Review: Yahoo puts email encryption plugin source code

Yahoo has shared the source code for a new email encryption plugin. The code is now on GitHub. Yahoo asks security experts to look at it and find any problems.

What is the Yahoo email encryption plugin?

The plugin lets users add end‑to‑end encryption to their Yahoo Mail messages. End‑to‑end encryption means that only the sender and the receiver can read the message. Even Yahoo cannot read it.

The plugin is built on a well‑known standard called OpenPGP. OpenPGP is a set of rules that many encryption tools follow. By using OpenPGP, the plugin can work with other encryption programs.

Why did Yahoo open the code to the public?

In 2013, documents leaked by Edward Snowden showed that the U.S. National Security Agency (NSA) had spied on many internet services, including Yahoo and Google. After those leaks, Yahoo promised to improve its security.

One way to improve security is to let many eyes look at the code. When many experts review the code, they can find bugs faster. Yahoo’s chief security officer, Alex Stamos, wrote a blog post asking the community to help.

Stamos also said the plugin should be ready by the end of the year. He talked about it at the South by Southwest (SXSW) conference in Austin, Texas, on a Sunday.

How does end‑to‑end encryption work?

When you write an email, the plugin scrambles the message body. Scrambling is also called “encryption.” Only the person with the correct key can unscramble it.

The subject line and some technical data (metadata) are not encrypted. This is because email servers need that information to deliver the message.

Think of a locked box. The message is inside the box. Only the person with the right key can open the box. The address on the box (the subject line) is still visible so the mail carrier knows where to deliver it.

How can a regular user set up the plugin?

Yahoo says the plugin will be easier to use than the GPG Suite for macOS. Here are simple steps a user might follow when the plugin is released:

• Step 1: Go to the GitHub page and download the plugin files.
• Step 2: Open Yahoo Mail in a web browser.
• Step 3: Follow the on‑screen guide to install the plugin. The guide will ask for permission to add a small extension to the browser.
• Step 4: Create a pair of keys – a public key and a private key. The public key can be shared with friends; the private key stays secret.
• Step 5: When you write a new email, click the “Encrypt” button that the plugin adds. The message will be scrambled automatically.
• Step 6: Send the email as usual. The recipient will need the matching private key to read it.

If a user already uses GPG Suite, the plugin can import existing keys, making the switch smoother.

Why does Yahoo work with Google on encryption?

Yahoo and Google have been cooperating to make their email services more private. Both companies have released Chrome extensions for end‑to‑end encryption on GitHub.

Working together helps set common standards. It also means that a message encrypted with Yahoo’s plugin can be read by someone using Google’s plugin, as long as both follow OpenPGP.

What other security steps has Yahoo taken?

After the Snowden leaks, Yahoo started encrypting traffic between its data centers in March 2014. This means the data moving inside Yahoo’s own network is scrambled.

Google does the same for its own data centers. Encrypting internal traffic protects user data from attackers who might try to tap the network.

Both companies also released Chrome extensions for end‑to‑end encryption, showing a pattern of open‑source security work.

FAQ

Is the Yahoo email encryption plugin free?

Yes. Yahoo has posted the code on GitHub for anyone to download and use without paying.

Do I need technical knowledge to use the plugin?

The goal is to make it easier than existing tools like GPG Suite. Basic steps are explained in the installer, but having a little comfort with installing browser extensions helps.

Will my email subject line be hidden?

No. The subject line is not encrypted. This is needed for email servers to route the message correctly.

Can I use the plugin with other email services?

The plugin works with Yahoo Mail. Because it follows OpenPGP, you can exchange encrypted messages with users of other services that also support OpenPGP.

Conclusion

Yahoo’s decision to publish the source code of its email encryption plugin shows a strong move toward openness and security. By inviting experts to review the code, Yahoo hopes to find and fix bugs before the plugin reaches everyday users. The plugin aims to bring strong, end‑to‑end encryption to regular Yahoo Mail users in a simple way. If you care about keeping your emails private, the upcoming plugin could be a useful tool – especially as more services adopt the same OpenPGP standard.