NSA proof email providers?

Hey Lains, what email providers do you know of that are NSA proof? Or mostly NSA proof? I'm explicitly looking for something hosted in a country hostile to US interests so that US law and FIVE EYES have no jurisdiction and limited/curtailed surveillance capability within the country hosting the email service. I'm not looking to set up my own server, once you understand even basic networking it becomes very clear that there are so many holes and mistakes for an inexperienced person to make that it's not worth opening my network up in any way for because I'm not learned enough to it the right way at this time. So that leaves the second best thing, a hosted service, preferably free, that's hosted outside FIVE EYES jurisdiction. My threat level isn't too major, I'm not doing any crimes or anything that should warrant law enforcements involvement. However, the department of homeland security is getting really trigger happy lately with taking comments on mongolian throat singing forums too seriously. I've seen multiple people get visits from glowies lately and I'm looking to curtail that possibility without curtailing my own right to free speech. If you know of any providers that aren't outside FIVE EYES jurisdiction but are very good, feel free to mention them, it will be good for the thread, but I'm probably not going to be convinced. Countries that are hostile are best for obvious reasons. I looked at Yandex already but it's encryption is simply not up to modern standards/non-existent. Too be clear, I don't care if the email is "truly private" to all viewers. I just don't want the American government to be able to see it. If some provider hands out encryption keys to the FSB or the CCP I don't care at all and there's little reason to care.

>>61382 this is going to be very hard, because if you avoid NSA and other western letter agencies, you'll most likely have to go to services from countries with even more hostile counterparts. in general, the rule of thumb should be: "how likely is it, that some agency wants access to my mails and what is the data policy of the country my mail provider operates out of" personally, i use protonmail for years with no hassle. i know, it's not perfect but i haven't found anything better yet.

>>61385 (((Proton))) https://www.theregister.com/2021/09/07/protonmail_hands_user_ip_address_police/

I use PGP on-top of Proton just to be extra sure. I don't think there will ever be a truly Five Eyes proof email that doesn't suck. So I'm fine using a privacy-focused email sparingly and with precautions of my own for sensitive communication.

>>61382 I host my personal email server by myself, but also use cock.li for another persona. Guess what? I was strongarmed into making a Proton email account, because cock.li addresses are blacklisted for one purpose I needed it. Then, I learned that those people who weren't responding to me from my cock.li address weren't even getting them, because most people use fuarrrking Gmail or Outlook and it just blackholes them, so I must use the Proton address to even contact plenty of people now. Don't even bother trying. Assume every email is being read by the government instead. I know I can safely use my cock.li address to contact a Proton address, however, so I always do that.

>>61393 Literally any email provider will do that, don't kid yourself. And even if you self host, your correspondent almost certainly does not, defeating the purpose. The whole point of proton, tutanota and other similar providers is to escape active data harvesting that you would get from Google, Microsoft, and almost every other popular free providers, while having something normal person enough that does not raises an eyebrow. Cockli and the like are more for brewing soykaf. >>61382 Just don't use email at all if your threat are government, multinational corpo level. It was not designed for that. PGP can help hiding the contents but will still leak metadata, and also assumes that your correspondent knows how to use it too (or has an email client that does it for him).

Email is inherently insecure. Furthermore, the only thing truly NSA proof is a face to face conversation on a two person dinghy at Point Nemo, provided you trust that the other person isn’t a spook. Assuming you can’t get the time off work or row that well, consider GNU Jami or some other service that passes e2ee messages via DHT.

>>61382 Self-host your own.

>>61393 >>61398 proton is a mainstream provider and they are obliged to cooperate with authorities, no big secret. still, they could not access the mails.

>>61382 The US government does not operate under jurisdiction, borders do not exist for these agencies. They do not care about borders, if they want you they will get you. Just use danwin1210 or disroot. Riseup is good but they are invite only so most people will find them inaccessible. Those three are the best available, they do not have a violating registration, no phone number requirements, no JS requirements. Use a mail client and connect with Tor. Do not trust your email provider, do not use emails for secure communications, email will never be safe or secure.

>>61446 >The US government does not operate under jurisdiction, borders do not exist for these agencies. They do not care about borders, if they want you they will get you. This, it all depends on how much of a threat you are, if you're a minor threat then yea they might as well not give a soykaf but if you're a major and i mean MAJOR threat then pray, pray to god every day that you don't end up bin laden'd inside your own house.

the only world to not worry about NSA proof is a world under anarchy and no states lainon <3

>>61449 >all these lains thinking they are going to get their skulls canoed by seal team 6 for their online bants dafuq are all of you looking at or talking to online that would warrant being surveilled and intercepted?

>>61449 My post could be interpreted as promoting the idea that attempts at the attainment of anonymity are futile which was not the intent. Rather that borders will not stop the US government from collecting whatever information they want. Although if the US government is hellbent on catching you they probably will catch you. My point is mainly to not waste your time worrying over stupid things like where a service is hosted, worry about the larger threats and focus on mitigating them.

>>61492 >things like where a service is hosted, worry about the larger threats and focus on mitigating them. Thats true, i was kinda suggesting the same thing with the reply, if you're doing something minor, you shouldn't worry about being around a 5g tower or something like that, because they simply won't use that kinda technology, they won't use nanobots and drones, when you're just selling weed, it just financally unfeasible and also dangerous to expect a system to nuke itself because their was a very minor threat hiding inside of it .

>>61494 Also if you're a major threat then you're not gonna worry about where an email service is hosted, because you would already be hiding and planning you're actions ahead of time, its simple as if your're a major threat you know it, and probably know what you're doing.

>>61450 This, you would only have to worry about warlords taking your grain and waging war on your land/community.

>>61393 the fact that the only information they were able to provide was the IP address is a good thing. this is solved by using a VPN or proxy, which is incredibly basic and low-effort. if your threat mode rules out any email service that would log IP addresses, there's absolutely no reason to be using a protocol as insecure as email.

>>61382 >a hosted service, preferably free If it's free, you're the product. I'm not exactly 100% sure what you're trying to accomplish here in all honesty, but there's a few holes and I'll try and not to over criticise too hard and give some recco's at the end. >SMTP is not secure by default I recommend reading over the RFCs for SMTP and the amount of holes the protocol has in terms of privacy and general soykafhousery. It was built for a day and age, long gone and we are now having to trying to make the best of what we can. >Five Eyes Obsession You have this real keen thing from your post around Five Eyes, and not caring if your data ends up in hostile nation's HDD. I'm not sure I really understand the thinking here, but your goal should be to protect your anonymity from everyone NOT just some people as that data can be easily transferred by other agencies. Most hostile countries only have loyalty to there countrymen, they'll sell you out in a second if smell gaijin. >A Hosted service... You cannot trust a hosted service. No matter where it's hosted. You have no control of potential mail routing, MTA's used, infrastructure that is being used or any software that is being run/used. You're running a black box and hoping that the sysadmin is competent enough, I do understand there are good services out there like proton, but it doesn't stop them from changing tomorrow. As for some actual recommendations, I would look at some VPS hosting and going that way (Reasons why): >You "control" the session and transport of the box, you can trust what exists on the box. >You can enforce what standards you need to fit what use case. >Some service allow you to pay with Crypto, you can essentially disconnect yourself from that box from you. So if the NSA does pop it, it's very difficult with good practices to fingerprint you connecting to that box. >No control over hardware still, if the host is running a soykaf iDrac setup your box could end up being popped by no fault of your own / also rowhammer CPU attacks are still prevalent on multi-tennanted systems. At the end of all of this, you need to decide on how far you are willing to go to protect yourself from the dark forces out there. If you want to be simple then a hosted service like proton will probably do the trick. If you want to really deep dive then IAAS will be the best option.

>>61451 >he doesn't know so naive anon most lains do illegal stuffs, stuff that would guarantee a death penalty in old times

>NSA proof hahahahaha do you not know how fuarrrked everything is?

>>62326 This, no centrally managed infra is safe from the heavy scrutiny of one of these powers attacking it. Even if it's a decentralized infra, like BitMessage one-to-many email with all protections enabled, it's still susceptible to a massive DDoS attack that can shut down your comms even though the cryptographic primitives are fine. Never is there such a thing as invincible security.