Guide for encrypting mails using pep

This is a guide to encrypt emails using [pep app](pep.security). Pep is available for download for [Android](https://www.pep.security/en/android/), [iOS](https://www.pep.security/en/ios/), and for desktop, it is available as an [add-on in Thunderbird](https://pep.software/thunderbird/).

-------Review this-----
The Thunderbird addon is not recommended because it disables OpenPGP in Thunderbird.
----------------------

For Android, pep app is available on [F-Droid](f-droid.org) and Google Play Store. Download the pep app in Android. The app will ask you for the permission to read contacts and download files. Permission to read contacts is to autofill the contacts when writing mails and the permission to download files is to save attachments in your phone. Both permissions are optional and can be changed at a later time. Set up your email account by entering email account and password. In case you have a Google Account, select “Use OAuth 2.0 token”. Depending on your email provider, you might have to manually enter IMAP/POP and SMTP details. These details would usually be available on the website of your email provider. Pep then asks whether to store messages securely which means https://www.pep.security/docs/general_information.html#store-messages-securely.Then, on the next screen, set an account name and a display name for outgoing mails.

You can also import your private gpg keys to pep app.

The first mail from a pep user will be unencrypted, but when you reply to that mail, you can check the 'Privacy Status' of that user which should be yellow. This means that the message will be end-to-end encrypted.

In order to mitigate MITM attacks, pep has introduced a feature called [handshake](https://www.pep.security/docs/general_information.html#handshake). You can do this by pressing the Privacy Status icon and then comparing the Trustwords using other means of communication. Select "Confirm" if the Trustwords match, otherwise select "Reject". Now you will see a green icon on the Privacy Status of the contact you handshaked with. It says 'Secure & Trusted'.

From now on, all the future messages to this contact will be encrypted with GPG. This means that your email provider cannot read your mails as well as the subject of the mail (as they are encrypted with your private keys). The email provider will still have metadata-- whom you contacted you and when. But sending encrypted mails is better for privacy than sending unencrypted mails.

The same steps work for pep in iOS as well.