looking into email service providers

hello lain, I've decided to finally make the first leap when it comes to security and I want to switch from gmail to something else and I don't really know whats the go-to when you want something more private these days, I have a mailfence email but I'm not actually sure if it's any good rlly. so any input and suggestions would be really great thanks in advance ^_^

go with proton, it is free and better than gmail

>>24003 >proton mail even russian intelligence knows better lmao

>>24004 on the topic of cockli, heard mixed things about it but mainly was suggested for the most part, should I give it a go?

>>24002 I assume that by "private" you mean "will not read my emails and collect/analyze/sell egregious my data without my consent", or something along those lines. In that case, a *paid* version of ProtonMail or Tuta should be fine, used alongside a domain name so that you can switch email providers if they happen to shut down someday. Read the provider's privacy policy [0] and terms of service to determine what information you are comfortable with having collected and stored. MailFence has it's issues [1], but these may be acceptable for your use. The following is a disclaimer from cock.li[2] that holds up for every email provider: > ...However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). Their end section on maintaining privacy still applies: > For privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our server. ProtonMail has it's issues [3] just like every other provider, but again, depending on what you are comfortable with being collected this may be acceptable for you. The same goes for Tuta [4] or any other mail provider. At the end of the day, providers known for their privacy and used with PGP are still leagues better than Gmail and Outlook. [0] mailfence.com/en/privacy.jsp, [1] digdeeper.club/articles/email.xhtml#mailfence, [2] cock.li, [3] digdeeper.club/articles/email.xhtml#protonmail, [4] digdeeper.club/articles/email.xhtml#tutanota

email is insecure, avoid whenever possible. the only email that does not violate your privacy during sign up at this time is cock.li.

Don't use proton, and only use cockmail for throwaway stuff. If you want a good email that's not going to get thrown into people's spam folders and will let you sign up for stuff, then use a Gmail/Yahoo/whatever and don't give them any personal information. Sign up with a VPN or proxy, only connect to it with a VPN or proxy, and use either an anonymous voip number or a burner phone for the number verification. It only asks you once and you can coast off of that number for years. A shady, obscure "privacy" mail provider isn't going to practice good opsec for you.

>>24003 fuarrrking lol (from Dreaddit) > Proton Mail, the renowned secure email service based in Switzerland, finds itself embroiled in controversy once again. This time, it involves a legal request from Spanish authorities targeting a member of the Catalan independence organization, Democratic Tsunami. The case underscores the complex interplay between technology firms, user privacy, and law enforcement, reigniting debates surrounding encrypted communication services and national security concerns. >In complying with the request, Proton Mail provided Spanish police with the recovery email address associated with the suspect's account, 'Xuxo Rondinaire.' This action facilitated further inquiries, with Apple subsequently providing additional details linked to the email, ultimately leading to the individual's identification. The incident raises questions about the limits of encrypted services and the balance between privacy protection and law enforcement interests. >Proton Mail's compliance with such requests is governed by Swiss law, mandating cooperation with international legal demands. However, the revelation of Proton Mail's involvement once again highlights the importance of operational security (OPSEC) for users. Recommendations include avoiding linking recovery information to personal identities, using secondary or disposable emails, and employing VPN services to enhance privacy. >With Proton Mail disclosing user data in this case and a notable increase in data requests, users are reminded of the need for vigilance in safeguarding their information. While services like Proton Mail offer robust encryption, users must remain informed about the legal obligations and policies of their service providers, especially concerning compliance with law enforcement requests. a link I found: https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain/

>>24012 >using recovery emails what a glitterboy. he deserved it

>>24002 Any of the email providers the other lainons have suggested are good to go for everday email use - yes, even protonmail. However, don't operate under the assumption that any of it is encrypted or secret. ALL clearnet email providers are compromised. If you want to communicate illegal or seditious soykaf, either use darknet services or set something up yourself.

>>24016 Protonmail isn't even good for everyday use because they wont let you sync with a mail client without paying. Most other providers let you do this: Gmail, Yahoo, even cock.li

I might switch to tutanota since protonmail has harsh limits even paying none of them are really private and all of them are compromised so theres no point in considering the state in your threat model. Still wouldnt use Google or microsoft personally

>>24002 Protonmail is sigredux asset, do your osint and area studies on the founders you'll see the connection ala INQTEL at a student meetup, or literally go visit and talk to the ex-glowie who dropped the ball on tuta but now sits in jail for dissemination of classified information. Hurr Durr. Glowies can get fuarrrked. And I'm sorry for all you ex-glowies who now either run Lainchan or simply visit here. I'll never understand how you could get wrapped up in this soykaf. Ya'll so smart, but you couldn't see the facade before signing up? Sorry but you're all fuarrrking idiots. No wonder the taliban won.

>>24020 Addendum: The solution to OPS question is SELF HOST and learn PGP air-gapped, in a home made SCIF with control of the ground and proper EMI filtering. Also red/black engineering.

>>24021 All that so you can send and receive email to people using gmail on the other end. Why?

>>24021 >SELF HOST Dunno, people say self hosting is very difficult. Or rather, the difficult part is convincing gmail and other big providers to deliver your email and not drop it as spam.

Obviously you teach the person on the other-side to do the same. But if you have no one else to do the same with, then let's just be honest, you have no power or wealth and nothing you do really matters anyways. I.e, you're middle class garbage with a job.

>>24013 They require a recovery email to sign up for their service in most cases, dumbass. Especially if you use a VPN. They're no different than any other provider. Pic related but I've also personally experienced this with them

>>24005 its inconsistent. Lots of outages. Im experimenting with mail redirection, so that messages get duplicated to many unstable mail services, and moving is seamless, like >>24006 mentioned.

onionmail.info, morke.org and cock.li are anonymous email sites with hidden services. The inbox doesn't work on morke, but sending works great.

I use vfemail.net for personal use and cockli otherwise. I also use spamgourmet.com most of the time to anonymize myself when signing up for services.

>>24023 Go to the email thread on tech and ask for pointers. Self hosting has its challenges. I personally had to spend a chunk of time getting my IP off of preemptive blacklists and sending mail until it no longer went to spam by default. >>24022 Fair point, but I can't just go the defeatist route and kneel before the gmail-outlook-yahoo triad.

If I wanted to get away from surveillance email like gmail, yahoo, etc, and I wanted it to be free, easy, and reasonably secure, I'd just get a proton mail account. All the fud about it is moronic bullshit, probably from law enforcement who really don't want you to use it, or paranoid schizos who don't know wtf they're talking about. I now return you to the retards.

>>24330 https://proton.me/legal/transparency

Ive been wondering a while if it is fine or not best idea to use an email like ProtonMail or Tutanota or Cock.li for whatever for the contact email you give on government forms like say for if you are assigned jury duty. Would that bring suspicion or security vulnerability just from trying to make sure the email is more securely sent? Do they have non login aliases at least? Should a separate account be used or just normal email services for that kind of stuff?

>>24333 No business or government would even think twice about the legitimacy of a Protonmail or Tutanota email. However, I'd skip Tutanota simply because they will deactivate a long unused account, but Protonmail won't. Some people might have issues about cock.li, riseup.net, autistici, etc, but I've been using riseup for my standard email for years without much trouble.

>>24335 Protonmail actually deactivate long non-used account. If you didn't connected to your email since a year, they delete it.

>>24335 I didn't mean I'd think they would assume it is fake or if it is on some block list of unnacepted email providers rather just I meant I wonder how likely they would find me shady for using such services when it isnt the norm. >>24336 This kind of thing drives me nuts. I think Yahoo actually had the best system I wish other email providers would adopt. Im not sure if still is this way but the longer you had an account and log in the less frequent you are required to log in before they delete anything. Like that should be the standard approach and there should be user set settings of what behavior a user wants if no login for x amount of time so a user can choose to delete on shorter times than allowed by the email providers which will help offset the lifetime no login users that exist.

>>24002 Honestly, you can take into account every email provider that anyone will provide you in this board. However, do remember that there is no "absolute" safe and or secure choice. Whatever you decide on is just transferring risk to another platform. Do you want the most secure email? Your best bet is to develop it yourself in your own VPC. Then if anything were to happen, for example your emails were to leak, it would likely be your own fault and not another entity. Obviously that would be a lot of work, and you are probably taking baby steps at the moment. My suggestion is to go with Proton which is where I started about six years ago (I just realized I am getting old ❛ᴗ❛). Anyways, best of luck choosing lainon! - mrb466y3y35

Weird thought, has decentralized hosted email ever been a thing? Though id almost feel more off about trusting random people with data than a central entity for something like that, plus the issue of email being full of spam meaning a lot of junk being saved with no right to be saved.

>>24002 Take a look at disroot. https://disroot.org/en Server logs, which store information such as, but not limited to, your username and your IP address, from and to email addresses, IP addresses of servers the emails come in or go out to, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. All emails, unless encrypted by the user (with GnuPG/PGP, for example) are stored unencrypted on our servers. We do not sell your data to any third party. We do not share your data to any third party [...] We have no advertisements or business relationships with advertisers. We store all data in our own servers, located in a data center in the Netherlands. https://disroot.org/en/privacy_policy

Tuta is a confirmed intelligence op: >>25204 Protonmail and all other "private" hosts have the same setup (best case), they always have the opportunity to eavesdrop and cannot prove they're not. Use any of them as normal person mail, but assume all mail ends up in an NSA database. You can self host out of principle: https://www.xmox.nl/ >Mox is a modern email server that implements all modern email protocols in a single easy to use and maintain application. But wherever you get your mail from, wherever you send it to, they will almost never self host, all mail ends up public anyway.

Cutting through some of the bullshit about Proton Mail... 1. Like all major email services, Proton Mail traffic is encrypted in transit using TLS/SSL, so it can't be intercepted and read on its way to or from Proton Mail by a third party. (Some people seem to even get this part wrong.) 2. Emails sent between two Proton Mail users are encrypted end-to-end, meaning that they can't be read by anyone except the sender and the recipient, not even by Proton Mail staff. 3. Emails sent between a Proton Mnil user and a non-Proton Mail user who agrees to use pgp are also encrypted end-to-end. 4. Proton mail has a featured that allows you to send a password-protected message to a non-Proton Mail user. The intended recipient receives a notification, gets the message, and decrypts it locally with the password you have provided. These messages are also effectively encrypted end-to-end. 5. Message contents stored on Proton Mail servers are encrypted in such a way that they can't be read by Proton Mail staff or turned over to anyone in an unencrypted state. Unlike Gmail and others, Proton Mail doesn't have your private key. 6. Proton Mail is based in Switzerland, which has extremly strict privacy laws that limit what email providers can reveal, or what legal actions can be taken to make them reveal anything. 7. All Proton Mail apps are open source and audited. Caveats 1. Some of the message metadata like subject-line, etc. is not encrypted. 2. If you send a message to a non-Proton Mail user without using PGP, it could potentially be read by someone with access to the recipient's email service. 3. If a message is sent to you by a non-Proton Mail user without using PGP, it could potentially be read by someone with access to the sender's email service. 4. I suspect but don't know for a fact that, in these two cases only, the message could momentarily be read by Proton Mail staff, but only at the instant it's being received by or sent from Proton Mail servers. Correct me if I'm wrong about this. Ny take is that Proton Mail, while not perfect, really is significantly more private than other major email services. Even if you use it carelessly, you aren't going to be stalked by advertisers and corporations, or easily stalked by law enforcement or intelligence agencies as easily as you are on Gmail, Microsoft, etc.

>>25597 >1. ProtonMail CAN read it, because they are the ones who own the keys. Nobody but THEM can read it, yeah. >2. True, but again, ProtonMail holds the keys and does the crypto FOR you. You still don't own the key, and they can read whatever they wish, because they DO have the key. >3. This applies to every email provider lol. PGP with Gmail works too. >4. Haven't tried this, so can't comment on it. >5. Wrong, ProtonMail has your keys, because you generated it via them lol. >6. Right, but remember how they gave up the IP address of a climate activist[1] ? And then quickly changed their "no IP logs" policy[2] ? >7. That may be the case, but you can never know what is actually ran in your browser. There's a difference between what is said, and what is actually done. Even lainchan's actual production site might differ from the source code. Now, ProtonMail is pretty good compared to gmail and yahoo, when it comes to privacy. But it isn't as secure as it pretends to be. Use a proper VPN, use PGP locally (or some other tool), and don't be stupid. Email is inherently insecure and not private. [1] https://www.wired.com/story/protonmail-amends-policy-after-giving-up-activists-data/ [2] https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/

>>25598 >ProtonMail CAN read it, because they are the ones who own the keys. Nobody but THEM can read it, yeah. What are you talking about? No one said TLS keeps any email provider from reading your emails. It keeps THIRD PARTIES from reading your emails in transit as I stated. >True, but again, ProtonMail holds the keys and does the crypto FOR you. You still don't own the key, and they can read whatever they wish, because they DO have the key. Sorry, but that's wrong: "Your Proton Mail private key is generated in your browser. Before sending the private key to the server for storage, we encrypt it with your password (or mailbox password if you use two-password mode). This ensures that you and only you can use your private key." https://proton.me/support/how-is-the-private-key-stored They do physically store the private key after it's encrypted with your password and sent to them, but they can't use it that way.

>>24002 Your best bet is not using email services at all Alternatively - cock.li

>>25598 What a dumb foid lol I will agree they are the ones generating/holding the private key so they can decrypt it since they made it but its almost like u betamax simps forgot that you CAN encrypt PGP text in the terminal then paste message in the body and attach the public key that YOU GENERATED OUTSIDE OF PROTON as an attachment lol get mogged you filthy scrub even grandma can nocap speak in PGP with nigerian princes in africa on FaceBook messenger if you she know hows to do this frfr

>>25599 >It keeps THIRD PARTIES from reading your emails in transit as I stated. Your post >>25597 is correct, but you omitted some important facts: 1. Proton can copy all your incoming and outgoing mail, same as Google. 2. A Proton user in practice runs binaries delivered by Proton (and often Google, Apple) who can seamlessly replace them for a quick key leak. 3. Even if PGP is used, there's a lot of metadata Proton sees, like the other party's address, subject, size of message, IP addresses, user agent. 4. Proton is obliged to store this metadata for at least 6 months according to Swiss privacy law meme. By the way Swiss companies have to comply with court orders like any other. 5. Proton makes use of dark patterns to push you towards non private payment and to get your phone number. 6. The free (private) tier doesn't come with standard POP, IMAP support. 7. pmecdn.protonweb.com domain is Cloudflare. If any JS code is hosted there, Proton web users are all owned. Even if it hosts images only, it's a surveillance sidechannel that the glow in the dark Proton showrunners actively invited into their platform. Remember kids: A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against. - https://www.devever.net/~hl/webcrypto Proton is better than most because it claims not to abuse your data commercially like Google, but never buy into the encryption and privacy statements they make. If you must encrypt, do it outside their app, like you would with Gmail. Look at Tuta as a cautionary tale: >>25204

>Look at Tuta as a cautionary tale: 1. Doesn't have onion address 2. Blocks Tor signup 3. Blocks Tor user agent 3. No email client (Proton doesn't either for free)

Proton uses zk zero knowledge if that means anything

>>25608 They don't use ZK cryptography, as in zero-knowledge proofs. They use the term "zero-knowledge encryption" when referring to regular old symmetric and pubkey crypto.

>>25602 >>lol I will agree they are the ones generating/holding the private key so they can decrypt it since they made it Completely wrong. 1. The user's private key is generated on the user's computer. An unencrypted copy of it never leaves the user's computer. Proton Mail only stores an encrypted copy of it, which is uselss for anything but storage. 2. Proton Mail can't decrypt their stored copy of the user's private key because it's encrypted on the user's computer using the user's password. They don't have the user's password. All they have is the password hash, which is useless for decrypting the private key. 3. The user's messages are encrypted locally on the user's computer before ever leaving it, using the only unencrypted copy of the user's provate key that exists in the world. Proton Mail staff can't decrypte or read the encrypted mail All of this is clearly implemented in the Proton Mail software, which is open source and audited. People who still don't get this after having it repeatedly explained to them are frankly off in schizo territory, and no rational line of reasoning is ever going to reach them. And that's where bullshit comes from.

>>25612 Sorry, 3. should read: "and can't be decrypted without" using the only unencrypted copy of the "receiving" user's private key that exists in the world. Doesn't change anything, though.

>>25612 Show me a paper verifying that all of this is true. Planting malicious js is trivial. Storing your password during registration is trivial as well.

>>25612 I'll quote from the cock.li webpage >it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). [...] >For privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our server. And then from riseup >Unless you use the Mailvelope browser plugin, or your own OpenPGP solution, our e-mail system is not end-to-end encrypted or client-encrypted. Would you rather trust the non-profit email hosts that are doing it for the community (with 1 of them who got in legal trouble because of that) or the corpos who only do it for the money?

>>25612 >The user's private key is generated on the user's computer. An unencrypted copy of it never leaves the user's computer >The user's messages are encrypted locally on the user's computer before ever leaving it, using the only unencrypted copy of the user's provate key that exists in the world The private key is generated in their web browser using the encryption mechanism developed by Protonmail written in javascript. Have you verified that the open-source code they've shared publicly is a reflection of the code a web browser runs? How can you know that if a user comes under investigation by law enforcement, law enforcement cannot force Protonmail to deploy a compromised encryption mechanism against the user? How do you know that they store passwords hashed, have you checked for yourself? You can see how passwords are hashed in transit, but once the passwords are on Protonmail's server they can store they however they like, they can keep them in plaintext. Any website can do this. You have blind trust in protonmail.

>>25617 but nooooo!!! ya si, proton be makin 0days so they store them in you computer and sheeeeeet, crazy amirite? Some blognigger on medium told me about dis n dat, I only has to pay like 5$ to read it!

>>25618 What is stored on your computer? That is another thing you said which made little sense to me. How can Protonmail work in an amnesic web browser like TBB if the 'unencrypted private key' is stored on the computer? An insecure browser might cache it somewhere, but not TBB. The only thing I know of to be "stored" is your password which is used to generate your private key. But this isn't necessarily stored on your computer, it can be in your head, a notebook, or anywhere. This is a genuine question because I don't use protonmail. Why resort to childish insults once your base of trust in protonmail has been shown to be illusory and nothing more than faith?

>>25603 >Proton can copy all your incoming and outgoing mail, same as Google. except they addressed this, outgoing mail is encrypted due to client-side PGP. > A Proton user in practice runs binaries delivered by Proton (and often Google, Apple) who can seamlessly replace them for a quick key leak. untrue and i don't think u understand how software works. proton free users will not run proton binaries although that's not a good thing for them, web mail is inherently much less secure than a client. the reason for this is that a program saved on YOUR computer canNOT be quickly replaced, thats literally the entire point. people can download a version of the protonmail client, and then check the hash with others who have downloaded. They can also use the hash on website but its more secure to use a communal web-of-trust model or at the very least 3rd-party hosted log, which itself has integrity assurances of hashes published by the developer. the metadata parts of your argument sound true, but I'd love to read the swiss privacy law you're referencing. >Proton makes use of dark patterns to push you towards non private payment and to get your phone number. I have no idea what "dark patterns" is supposed to mean in this context but I would highly recommend you keep buzzwords out of computer security discussion, especially with people who know more about security and software than u do. that might work on normal people but is generally annoying and using / relying on people who use will only distract you from security. convincing yourself of expertise != expertise lol. That aside, the non-private payment is a good point, especially as there is no alternative. >The free (private) tier doesn't come with standard POP, IMAP support. this literally contradicts your second point. you don't run proton binaries as a free user. >pmecdn.protonweb.com domain is Cloudflare. If any JS code is hosted there, Proton web users are all owned. Even if it hosts images only, it's a surveillance sidechannel that the glow in the dark Proton showrunners actively invited into their platform. sounds almost plausible but it is to my understanding this has never been used to indict somebody, and seems equivalently paranoid to argue that the webapp presents a potential attack vector. All of your paranoia about Proton could be justified by delivering a single source about these potential attacks being used to indict, but they haven't been. I am begging you to provide a single example of wtf you're even talking about. >A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against. - https://www.devever.net/~hl/webcrypto Wrong. thanks for the link, but it posits a "long-overdue principle of web cryptosystems" which hasn't been stated because it is in direct contradiction with an actual principle of cryptography, known as Kerckhoff's Principle. Kerckhoff's principle states that A cryptosystem should be secure, even if everything about the system, except the key, is public knowledge. The reason why Hugo Landau's assumption contradicts this is that he argues code delivered by an entity will necessarily serve the interests of that entity - that it being "their" cryptosystem puts them in control. this is not how code works. He goes on to argue not only that there is no other way to verify a code's integrity - aka, denying the existence of security audits, or simply being able to read the code, but also that he believes Signal can't be trusted for the same reason either, and likewise for any other security software. I don't think I really need to get into why this is retarded. -I- would go on to argue that Landau's basically attempting to make an argument against all open-source software here, because he is arguing that in order for a service to be secure, you must be accessing it with code kept secret from the provider.

>>25618 You can't refute the central point of >>25617, which is that Proton is essentially trust based like every mail provider, like unencrypted cock.li for example. So you fall back to factually wrong and irrelevant tardposting? >proton be makin 0days nobody implied this >store them in you computer nobody implied storing code or malware on a client >Some blognigger on medium told me proton's architecture and its flaws can be independently and easily deduced >I only has to pay like 5$ nobody read a blogpost and nobody paid for it, but if they did, it wouldn't invalidate any of the arguments Proton is a trust me bro provider. It doesn't even matter what the mystery binary clients do because all emails can be logged when they're sent and received on Proton's servers. Built-in PGP is a downgrade from independent client-side PGP because "A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against."

>>25621 >You can't refute the central point of >>25617, which is that Proton is essentially trust based Lol, it's easy to refute. If you use the Proton Mail software, all of the restrictions they place on themselves are written into the code. You don't have to take their word for it. All you have to do is read the open source code to see for yourself. If you're too lazy or stupid to do that, read the audit report: https://res.cloudinary.com/dbulfrlrz/images/v1714641807/wp-pme/securitum-protonmail-security-audit_31247ae2ee/securitum-protonmail-security-audit_31247ae2ee.pdf?_i=AA Yes, I know that in the imaginary schizo world of some of the posters here, the imaginary schizo version of the Proton Mail software can do all kinds of imaginary schizo things. Some the stuff they're writing is so stupid and confused that it makes you wonder how they even manage to use a computer. But that has nothing to do with the actual, real version of the OPEN SOURCE, AUDITED Proton Mail software that people use in the real world.

>>25624 >OPEN SOURCE, AUDITED Proton Mail software that people use in the real world In the real world the vast majority of people use: - Web client which is megabytes of JS BLOB, compiled and delivered by Proton - Auto updating phone app binaries by Proton. In addition to Proton, Google and Apple app stores could modify the apps too. How do people independently verify that the binary on iOS is the same as the source, or the same that Proton published? Security on phones is dead on arrival. - Binary desktop apps by Proton. Windows and macOS releases have a built-in update mechanism which by default fetches and installs new code from Proton in the background. Only an extreme minority compiles from source or uses a binary that is compiled or verified by someone independent of Proton. I would have no problems if everyone used binaries built and shipped by distro maintainers, with reproducible builds if possible. But people don't, they use Proton's binaries and pretend encryption matters at that point. >securitum-protonmail-security-audit_31247ae2ee.pdf This is a narrowly scoped pentest for the web app. It doesn't go into architectural review at all, like the issue of a missing link between "open source" and the proprietary binaries published.

>>25625 >I'm too lazy or stupid to use the open source, audited Proton Mail software, or verify for myself that it works as advertised, or compile it myself if I'm really that schizo, Intentional bad opsec and willful ignorance aren't even remotely valid arguments.

>Proton Mail worker sweats hard to prove they're not malicious. 1. Allow registration without webmail, using desktop software (must be dead simple). 2. I don't give you my password, only public key and you use that to authenticate me. 3. Mail are encrypted using SMTP proxy that has a trivial codebase, not more than 500-2000 lines of code in an easily understood language like go or cython. There is nothing to do except encrypt the contents, so there is no complexity to be implemented. As long as these are not met all your arguments are pointless, because you can decrypt all my mail since the day of registration.

>>25627 > If program has more LOC that I can understand, it is bad and backdoored Lemme guess your political views, you're alt-right MAGA cuсk-servative, right? > If book is too complicated for me it is a bad book > If I don't understand this paper it is non-sense globo-homo jewish conspiracy > If expirement too hard to understood it is a conspiracy too > If reality is too hard to get it, well, it's reality' problem, not mine

>>25625 >vast majority of people this thread isn't for the vast majority of people lol, its for making a list of resources for the privacy-conscious. people who do relatively accessible opsec things like read security reviews and not enable auto-updates - things u seem incapable of even recognizing. if you want to debate the pros and cons of software projects advertising truly secure software for laypeople, wherein you play the role of an adult child who can't read a security audit or configure their operating system, then I would suggest you go elsewhere (possibly /g/?), instead of FUDing / fedposting the general subject of secure email because you fetishize self-hosted e-mail. like, I'm not saying the recommendations you give in >>25627 are ultimately wrong, but it's very likely you're not talking to a protonmail representative and are better off developing the secure email software system with these things in mind yourself. of course you won't do that, because as evidenced ITT you are incapable of not behaving like a turbonormal person when it comes to software, but maybe learning to code or make a security audit is a good place to start. after all with your behavior towards people it is very doubtful you will convince anybody to make the software you are demanding. Another thing, though. >This is a narrowly scoped pentest for the web app. It doesn't go into architectural review at all, like the issue of a missing link between "open source" and the proprietary binaries published. it's not narrowly scoped. it covers every single one of their binaries, using both black and whitebox approaches. to explicate what that means, a whitebox approach involves code review, and a blackbox approach does not involve it - meaning that it addresses your concern about code obfuscation. >>25628 suggest you step aside and breathe for a minute. the person you're arguing with is being difficult on purpose, they probably want you to be mad and look stupid. remember they can't reply unless you do, and they're only going to reply to the lowest-hanging fruit they can engage with - thats why they ignored my reply earlier. remember, it takes two to argue.

Glowniggers are STILL pretending that Protonmail couldn't power all of Switzerland with the sheer radiation. Fact is: the "privacy"/"anonymity" they advertise is obviously a lie given how coincidentally they keep track of just the data that authorities need, and also all too happily give it away too. Last I checked their .onion is worthless too since it requires JS to be enabled, so forget about even signing up anonymously. >>24002 Depends on your usecase. If you have the time I recommend selfhost, but is challenging due to the oligopoly of GMail/Outlook/... who are all too eager to send your mails to spam or even blackhole you. cock.li is good if you just need it to sign up for some sites and/or chat with some people, but due to its nature it also tends to be blocked by many sites. Currently signups aren't open though, also idk what is actually up with the alert thing, no proper explanation has been given AFAIK.

>>25631 You sort of missed the party with cock li. Apparently they got into some hot scuffle with government who also took down and stole some of their hardware. They didn't tell much detail though. I think there are some personal grudges going on otherwise I don't know why somebody would bother so much as Vincent does just to keep some cocks running

All these posts and not a single recommendation for a decent email service provider. Everything is soykaf, yes, but pointing that out really doesnt help. For now i keep using protonmail even though it is probably a honeypot and the usability is subpar because it is less fuarrrked than gmail

>>25634 procure server hardware, can be 1 core low mem put server behind firewall install mutt bada bing, bada boom

I've been using riseup.net for my main email account for years and I don't have any complaints. Recently I got a domain name at namecheap and added their optional $14.99/yr email account to it. So I'm <me>@<mydomain.name>. If I don't have any problems with blacklisting, I might start using it as my main email account.

>>25634 At least gmail allows you to use imap without some tardard bullshit about installing bridges or whatever for god damn fuarrrking mail. oauth is soykaf though, thankfully claws supports it and i don't care for other mail clients

>>24006 >>24019 >>24333 >>24335 tutanota is confirmed compromised https://archive.org/details/nov3am/page/14/mode/2up?q=Tutanota

>>25632 didnt their canary expire before just making a new one?

https://web.archive.org/web/20241209023449/https://prxbx.com/email/ used to have some more in-depth information about the private email providers, but it seems like updating the page was too much work so they changed it to a redirect to https://www.privacyguides.org/en/email/ i hope they update the original page soon, considering how mid the guide in redirect is

Just a friendly reminder that LE/IC routinely spread FUD about things that give them a headache, like Tor and Protonmail. They usually pretend to be 1337 hAxors giving dire warnings about glowies. Lol Another part of their job is to flood out messages that provide accurate information with their own FUD messages that cause the accurate information to scroll up out of view. Standard procedure for them. This has been a public service announcement. Happy New Year.

>>25651 >headache >Protonmail Meanwhile back in reality: >gives away IP of a climate activist to the French >gives away "recovery email" of a Catalonian activist to the Spanish And I'm sure there are others I've never heard of. You also can't use Protonmail's .onion without enabling JS Putting Tor and Protonmail in the same sentence is disingenuous and you know it.

>>25652 (me) And I should add: you shouldn't trust cock.li with anything serious either. The reason I recommend it is because the owner isn't a weasel about it and is much more straightforward. The page is still the "alert" one, but you can read the old one here https://archive.is/GXJ9p >How can I trust you? >You can't. Cock.li doesn't parse your E-mail to provide you with targeted ads, nor does cock.li read E-mail contents unless it's for a legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). For privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our server.

>>25643 >service >storefront Does he even know what it is? IIRC he was being investigated for corruption, then agreed to help the prosecution in exchange for a lesser sentence. Seems like the kind of situation where he'd try making something up to look useful. Also this >>25651 Also even if it's 100% true, what's the alternative, Outlook? lmao

>>24002 > I have a mailfence email but I'm not actually sure if it's any good rlly. Does it send and receive email? Then it's good. The long and short of it is read this: > https://digdeeper.club/articles/email.xhtml and decide what information you are ok with giving up. Remember, no matter how good a service seems, you are ultimately reliant on them keeping their word. If you want a "private" email service, pick something off the list above (Posteo/Mailbox/etc.) and use it for normal people stuff (doctors appointments, taxes, etc.) Hell, even Proton Mail is fine in that regard. > inb4 proton mail bad The main concerns are being able to use a custom domain, being able to use your own mail client, and having proven encryption standards built in. GPG aside, email was not meant for privacy, and you should not expect privacy from it. Also things to consider, >>25651 applies, as does the disclaimer from cock.li (see >>25653)

>>25676 >Also this >>25651 That lainon gives protonmail as an example of something the authorities wouldn't want you to use, but PM has a track record of collaborating with authorities. Honestly I think it being posted to discredit >>25643 isn't that unlikely. >Also even if it's 100% true, what's the alternative, Outlook? lmao If it is 100% true, both of the most popular private email providers collaborate with authorities. Not much we can do about it I guess, but it's quite worrying, no?

>>24026 guerrillamail's pokemail domain has always worked for me. just skip using it as a recovery option

>>24002 ProtonMail is actually good enough for most people. But avoid using email for secure and truly private communication. Instead use something like Signal or some kind of OTR messaging. If you use GPG, you need to copy+paste the encrypted text into webmail or use a separate email client (like Claws Mail). Also, I highly recommend having at least 2 email addresses: use one address for government things and other more "official" stuff. And use the 2nd email address for online accounts that you don't want to tie to your IRL name (obviously, you need to avoid services that require phone number!). If you want to keep an identity truly private, you will need to make a separate email address just for that identity!

If you really want to have a secure email you should try making your own hosted server. Proton mail works best if you want to make a step forward towards a more private email service. And if you really, really want to have a secure conversation you 100% encrypt your emails with PGP, keep in mind that you need to encrypt the email in your computer before sending it, DO NOT USE PGP OPTION THAT COMES WITH THE EMAIL SERVICE.

>>25587 I like disroot, very good can recommended

>>24012 >>24013 >using recovery emails Just got to know that they require it not even fuarrrking gmail does that

>>25775 >you should try hosting your own email server >neuroimplicating that 99% of self-hosters know a thing about actual security >neuroimplicating this wasn't an anti pattern that was responsible for many data breaches in the 1990s/early 2000s and as a result the industry has moved away from roll-your-own type solutions https://security.stackexchange.com/questions/168261/what-does-dont-roll-your-own-security-mean I'm low key wondering if feds push the DIY security angle to make us less secure

>>25868 >https://security.stackexchange.com/questions/168261/what-does-dont-roll-your-own-security-mean It's clear that you didn't even bother reading your own link. This post is about not rolling your own crypto, not advising against self hosting things. >By implementing a known and trusted process or algorithm like pbkdf2, you have some level of guarantee that it has been audited and will not keel over and die the minute someone prods the algorithm itself. By using a widely accepted standard, you have some level of assurance that the algorithm is not going to be flawed and you only need to ensure that your implementation is secure. This is not rolling your own crypto. This is you implementing it and if your implementation is correct and you follow the guidelines, you're golden. Your just a retard spreading FUD and is probably a glowie.

FSF made a list of recommended private email services https://www.fsf.org/resources/webmail-systems, you can check them out

What does this thread think of fastmail? I heard about it from a retired dissapointed tech guy and i just started looking into it and skimming stuff. >>25966 The moment the website needs JS, they unrecommend. I do like the recommended ones, however.

>>26011 Doesn't matter, anything you don't host yourself is a trustmebro and potentially backdoored. If you self host the other party will still copy the full conversation to PRISM anyway. Accept there's no privacy for personal email. Act like a nothing to hide normal person, use gmail. Do private or illegal soykaf through darknets as a separate identity. There are tons of OnionMail instances. Any email account is more private than these clown privacy honeypots if it's accessed through tor without js and PGP encrypted.

>>26012 My threat model can be summed up as "an email provider most likely knows more than me about hosting emails". If i'm doing smth shady i'm nowhere near smth electronic or i'm on someone else's machine at worst.

>>26012 >anything you don't host yourself is a trustmebro why are you still here? >>25621 this is obscenely false and completely premised on a rather spurious claim made on your blog about end-to-end encryption software. AES was established by NIST, does that make it a ~trustmebro~ too? since it was specified by the US government? > Any email account is more private than these clown privacy honeypots if it's accessed through tor without js and PGP encrypted. one of your many issues is that there's no webmails that are jsless and its very rare to have mail server that doesn't use js in the signup, too. additionally you are not "more safe" if you overlook other qualifications of the provider, for instance pay for your email with a credit card, even if you do access it through tor and use pgp to encrypt your mail, you will get raped. in fact, PGP is hardly a solution if you don't know how to use it properly too, since any shady thing you do will require a new key generated in isolation on a task-specific basis and make sure they aren't pushed to repositories from your machine over a normal internet connection as well.

>>24002 Don't know whether anyone mentioned these, but I2PMail is an option. I hear that AWS also gives 1 year of free compute credit per account, so some lainons should really spin up some instances and either port them yearly with fresh accounts or run them off of cash-in-mail or crypto donations. Lainons could donate domain names too.

>>26012 >anything you don't host yourself is a trustmebro and potentially backdoored. So is everything you do host yourself, and for the same reasons. You're using technologies created by other people. Security is a game of percentages, just like probability. Each person uses their own method of calculation the probability of a certain action or method or product or service being secure. Obviously, you think that self-hosting is more secure. Do you know that your hardware is secure? Do you know that your internet connection is secure? Do you know that the encryption you rely on is secure? No one can be absolutely sure of any of these things. You could even say that self-hosting is less secure because it makes you so easy to monitor and analyze

>>24009 My guy you need to fuarrrking elaborate because there are NO ways to get a VoIP anonymously, it is even worse than email. The only mail you can get anonymously is tutamail, probably. Could half a year ago. Proton mail now disables third party service registration and forces you to doxx yourself. There are NO mail providers that are usable for third party registration without doxx, all of them require another mail or phone. As for getting anonymous VoIP, how? How do you do it? Literally fuarrrking how? I have tried everything on the surface and sure as fuarrrk it does NOT work.

>>26051 >There are NO mail providers that are usable for third party registration without doxx, all of them require another mail or phone. Disroot works.

>>26012 Ultimate skeptics like you think you're so clever for pointing out that software can contain vulnerabilities. In reality you just seem stupid for smugly stating the obvious while refusing to think beyond the surface level about the purpose of security.

good indication proton, tuta, everything popular is a glowop: there's no technical way to make email secure because server has access to mail yet they pretend it's secure, they're widely used and not attacked like cockli

Holy fuarrrk Vincent is so based. Guy literally spent month of fuarrrking around with investigations, probably put alot of money in it, just to keep brewing soykaf on

>month months fuarrrk typos fuarrrk typos fuarrrk typos fuarrrk typos fuarrrk typos fuarrrk typos

>>24002 mailfence has been gud to me can use it to sign up for steam n shiet aswell as be anonymous

>>26088 >steam do you pay for games by verbally pleasing the developers? i don't remember steam accepting crypto or maybe i'm just schizoing out, but can you please clarify?

>>26012 You can still use PGP if you're communicating with ultra schizos like some people around here. But then if you're actually communicating with ultra schizos, most likely they won't even be using the internet. So idk. >>26088 I've never actually seen them in the privacy respecting email category. Might have to setup one account just in case. I use proton in a lot of places so I kind of want to ditch it. They know too much about what stuff I visit. I still use gmail for government/banking stuff but everything else I've moved to proton. Seems like it's time to move again. I'll check them out.

Simply not use email at all, it can get read in transit when it not using TLS, which is optional actually. Evade registering accounts, and if you can't use a temporal email like https://www.adresseemailtemporaire.com/ , and enable TOTP for evade id you again using that temp email . TOTP should also evade ask for sim number in the future in mayority of services.

>>26089 >i don't remember steam accepting crypto Not that guy and don't want to derail, but : There was a time where steam experimented with letting people pay with bitcoin (that was waaaay back before "the boom") but it was too unstable for Steam to keep track and eventually dropped it after a couple months if not a year. I don't remember if they reintroduced it recently.

I did not mean to atach this image

What is Lain's take on Countermail? It seems difficult to get an account though since so limited space. I found one email provider that seems suspicious because there is some aspects too good to be true for free. Anyone know about Swismail? I suspect if they are a legitimate email provider not ran by a government agency they might be trying to build a userbase by offering everything free and will then will ransom people's emails for a service fee. Could that be why they are offering unlimited space for free? Also what is the deal with CTemplar? They supposedly shut down but I clearly see a website up so did they comeback or is it a scammer or honeypot? but the registry doesn't work so what is the deal?

>>26260 Did you really sent a soykafty french website and want to teach people about privacy? While there is thousands other service like : - https://emailtemp.org - https://www.emailnator.com/ - https://temporarymail.com - https://tempmailer.net/

i once had this same thought and was stopped because of the seamless ecosystem of gmail connectivity.

bro i use tutamail, proton, morke.org, torbox, cock.li, and onionmail. Those are all of my favs to use lmao

>>26259 >Simply not use email at all, it can get read in transit when it not using TLS, which is optional actually. All common email providers use TLS or other effective encryption. if you're using a client like Thunderbird or similar it gets set up automatically. If you're using webmail you get switched to an httpS address automatically even if you don't specify one, You'd have to be some special kind of super-retard to find a way of sending unencrypted email over the clearnet. But if you're that worried about it, you can just use an email service with onion addresses, like Riseup.

>>24005 Downtime, but it's been one of the best for almost a decade now.

Maybe Lainchan should just make our own email provider. Get someone to set up a server (ideally in some country with strong data privacy laws and no data retention law) that only stores emails in memory and not store the email there longer than it needs to be delivered to anyone's local device but purge anything after a certain time period just in case of bad actors or they have a warrant on them requiring the use of IMAP and SMTP, possibly no web access to email but sometimes people lose or break devices so maybe it is fine to allow. Only reason for this is to hopefully avoid any legal responsibility. The server should not store passwords not even hashed in case of data breech, unfortunately it slipped my mind what this type of login authentication is called. Email between server and user computer could be routed through i2p helping avoid government blocks of the service as well as further protect the server holder from any knowledge of userbase to help avoid legal troubles. Instead of signing in to the email as if it is an ordinary email account where the email is the account instead it should be there is no main email as the account only email addresses tied to a username. This would help prevent users accidentally revealing the email used for logging in because there would be none only an account that does not show you the email addresses until logged in which further secures the account from anyone knowing usernames assuming if they do not recycle these names everywhere online. Lastly no automatic timed deletion of accounts, since nothing is stored in it long term anyway there isnt even a reason to do this and just poses a security risk for people to lose their account for someone else to reclaim an email address and an inconvenience if they used an email associated with it for their login on sites but lose access due to not logging in for a while. Use a canary warrant. The email client also needs to have an easy to use encryption user side for both the storage of emails and PGP for the email contents, but the servers also of course should encrypt on top of this since not every email will be encrypted to begin with such as receiving financial forms. Would this work or would it run into the same troubles as some other email providers did?

>>26950 I was in talks with someone a while ago to do this. unfortunately the guy wasn't consistent enough to keep one going for a meaningful period of time. You should do it yourself lain, you have a lot of ideas on how to do so and it's not hard to host an email service, the hard part is the same difficulties as running any reputable service that will be used by other people

>>26955 Unfortunately I have too many setbacks to doing that. For one thing privacy and security wise living in the US isn't a good start. I also lack enough knowledge on programming and implementation of security measures beyond the general conception to do it by my lonesome. Not like I was thinking about this for a long time, I just made up most of these features on spot.

>>26957 recommend you at least think about it. you might find it easier than you think, all things considered. it's also not a programming problem, its system administration, and you don't need to live in a country to host a service - just use a VPN, to access a VPS, in the country you want to host from.

https://purelymail.com/advancedpricing https://purelymail.com/docs/features https://purelymail.com/docs/security https://purelymail.com/docs/domainDocs https://purelymail.com/docs/faq https://news.purelymail.com/api/index.html

I have used posteo for everything for 10 years with no problems or any downtime. I also use it for contacts and calendar. Make sure to get a .net address if you are in the US, some websites don't accept .de

>>26982 Seconding this. They've added .com as well.

>>26958 A lot of what I described isn't something that could be set up generic but would require customization for some things. One feature I didnt mention is making visual spoofing more difficult by color coding homopglyphs on the client and making invisible characters highlighted. I am too broke to afford even any VPS space currently, plus domain registry and that is before considering laws like the CLOUD Act to consider with me being Us based. Also someone would have to figure out privacy friendly solutions to service threats such as DDoS attacks and bot registration and maybe (not) spam handling which I don't know what would be most effective without compromising too much. >>26982 >>26983 Is there a consistent pattern to what top level domains websites accept for emails on registration or do they only approve of specific services on a case by case level not a broad filter? Likewise do spam filters in emails often mark anything from a niche TLD as spam? Is there any difference between country code .de by itself vs .co.de in how they are treated?

>>26950 >Would this work or would it run into the same troubles as some other email providers did? Glowies and big tech are unlawfully cracking down on any service providing real privacy. Solution is 1. Computers owned by users (there is no privacy on 99% of devices, they harvest and analyze user data) 2. Asymmetric encryption (like PGP) 3. Optionally something decentralized for a chance at anonymity (like Tor) We can't have nice things because 1. People are too stupid and easily taken advantage of by evil corporations 2. World government actively sabotages anything that hinders mass surveillance, governments and corporations increasingly act as one entity, governments are acting against their own citizens It's not a tech problem. We are being oppressed. No private communications, no anonymity. No activism coming from the 99% is allowed against the 1%. Isolation without the ability to inform people and form a consensus online. It's intentional, it's not some accident of technological evolution. Lainchan is also affected, we can talk all day about feels, drugs, act demoralized by the latest dystopian development, discuss ineffective tinfoil hat methods to cope with it, but we're not allowed to observe certain important facts, e.g. the fundamental reason behind email not being private. Those comments are deleted without a trace, with no reason given.

>>26986 Thinking you can host an email service on Tor makes no sense if that is what you meant. It would be a closed system defeating the entire purpose, why even use an insecure method like email at that point? Likewise you cant host email on IPFS and the like for the same reason.

>>26998 > Likewise you cant host email on IPFS and the like for the same reason. Hey, it's easy with asymmetric encryption, just encrypt it with public key person shared in addition to their email address, publish it -> everybody using this ipfs email system see some data exist, but only the intended person is able to realize it's email to them and can decrypt it using their private key. This is very roughly how it can look like.

>>26998 > It would be a closed system It can additionally have its own "exit node" which hosts conventional email service, but on receive, it encrypts the data and pushes to ipfs. Maybe it can have its own private/public key pair and if you encrypt using its public key it detects this and forwards email to clearnet receiver outside of system.

>>26998 The service doesn't have to be on Tor. It just needs to allow registration and access from Tor through a standard protocol, without proprietary software like JavaScript. Email, Tox, SimpleX, whatever. Tor has a bunch of onion email servers by the way, in a way it's more open than normal person internet because you don't need special IP addresses for your email not to be bounced by the billion dollar company.

>>26950 If someone makes one on here , and actually puts the proper security and privacy in place for annual fee through crypto, I would genuinely pay for it.

how to make this work on a client?

>>27005 ports are 465 for smtp and 993 for imap use mutt for the full h4x0r experience

>>27005 Huh? I seamlessly got it working on operamail, wtf are you doing, bro?

>>26950 Great idea, I'll make the logo

>>27005 Although I am not a fan of most of his stuff I think Luke Smith has a video on setting up neomutt and he uses cock.li as the example email during the setup process. If you don't know what you're doing then you could just folllow that!

>>27005 Make sure yo set mail.cock.li as both the IMAP and SMTP server. By default thunderbird picked different values for those fields.