teknik.io warrant canary removed

I'm looking into alternative email providers in order to pull away from a big, privacy-invading company I don't like. I've seen teknik.io recommended here and there, and some of the features like email and a git repo seem useful to me, but this blog post of theirs worries me: https://blog.teknik.io/uncled1023/p/266 The reason for removal is apparently that it was "voluntary" and that the canary "wasn't serving it's purpose" anyway. They don't elaborate on why, and the curt nature of the explanation makes me uneasy, PGP signature or no PGP signature. Does anyone have any opinions or insights on this? Have warrant canaries been rendered obsolete somehow? Are there any better email providers I could look into?

>>2015 If you build your business under the banner of privacy then warrant canaries are essentially self destruct buttons. With that in mind it is possible that investors pressured them into removing it voluntarily. I don't think there is a clear cut answer to this whole issue though. https://www.schneier.com/blog/archives/2016/04/reddits_warrant.html

>>2015 Thanks for mentioning that. I may conduct some research to it. Not a user of the service but it looks neat, so I am wondering too why the canary was removed.

Use GPG and no one will read your emails and invade your privacy, even boogle. Woah, that was simple, right? Sheesh, people are stupid.

>>2043 That's a nice idea. Meanwhile, in the real world, literally no one you want to exchange emails with uses GPG.

>>2020 hm, I hadn't thought of it from that angle. >>2037 exactly, I thought teknik looked pretty good for my use case as long as they can stay in business long term, so I figured it was worth mentioning for anyone else who wanted to do what I'm doing. >>2037 glad it was useful, and glad to have more eyeballs on it. >>2043 well yeah, this is fine for most people but A) I don't talk to people over email so your solution is a total moot point for me, B) they still get your metadata and know who you're talking to even with the message encrypted, C) I'm looking for a company that won't datamine my inbox, and D) >>2045 Sheesh, people are stupid.

>>2082 My inbox >meetup.com >ebay >linkedin >digitalocean >sainsburys >gandi.net >amazon >estate agent This is the type of soykaf you need email for and GPG is not an option. >I'm looking for a company that won't datamine my inbox Amen.

>>2082 >>2083 1 account = email address policy don't forget your passwords and disable all spam notifications to email separate your soykaf

How about protonmail?

>>2084 >1 account = email address policy Instead of Google knowing a lot about you, now 50 different email providers know stuff about you. I don't see how that is an improvement. In terms of amount of redundant personal data in 3rd party hands, that's worse to be honest.

I personally use Protonmail. I liked their privacy policy very much. I also love their service in general, especially the automatic encryption options. It lets you set a separate passphrase for your inbox; i.e. you log into your email using your password, but you still need to decrypt your inbox by entering another passphrase. It's also open-source, so you know what's going on in the background and can check that they're not stealing your passphrase.

>>2089 The annoying thing about Protonmail is all their special client side encryption means you cannot use a generic mail client, you have to use their web client or app. And their app doesn't let you log into more than 1 account at a time.

Mods are deleting ProtonMail criticism posts. This board is confirmed to be MOSSAD honeypot.(Soykaf spilling was all that was deleted; feel free to criticize without resorting to such; complain in /q/.)

>>2097 you can get multiple protonmail logins open using tab containers in firefox. really though, the best option is self hosted, either in servers you physically own or servers not in the jurisdiction of your country or a country willing to cooperate.

>>2088 >1 account = email address policy >Instead of Google knowing a lot about you, now 50 different email providers know stuff about you. The whole point is using different identities, for different accounts, i.e. not to give out any personal information for a random website, and not to use the same fake information multiple times. As a result 50 different email providers know stuff about you, but they cannot cross-link them to YOU.

>>2119 >The whole point is using different identities, for different accounts, That's not really how being a grownup works. Any kind of online shopping or paid for service needs to know your real name and/address. Having 1 email for Amazon and 1 for Ebay and 1 for DO, is just multiplying the number of sources where that information can leak. Keeping them all on 1 provider makes more sense to me. >not to give out any personal information for a random website, and not to use the same fake information multiple times. If you are giving away fake information why do you even need a permanent email address? This is literally the point of 10minutemail.

>>2099 Is there a reason I should be concerned about using protonmail? Been using it for a year or two and I really like it, the first one I've liked since lavabit took themselves down... (RIP) Not to stir up any soykaf or whatever but I didn't see any of those posts and am trying to inform myself. What exactly was the issue presented?

>>2097 >all their special client side encryption means you cannot use a generic mail client They said they were working on a proxy program to encrypt and decrypt the messages locally, and provide a IMAP interface. They had a beta release written in C with a open license, and for a while during the web login process, there was even a message saying setting up IMAP. It's a mainly a good thing not only because you can use a standard client but also ensures the encryption code you use is not crooked. The only problem is I never heard any progress on the project anymore.

Every time the subject of email comes up here there's always this heated discussion about which email provider you can trust and which is selling you out. Which seems odd to me when really the only answer to all of these concerns is to host your own. And so far only >>2100 has even mentioned this. There is no point comparing the features/privacy/security of hosts you can't confirm. >>2097 Want email encrypted with your key on disk and be able to use a competent mail client? Host your own and be confident that your soykaf isn't being data mined for soykafs and giggles. Just do it.

>>2277 Self hosting adds new risks. https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd It also doesn't change the fundamental problem here that email is a plaintext protocol so you still need to trust whoever you rent server space from to not mine your data.

>>2278 Interesting read, lainon. If you think you're at risk of targeted attacks like this then certainly something to consider among many others. But for the most part I think we're talking about mass surveillance/marketing/privacy infringements. In which case, although it is a plaintext protocol, you can still use TLS with SMTP. You don't need to trust your host in that regard either. Incoming email can be immediately encrypted with your public key before being written to disk. I imagine there's some vulnerable point where it's plaintext in memory but at that point you're definitely noided.

Teknik is down for me and I can't find an explanation anywhere. Anyone know what happened? It looks like some Opera source code was uploaded, maybe it has something to do with that.

>>2375 >Incoming email can be immediately encrypted with your public key before being written to disk. Does anyone actually do this?

>>2277 >>2100 i want to do self hosted email, but i don't want to pay for storage on a vps and i don't want to lose emails if my home internet is down. would a paid smtp relay service (e.g. mailgun) + home server be a good option? relay service: >queues inbound emails >filters spam >delivers queued emails to my home server when it's reachable >relays outbound emails home server: >inbound smtp from the relay service only >maildir storage >imap server are there any good companies that offer this kind of service, or am i better off just using dovecot on a vps or something.

>>2380 Yes. I actually do this. https://perot.me/encrypt-specific-incoming-emails-using-dovecot-and-sieve I used this page as a guide. There's a lot of moving parts and it's a lot of tinkering but it works. Then I use Thunderbird with Enigmail. Thunderbird downloads the encrypted message and Enigmail decrypts it. >>2622 I'm not familiar with such services, but my immediate concern is their ability to read your emails. Just having a quick look at their docs, if you're not concerned about that then it'd work. Any particular reason why you don't want to pay for a vps? I'm assuming this is for personal email so storage shouldn't be much of an issue. OTOH, if storage is an issue, I imagine you can setup a similar service yourself, though I haven't personally looked into it.

>>2375 so with >>2278 in mind, I guess my last worries regarding self-hosting would be problems regarding getting major email providers to whitelist me (because I hear that's something some people have to deal with when hosting their own,) and whatever other problems come up using my home connection for something like this. If my self-hosted email address ends up on a spammer's list, should I expect excessive inbound traffic, or any other problems along those lines? Someone in my house telecommutes, so I can't treat my home connection as something I can toy with without repercussions.

>>2637 After a couple of years, I receive less than one spam a day. UNITED NATIONS said HELLO to me today. That was nice of them. Getting blacklisted hasn't really been a problem either. At one point Micro$hit blacklisted me because I was running a tor node on the same box. The other thing to consider is your ISP. Many block SMTP ports on residential connections, so you'll need to check that out first and whether they can make exceptions.

What about Tutanota?

https://posteo.de/en Posteo is very good.

>>3509 this. if you dont like protonmail you can use tutanota as they (i believe) allow you to self host

>>3612 I use a similar german service but concerned about the long term safety of german providers considering the recent social media censorship laws.

>>2043 It's about meta-data, genius, aside from the fact normal people will never use GPG. Sadly people are too stingy to pay for E-Mail, so in turn they're the product.

>>3641 yeah, i'd look for an alternative

>>3654 >>3641 >>3612 I am quite sure that law only applies to public facing content. Emails are personal/private. Not public, like Diaspora or Twitter. Anyways why aren't you encrypting your emails?

do any of these privacy focused email providers allow for IMAP/POP3 integration with Thunderbird? so far tutanota and protonmail don't, supposedly because it interferes with their end to end encryption? sorry if this is a dumb question.

Maybe it's my ignorance, but supposing an email provider cares about your privacy, encryption works and all, isn't it pointless in a world where everyone else uses providers that don't? Your messages are going to leak on the other end anyway. Using a more obscure provider might even put you on a list. I don't think email was supposed to be private from the beginning, but I don't think a better protocol can replace it as things are today. The only replacement I can see happening is a company doing a 100% centralized service that replaces email, and that's even worse.

>>4161 Email can be private if both sides use public key encryption. The biggest problem is exchanging public keys in a secure way.

>>4159 actually Protonmail does but you have to use their bridge client and it's basically a proxy you to connect to. You log the proxy into your account and you log into the proxy from your email client. You use a password set in the proxy for connecting from the mail client. https://protonmail.com/bridge/

>>4172 I know, but the bridge is for paid users only :l I think I'm gonna use Mailfence. IMAP support without a bridge, and it's free (with limited storage space ofc). Does anyone here have positive/negative experiences with Mailfence before I jump in?

>>4162 Exchanging public keys in a public, promoted post on Facebook is secure. The problem is getting people to use public key encryption, which boils down to a) making the exchange of public keys simple and convenient, b) convincing the general public that this is important. That second point is the reason personal pke for emails is likely never going to become mainstream. Even with the most user friendly system, it's going to be at least slightly more of a hassle than not using it. Also, just wondering, are there any good one-to-many pke schemes? How would one go about encrypting messages on a private mailing list?

>>4174 >Exchanging public keys in a public, promoted post on Facebook is secure. I can understand why you might thing that but it absolutely is not. Facebook is a central platform. Clients connect and Facebook decides what content to show. It is not possible to securely share keys on Facebook because you have no way to guarantee Facebook will show the same key to the other people. Everyone might see a different key or everyone might see the same key except the target.

>>2085 CERN nwo honeypot

protonmail

>>2089 >It's also open-source, so you know what's going on in the background and can check that they're not stealing your passphrase. Just because its open souce, it doens't mean the version they actually run is the same as that.

Is it really worthy? I mean, you could use a secure e-mail provide, but if all of your contacts use regular e-mails...? That's gonna be the same soykaf, isn't?

freedombone.net for self hosting email re: honeypotonmail, listen... if your data crosses country boarders it is automatically collected and crunched in a giant decryption center in germany, so tor + protonmail necessarily means that your data will get intercepted and read your best option is self-hosting and that means tapping into the internet backbone

>>5788 "Secure" email providers are not for contacting regular emails obviously since other end is always listened. But you can still encrypt everything with PGP if you are concerned about contents.