gets an invitation to set up a free account.
You can choose between four levels of sharing. At the Edit & Share level, the recipient has full access to view or change the file and can also share it with others. If you just choose Edit, the recipient can still make changes to the file but can’t pass it along to others. Read Only naturally means the recipient can read the shared item or download a copy but can’t modify it in any way. Finally, if you opt for View Only the recipient can look at the file in a browser-based viewer, with no download option. At present, only Office documents and PDFs support the View Only mode.
By contrast, Private-Mail’s secure file sharing defaults to using simple password-based encryption. If you want to share files with the protection of PKI, you must set up PGP again, with a separate set of keys from those used for email.
You’ll find a link icon next to each file that lets you perform a different kind of sharing. Clicking it copies a direct link to the file into the clipboard. However, the only people who can use that link are those who already share access to the folder containing that file.
Key Recovery
As noted, if a device with PreVeil installed gets lost or stolen, you can disable the app. But if you lost all your devices that have PreVeil, you’re in trouble. You can’t add a device without the aid of an existing installation. That’s where the key recovery system comes in.
As mentioned earlier, PreVeil encourages you to set up a recovery group of friends who also use the product. A common group setup would be three friends, with two required for recovery. The key recovery process is similar in many ways to establishing PreVeil on a new device. As in that situation, you start by installing the product and choosing to add an existing account. But instead of choosing to transfer the existing private key, you click Recover Key.
At this point, you enter your email address and wait for a message from PreVeil. After a couple of confirmations, you get a list of your recovery group members. One at a time, you have PreVeil send them a notification that you require account recovery help. When they approve the request, you use the phone or a secure IM app to tell them an eight-character password displayed by PreVeil. Don’t send that password via email or a simple text! Once you’ve reached the threshold that you set for number of approvals needed, you click to re-create the key on your local device.
The process is a little bit involved, it’s true, but the PreVeil website lays it out step by step. And being able to get your key back is certainly better than losing all access to your messages and files.
If you try to recover an imperiled account but haven’t set up a recovery group, you’ll get a discouraging message from PreVeil. The message implies that without a recovery group there’s no chance. The message is wrong, as long as you’ve created a recovery file, either during installation or later.
You can’t use the recovery file on a desktop computer—that feature isn’t ready yet. But you can open the file on your desktop and snap it using the PreVeil app on a mobile device. Once PreVeil is active on the mobile device, you can use that installation to enable any other devices.
Naturally you must keep the recovery file in a safe place. If by some mischance it gets compromised, all is not lost. You can create a new backup, a process that disables use of the old one.
High-Tech Privacy for Free
PreVeil uses security technology that’s suitable for protecting the most important business data—and complying with government regulations—but hides its complexity from the user. You don’t have to set up a new email address, you don’t have to change your email client. And for individuals, it’s totally free.
Other encrypted email solutions we’ve reviewed come with significant baggage such as a high price, limits on features, or the need to use a special email address. With PreVeil, you just start using it and get world-class protection for your email privacy. Combining top-tier technology, ease of use, secure file sharing, and no cost, PreVeil is our Editors’ Choice for encrypted email.
