What is a GnuPG public key?
GnuPG, the Gnu Privacy Guard, is a free/libre application for secure communication and data storage. It is available for Windows, Mac OS X, Linux, several BSD variants and other *nixes from www.gnupg.org. It is used to digitally sign and if desired to encrypt messages and files. Signing and encryption are done using a secret key. Verification of signatures and decryption are done using the corresponding public key.
GnuPG is OpenPGP-compliant. www.openpgp.org.
To verify the authenticity of a digitally signed e-mail you will need GnuPG or OpenPGP installed on your computer. With that in place follow these steps;
- click on a public key link on this page. My public key will be displayed in a new browser window.
- save that file unmodified to your computer (ie using the menus "File" > "Save Page As...")
(alternately you can right-click the public key link and use "Save Link As..." or your browser's equivalent.)
- import that public key to your keyring
(For GnuPG use "gpg --import <public_key_filename>")
With the public key added to your keyring you can now click the digital signature icon on the e-mail to verify the identity of the sender.

Why digitally sign e-mail?
The proliferation of spam, viruses and other nuisances commonly relies on what is termed "social engineering". This boils down to tricking the user into activating malicious code. Common methods include making an e-mail appear to be from a trusted sender and/or disguising the true nature of attachments.
Digitally signing e-mail protects against these threats on two levels;
- If a sender digitally signs e-mails, recipients are alerted that something may be amiss if an e-mail is received apparently from that sender, but lacking the signature.
- Verification of signed e-mails using the sender's public key proves the authenticity of the sender.
Using GnuPG or OpenPGP allows you to verify signed e-mails you receive and protects those you communicate with by allowing them to verify your messages.

What other methods can protect against e-mail abuse?
There are many ways you can protect yourself and others from abuse of e-mail communications. Some of these are;
- Use only plain text e-mail. HTML e-mail can contain malicious code in the message itself.
- Use throw-away e-mail addresses (such as free ones from Hotmail or Yahoo) to sign up for any contests or promotions.
- Use an e-mail client that does not run scripts in e-mails automatically. Mozilla's e-mail component is good in this regard and has excellent client-side spam filtering. www.mozilla.org
- Set your antivirus to scan all e-mail, incoming and out-going. Keep your antivirus up to date.
- Use a router between your computer and the internet, even if you only have one computer on the connection. A router with firewall enabled prevents illicit use of many of the ports through which malware or crackers attempt to communicate to and from your computer.
- If your e-mail address must appear in a website, have the webmaster generate e-mail links with client-side scripting (ie javascript) or otherwise obfuscate your address so it cannot be harvested by web bots or spiders.
