secure mail

Which secure and private email providers can you personally recommend (both free and paid) except for protonmail?

cock.li i got an account, it's pretty cool honestly.

>>18464 Can you send an invite mate? I have been trying to get one without much luck, bluegreenorange@inbox.lv

I've been very happy with Posteo which is 1 euro/month

What is your standard for secure and private? Email as a protocol is neither secure nor private.

Tutanota works great for me, never had any issues You can read this if you want to know more about them : https://tutanota.com/fr/security/

>>18477 same here, tutanota works great

>>18478 wait, I think that's my own post. I just replied to myself. fuarrrk me

>>18463 >except for protonmail why? it works well and you can pay with btc

>>18480 protonmail is a fed honeypot, not really private at all. https://www.youtube.com/watch?v=IeXaYR4ed9c https://www.youtube.com/watch?v=QCx_G_R0UmQ

>>18482 >mental outlaw That guy's channel is full of sensationalist, clickbait garbage, not exactly a reliable source. Also, 45 seconds in your first link, he explicitly states there is no hard evidence that protonmail is a honeypot. I'm not saying protonmail is secure or private (because email is inherently insecure and not private), but these youtube videos aren't very convincing evidence that they're a fed honeypot.

>>18479 Lmfao no that wasn't you brother, we two different person don't worry (Exactly what a schizo would say though but believe me:p)

elude.in . Anyway, don't trust your email provider no matter who it is.

>>18463 Your own, period.

>>18484 >https://www.schneier.com/blog/archives/2021/09/protonmail-now-keeps-ip-logs.html Better source on the case. Protonmail can be made to keep ip logs (and likely more) if the Swiss courts compel them to. The actual encryption wasn't broken. Theoretically the courts could compel Protonmail to inject JS code which would leak the contents of a users email address. Whether Protonmail is secure depends on your threat model.

>>18482 can we at least use invidious for youtube links?

>>18492 Thanks for the link. >Protonmail can be made to keep ip logs (and likely more) if the Swiss courts compel them to. This is unfortunately true for virtually any service provider who isn't operating anonymously themselves. Unfortunately, hosts who do operate anonymously tend to not be around for too long, and tend to be ran by untrustworthy people.

>>18493 OF course you can, no need for asking ;)

>>18468 Sorry, got only one account, and I don't have any invites on it. How does one generate cockli invites anyway?

I cannot recommend these two enough. Both are great. https://posteo.de/enhttp://sdf.org/ http://sdf.org/ (SDF is a whole host of things that everyone should be a member of anyway, BUT their email server is great too.

>>18463 Anything which support PGP. except bigcorps.

>>18463 The fuarrrk are you retards still going on about secure email? Email was never meant to be private and even with PGP it doesn't hide any metadata which is worth more than your actual email content. Just host your own so you can jerk yourself off to others who say it's impossible to self host email and assume nothing on there is private.

>>18463 onionmail http://en.vzoc4aylgsqwexe6okjbz2ix5atgdv5xyibnkcekmtg4u23syz6a7rid.onion/

>>18463 >cock.li >tutanota >elude >fuarrrkING PROTONMAIL Is this a joke? Listen, use Disroot, danwin1210, or Riseup you little privacy goblins. Not a single non-honeypot service has been mentioned in this thread, potentially excluding Elude however Elude is still paid soykaf. The services I mentioned are decent, but not trustworthy. Nothing can be trusted, you have to have faith in a provider not to spy on you. There is no justifiable reasoning for placing faith into any provider of any form online. The services I mentioned permit the usage of all of the tools necessary to preserve your anonymity. There is mountains of evidence of Proton's spying, it should be common knowledge they are a honeypot directly tied to US intelligence If a provider meets some of these requirements, it is a honeypot: Paywalled or no mail client support, Requires javascript for signup, Requires verification phone number or email from "valid" provider (e.g Gmail) during signup, Blocks or discourages Tor usage, Uses reCaptcha. Of course you can also read the privacy policy of your provider. Indubitably, none of you have done this. Seriously, it only takes a few minutes bros. I will give you a few short writeups on these providers.

Proton: >Proton is based in Switzerland. This means all user data is protected by strict Swiss privacy laws. We are a neutral and safe haven for your personal data, committed to defending your freedom. Protonmail provided the logs of one of their users to the French authorities. The location and identity of the user was already known to authorities. The information that Protonmail provided the authorities helped strengthen their case against the suspect, resulting in their conviction. They withdrew one of their user's privacy they supposedly value in order to aid an investigation that did not require their assistance. Protonmail advertises their Swiss jurisdiction as if it provides protection from foreign nations. This follows the same logic behind elites hiding wealth in Swiss banks which they no longer do as the banks are no longer sovereign. Even if their "Swiss jurisdiction" meant anything which is does not, any government could subpoena Proton through a Swiss court. >Proton uses zero-access encryption wherever possible. This helps ensure nobody, not even Proton, can decrypt, access, or share any of your personal information. We don’t serve ads and can’t share your data with advertisers. I wonder how the French authorities I just mentioned gathered enough information to strengthen their case against a suspect using Protonmail. Their encryption clearly does not function as advertised. It is either applied improperly or is backdoored. >Our overriding policy is to collect as little user information (personal data included) as possible to ensure a completely private user experience when using the Services. We do not have the technical means to access the content of your encrypted emails, files, and calendar events. >We have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, message subject, and message sent and received times. We also have access to the following records of account activity: number of messages sent, amount of storage space used, total number of messages, last login time. >In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities. >When a ProtonMail account is closed, data is immediately deleted from production servers. Active accounts will have data retained indefinitely. Deleted emails are also permanently deleted from production servers. Deleted data may be retained in our backups for up to 14 days. HAHAHAHA Here is how many users they sold out as of 2021 >Number of legal orders: 6,243 >Contested orders: 1,323 >Orders complied with: 4,920 Alongside all this they demand JS, phone number or "valid" email for verification upon signup or at the very least reCaptcha I believe. This is only a short summation of how awful Proton(mail) is.

Cockmail is often touted as a private and secure alternative to Protonmail. Here is their privacy policy: >All E-mail sent or received through cock.li is automatically scanned for spam >Statistics like how many e-mails you've sent is used for quota tracking purposes >[emails] May be looked at by a human or a robot to investigate abuse >Cock.li complies with every legal order for user information under the jurisdictions which are applicable. Data cock.li collects: >Registration information (E-mail address, hashed password, IP address, user agent, timestamps) >Cookies used to keep you logged in to cock.li and the webmail interface >Session information saved by webmail in order to provide webmail access >Mail storage (Anything saved in your inbox, sent, or any other mail folders) >Mail filters (Configurable through the webmail interface) >XMPP buddy rosters and data saved as part of your client interacting with XMPP extensions >48-72 hours of IMAP and SMTP log information (detailed below) Remember this? https://arstechnica.com/tech-policy/2015/12/cock-li-e-mail-server-seized-by-german-authorities-admin-announces/ >That means that SSL keys and private keys and full mail content of all 64,500 of my users, as well as hashed passwords, registration time, and the last seven days of logs were all confiscated and now are in the hands of German authorities Cockmail is also invite only. They are in essence, an invite only honeypot. Why waste your time trying to acquire an invitation to a honeypot? Tutanota does not support mail clients, you have to use their insecure, bloated, javascript addled web client. Payment data is stored indefinitely. As far as I can tell their accepted payment methods are easily traced, I tried to see for myself and was met with a stark white screen asking me to enable javascript. For this, I must rely on other's statements. Here is their logging policy: >In order to maintain email server operations, for error diagnosis and for prevention of abuse, mail server logs are stored max. 7 days. These logs contain sender and recipient email addresses and time of connection but no customer IP addresses. They store anonymised IP addresses indefinitely. These could be tied to a user in the future. >In order to maintain operations, for prevention of abuse and and for visitors analysis, IP addresses of users are processed. Storage only takes place for IP addresses made anonymous >we can be legally bound to provide content data (in case of a valid German court order) and inventory data to prosecution services They also have no hidden service. Posteo appears to be decent, however they are paid and demand JS. I can have email for free with no JS requirements.

There's really no such thing, you can trust the provider to a degree, but again, to a degree, something that seems very secure can turn out to be a fed psyop email is not a secure medium, my bf switched to protonmail after his mom's ex fuarrrked his gmail acc as revenge im using gmail simply because im too depedant on it, might switch to something more secure but it would be a bitch the thing with protonmail, its not secure, but its more secure, and its as secure as email can get really, its not a secure protocol that you should trust. for general day to day stuff protonmail is fine. >>18468 no reklāmām vēl nenoguri :D?

>>19736 proton is awful, but the thing is, email in general is awful. its really about shifting trust, which is why i dont trust cock.li because its just some dumb email hosted by a /g/tard the main advantage of these 2 is the fact that they are free, but just as you cant trust a free vpn to not fuarrrk you over, you cant trust a free email provider either. and most people have no intention to pay for email

>>18464 Can you use cock.li for NeoCities?

>>19869 >im using gmail literal fuarrrking retard >>19735 Services that dont do anything to prevent spam get rekt. I use protonmail and pay for it even though i expect it to be a honeypot because at least my mail gets delivered, the app/website loads reliably, they arent blatantly reading and sharing my data to advertisers, and they are more competent than most. The government isnt my threat model for emails, and there are barely any other other good providers for day to day stuff. If you're sending shady PGP-encrypted emails then sure go for some little-known site, but there will be serious tradeoffs

>>18470 Same. Have been a Posteo customer for a decade. Pretty fair pricing. But you don't know what's actually going on behind closed doors. There's nothing better than self hosting.

>>19886 >There's nothing better than self hosting Nothing better than having your mails not delivered and having to ask spamhaus to remove your IP from spam lists every week.

>>19735 >non-honeypot >mentions literal cоmmunist antifа hоneypоts with stained history (can't say anything about danwin guy, but since it's in Germany you just know)

>>19887 At least the one guy from spamhaus who replies to you is pretty chill. I would recommend to quadruple check your settings to make sure your emails is properly configured and passes all the checks from those email checking websites.

>>19888 Ok, give me a coherent rundown on the alleged antifa honeypot.

>>19890 Don't hold your breath.

>>19869 >>18468 I didn't know Latvians were fond of cyberpunk lifestyle

>>19890 Huh, I see. Wanna unveil the new mystery? Wanna look behind the curtain of the new conspiracy theory emerging? Wanna see the tinfoil hats running around you in circles, screaming mad Arabic insults with a piece of chalk and dashboard, proving you an incredibly complex mesh of connections between CIA undercover laundry facility and Zimbabwean children? Wanna see them bringing you shredded research papers, restored piece by piece, proving the communist agenda of putting estrogens in your water? No, there is no any rundown. Simply riseup and disroot are well known antifa hosters. If you were in touch with antifa communities in US, Germany, Belgium, France, you would know just how many of them use their services exclusively. Can you guarantee they would let their political enemies in and leave them in private, given they offer purely politically oriented services? >19891 Next time you decide to stick your nose in, at least wait a week so people can conveniently ignore your existence.

>>19898 Granting they are as privacy respecting and non-judgemental politically in terms of their userbase as they claim to be yes they would let their political enemies utilize their services. Why? Because they wouldn't know one particular user is a political enemy.

I bought a tutanota giftcard but have not use for it, since I can't sign up over tor. If anyone wants it, post a public key and I'll encrypt it for you. If anyone has posteo gift codes, I'd be happy to send you some XMR for them, or trade the tuta gift card, to spare myself going to the postoffice. -----BEGIN PGP PUBLIC KEY BLOCK----- mQENBGMEfzcBCADOSy+cOOzDJbiBIZB0bnUvTHjzhwDif/3woYUzQB2hCjSwdRh7 W1Vc13/0R9uqNoGIB6d6fKlDAgat41WDR8RcNatFbl0d1RPhDTvVyjN6JvUPNCLO kuxpT4/K6yH6g6x+5Z3/wFPz2p0T9pJbkp9/2VRSjomvEvPkPM8ajwyiI/lHzVKj vd+TyQkbtwmyS83wl6Wfz4sM1awFsga8dWkcQLcs9CCnon5SGbTTQvbmeDkUS0ZO 0vFm248EumiX8kkLIKX8PCVrMu13J9mS2JkGjqJaShLA2RPiLKh+WW6OyPduLDf+ bW66/eXDbhslFomJ+TMux6XEIMb+4PN0ZP6DABEBAAG0MXRlY2hub2xvZ2ljYWxs eWluY29tcGV0ZW50IDxmYWtlYWRkcmVzc0BtYWlsLmNvbT6JAU4EEwEKADgWIQRC 6Zr1P+5k47Bpvuz4yj1PUs9WfQUCYwR/NwIbAwULCQgHAwUVCgkICwUWAgMBAAIe AQIXgAAKCRD4yj1PUs9WfZqdCACiaThZMLBlIv8GQCEER4/Y2Njp94g61kjObNYc x/dqtUbML15mC0dXXS7BID4Eg1w4FvdagfxEtyhq5ubvHrjrQhJOUt+o8Sgy/A/3 t9aRw21PndsN50uAXiGwDZ/n7mmoNW/3Wo8wopWL/VCVRZZ6FhyylVyvAa/Y9cAN 18L6E87463G8D1dqHp75bJQHUWXy4SG8u0HNy1pEZUliaZw9i+Z8IR9P/AQ2853i w0Qct/ee2VlzIk07hevv4/mvdH9NLb/Vk5YHdj4IO/7gbPHCS7MjJs+OOQds6NiC PuzTnXF5VRwAXktHtxpQ9LjK7tAQpptvrT+MRYXopApdMq9auQENBGMEfzcBCADf 5g/LA3ytn/IN4BMBFK6itKeFOLFw7f3LlnDz8kPwDS/qs1xkRYq9W4ihG3smFslq oGCO0BFsxg0on+RSOrxoVmqplQ+mUiB1UrG40VWIfYgnasZ6AkIb2MfMdOutf3+B kBKyITg7P2cRZmUWX1pZ8PeX9RysunIHmeCUUJQD//q12r2yQV8pMS5zRccbU4Jg Zz3O2EizkGHKafedPZcxGGETWfLtdLk4OlCN8pB6nzeZyNcgCG+86puFj571bcsn 7YDBZQnHKedNSZyOEkX1mFoyv3jAMOOMSiVRTcfYXH669XakZV89RmHMHGaFym2Q 5RWzKl+rkgDjuqzwNNx5ABEBAAGJATYEGAEKACAWIQRC6Zr1P+5k47Bpvuz4yj1P Us9WfQUCYwR/NwIbDAAKCRD4yj1PUs9WfS21B/wPxTZ3Dj+VC3teFAM6c/74eqGG qumsdSGTIS8qG0GZjbtmZcCjep6FhxRIQRsTgGWIPxP9WOGgCdb2BgVIxkRkqyNu UAkhT+oNqvV4GIH7a2cPn/s3aGkdMGOrIGv3cUYgOtrOQ9QuGgyM5C97fF6D7qEx 6q5yVbnkXKxBMphieY0BBy170p9HmiGLnRCPGbOMolax0gF+uZ7yJrJSggpzKV4t HmhCa69x6aoSgiA2y9uRWnsq6CREgpKvmK3HjYfwCcUcr/xZvP9pBv2CHbNqytCl YWbzJIlOerzzBLQmsYNa3h+JMBaug/WYXgOZCK/Om57EbUbR/uShOPj1ess5 =fdtV -----END PGP PUBLIC KEY BLOCK-----

This is slight speculation, but it seems that every email option has it's downfalls: >Generic normal person mainstream provider such as GMail, Outlook, etc. Absurd amounts of data collection, closed source, nightmarish privacy policies. The problems with such services have been explained countless times, but for the uninitiated (or those who want an idea of just how bad they are): https://digdeeper.club/articles/email.xhtml#Google https://digdeeper.club/articles/email.xhtml#Outlook >"Privacy focused" providers that claim to have your best interests in mind such as Protonmail, Tutanota, CTemplar (RIP). Collect significantly less data than GMail/Outlook/etc., but still make some odd choices on what information they do store on you. Sometimes don't allow TOR/VPN sign up without some form of verification. https://digdeeper.club/articles/email.xhtml#Tutanota https://digdeeper.club/articles/email.xhtml#ProtonMail >Grass root private email providers such as Disroot, Riseup, etc. Funding is usually an issue. Besides that, they are usually more susceptible to pressure from law enforcement as they do not have the funds/power of larger providers. See the incident in which Cock.li was raided. >Hobby email providers (danwin210). See above. >Darknet email providers such as Elude, DNMX, etc. Very rarely have a privacy policy, by nature are usually blocked by most mainstream services. Obviously they are meant for darknet activities but still worth a mention. >Selfhosted email. All well and good until you get marked as spam on spamhaus or hacked by a teenage skiddie. >Custom domain name. Usually forced to pay for this option for most email providers, however if you're already paying for a domain name this may be a moot point. Ultimately the best combination seems to be a custom domain name and a relatively privacy focused email provider with PGP encryption. If I've made a mistake or mentioned DigDeeper too much, or if you know of a decent email provider, please let me know.

>>19904 Don't need the posteo gift code anymore. Here's my tuta code if anyone can get use out of it. YdvWF0PAAAADvKjpSydC2k1rx0b3t0eVHQ

Email is a fundamentally insecure protocol, it was built in the 70s and no attempt to add privacy-respecting extensions has had anything more than vague success at best. Even PGP has had limited success because only a minute and diminishing minority of email users actually a) have keys, b) maintain them in a reasonable way, c) have a keychain with real contacts, and d) use it on the day-to-day. We keep email close to us because, despite its flaws, it is still the most popular and best decentralised protocol for communication over the Internet. But never assume your communication by email will be secure - you never know what SMTP servers are going to deliver your mail to its destination. Choose a commercial mail provider with sane security settings, competent staff, that's based in a first-world country. At least in that case no one will be breaking into your account without a warrant, and they're not staffed by 'professional services' staff you wouldn't trust to maintain a toaster. If you need secure communication with other people, use PGP. I use Fastmail, and while I have keys I never use them. I know that if Fastmail get served by authorities in Australia, US, or Europe about my comms then I'm screwed - but if I'm doing soykaf which is actually that sketchy, then I'm not communicating by email, or if I am then I'm using PGP. I'd love to build a messaging client native to iOS and Android that leverages whatever email account you use, maintains a key server that integrates with your socials for key discovery, and uses PGP by default - but email is hard and time is short.