Email Services

Obviously, gmail, outlook and yahoo are in no way secure. What are some email services that don't sell ur info, spy on u, ect.?

cock.li

I use Tutanota

>>6699 I've been using ProtonMail for good five years now, seems good and secure.

>email >secure choose one

>>6703 Email with PGP is one of the most secure means of conversation. Unfortunately, not a lot of people use PGP for their emails, which results in people who actually use PGP to send insecure messages most of the times.

>>6702 In a previous thread like this, a lainon posted this to warn about ProtonMail.

>>6701 I've thought about using that 1. Is it good?

>>6699 riseup.net

>> 6705 does the possibility that webapp PGP could be backdoored by the source really surprise anyone? Even a signature of the pgp code would need to be preinstalled on the access computer - might as well just install PGP locally.

>>6705 The main flaw found in this report seems to be the usage of a JavaScript based web client. Are there any email providers that avoid this? Even if there are large flaws in ProtonMail's encryption, the alternative is to use PGP yourself for email encryption. However, the problem is that very few other people use PGP as well, so it ends up not being encrypted for those purposes. There are other concerns about email hosting that ProtonMail covers well. It is hosted in a country outside of the fourteen eyes, as well as allowing Bitcoin for payment. It seems to be very difficult to find providers that meet all the criteria for security and privacy.

>>6715 I don't think so.Like the paper said, that's been discussed for years. >>6719 According to the paper, protonmail does, if both people are using the smartphone app. >he problem is that very few other people use PGP as well, so it ends up not being encrypted for those purposes Very few people use email services that try to provide end-to-end encryption as well. If end-to-end encryption is your goal, email is probably not the best platform, given the unlikelihood of all of your email correspondents also using the same email provider as you, and given that email itself is a plaintext protocol.

I had protonmail for a couple of years, but I've increasingly grown dissatisfied with them. They've proven to care more about (marketing) privacy than freedom. I didn't like them releasing their clients under a proprietary license and making their Bridge only available for paid users (in addition to being proprietary). Making up weird excuses like "the source code is not ready for the public yet" or something. If they rely on security through obscurity then I want none of that. So I went with a paid provider (mailbox.org) instead, mailfence would've been my second choice. They allow any clients, seem just as privacy oriented and have been in the business for decades, and have the option to GPG encrypt incoming email immidiately, which is basically the same as protonmail minus all the dependency on web software. I don't use the above provider for anonymity though, otherwise I'd be using cock.li or something. >>6701 I've considered Tutanota aswell, but they share the same flaw as ProtonMail, web client lock-in.

>>6722 >So I went with a paid provider (mailbox.org) ... have the option to GPG encrypt incoming email immidiately, That's pretty cool. Thanks. https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox

>>6722 Mailbox.org seems to be very cheap and feature rich, but can I really trust a server hosted in Germany? I'm paranoid.

>>6725 you can't trust a server you don't host yourself, period.

>>6729 That's true, but my ISP doesn't allow me to host a mail server on my own.

>>6729 You can't trust a server you didn't bake from your own sand, period.

I'm currently using Fastmail since they have a straightforward service and seem to genuinely not do any analytics or advertising. All my person to person communication is PGP'd anyway (well not my work email, can't stop them from using MS crap). I do plan to set up my own mail server at some point, but I'll still have to use a service for outgoing since getting a personal server on spam whitelists seems like a chore. At least all those automated confirmations and notifications won't be sitting in a centralized and unencrypted place. >>6719 It might be possible to replace the web client with a browser extension, that way it would be more like the mobile app in having the user download a single authenticated version of the code. But that would detract from ease of use, not worth it IMO. The point of Protonmail is providing a decent level of privacy while being idiot friendly. People who are really serious about privacy should know better than to trust it completely, but it's far better than gmail. It also doesn't let people use crap like MyMail where you entrust your mail account password to a soykafty mobile app developer. The popularity of those apps is second only to the effectiveness of bad phishing in making me terrified of emailing anything sensitive to "normal" people.

Has anyone used secMail? I've used a couple different accounts for a couple different things for a while now and haven't checked in on any news.

I rent a VPS and I simply host my email on it. It already had OpenSMTPd, et al. on it and I don't currently care enough to replace it and the other email software with better programs. I found these programs rather poorly documented, but that's not unusual. My point is you'll want to test it, obviously. I also use an FSF email alias linking to this, so that's always a thought; it's easy, using an alias, since the indirection permits changing the underlying address with no effort.

>>6731 This. Your trust has to extend *somewhere*. Sure, you can always try to reduce the number of layers of trust, but ultimately you're going to be chasing some very deep rabbit holes. The answer? Threat modeling.

>>6699 cock.li

Look at your threat model lain. If you need to send sensitive stuff over email, use PGP. The email provider shouldn’t matter. If you need something else, jabber+tor+ssl+otr is a great option.

posteo.de

>>6705 >This paper is dedicated to music composer Toby Fox Wow I did not see that coming. Did ProtonMail ever give an official response to this paper or did it not recieve enough traction to merit one?

I don't know much about this site other then it recently popped up on my radar and I bookmarked it. It would be interesting to hear from any anons who have used or have any info on this service. Ctemplar https://ctemplar.com/ CTemplar42u6fulx.onion

>>6699 privacytools.io has some good recommendations for privacy focused email providers. https://www.privacytools.io/#email I use disroot.org as its free and has a nice ui

>>7066 I'm wondering the same. Since Germany now forces Posteo to take logs and Switzerland has similar problems, Iceland seems like the next best thing. But Ctemplar is lacking in some features, though they apparently plan on adding support for third party clients soon.

Cock.li

I've been down this particular rabbit hole myself and ultimately ended up self-hosting. It's honestly the best way to go when free providers are outright malicious and paid services don't have quite the feature set you're looking for. It's also how email was intended to operate before spam became a massive problem and the cabal established their circle-jerk of trust. Self-hosting is, however, a fair bit of work involving numerous pieces of software, DNS shenanigans, and all the security snake-oil best-practices you can name. You do end up with secure mail that you control on any domain you please, but the downside is that you'll probably always end up in gmail's spam box, even if your server is set up 100% correctly. The only way around this that I know of is to use one of Google's MTA servers as a relay. If you don't want to go that route, Posteo, mailbox.org, and Fastmail looked alright, plus I've heard good things about all 3. >>7158 If a mailbox isn't accessible over standard IMAP it's practically worthless. I'm not throwing out everything that makes email a good format just for the illusion of security.

>>7162 Cock's had their servers taken down and searched a few times due to being in an insecure country

>>7175 At least you know it happened.

>>6719 >It seems to be very difficult to find providers that meet all the criteria for security and privacy what exactly are the criteria for security and privacy?

Germany and Switzerland aren't privacy safe anymore The only truly safe options are Iceland based or self host

>>7266 What happened in those two again?

>>7272 being secure and private

>>7286 I think they meant what happened to Germany and Switzerland.

>>7291 > >>7286 was meant for > >>7191

>>7272 Germany: https://www.zdnet.com/article/log-free-email-provider-posteo-you-must-log-user-ip-addresses-court-rules/ Switzerland: https://www.swissinfo.ch/eng/directdemocracy/social-detectives_do-the-swiss-have-a-weakness-for-surveillance-/44575252 https://www.srf.ch/news/schweiz/neues-ueberwachungsgesetz-verfolgung-auf-schritt-und-tritt-im-digitalen-raum?ns_source=srf_app

There is none, single purpose burner email and PGP. Always assume your host is compromised unless you yourself run it. Tutanota is suggested a lot but it like a lot of things in Germany is compromised, cockli was raided a few years ago and Vince says you shouldn't trust it anymore, Protonmail is a sneaky swiss jew so don't trust them either. Wherever you can make an email with as little javascript as possible with as little info given as possible is where you should get your emails. Bonus points for allowing IMAP/POP.

lain go to the wired come back with a threat model >Can you run your own mail service? this doesn't promise anonymity but it does provide privacy if you run it through i2p/tor/cjdns/whichever alternative routing protocol it means whoever emails you will need to do the same or you will need an authoritative nameserver for your domain to do it. >how are you encrypting it? your mail will not be private through transport without PGP or TLS, and the mail servers will possibly reject forwarding your mail if the headers do not look normal or your exit node allows normally mapped ports

>>7340 >people may reject to serve if things seem unusual This is an effect of customers demanding that services be free-of-charge or cheaper than fair, and governments imposing false liabilities on service providers, rather than the customers. Many internet services are free-of-charge to the "customer" because network-communication service providers overcharge, causing customers to compensate their greater cost by demanding other things be cheaper. The result? The people who own the wires make money by the foot, and content creators don't get donkey fecal matter, maybe some gerbil ass pellets, or they have to rely on donations, which the customer is either reluctant to give, given that he has already paid enough for it all, or he gives a fair amount, which only makes the situation worse by making the problem less visible to the content creator, and adding to his expenses, or he gives less than fair, while still minimally supporting the content creators that are good enough that unfair pay for their services is livable, causing everyone to see the existance of a problem (though which do who see?), while risking being seen as cheap by making his donation visibly unfair (as oppopsed to the invisibly unfair donation of nothing).

Email is inherently insecure. Metadata leaks are inherent to design and it is was not developed with encryption in mind. That said you can mitigate some of the issues by using GPG, a decent client and a decent provider. This guy has a decent guide: https://digdeeper.neocities.org/ghost/email.html

>>7485 thanks for this, the entire website is pretty good. he really helps shut down most of the privacy arguments about browsers, vpnsl addons, etc.

If one were to host their own email, what VPS provider would lainanon recommend?

>>7528 Try out https://sibyl.li/, they are privacy and free speech friendly with DC on countries like Japan and Switzerland. Gab uses them and their emails don't get filtered.

>>6704 In all fairness that security is only added by pgp, which can be used in any medium. email suffers from a ton of pitfalls of security. If the user has configured the pgp email wrong on their end then others can tamper with the email data / packets / see the metadata which compromises their physical security / etc. The mail may also be unencrypted on the drive \ by a bad implementation and sit for many years .

I use mailbox.org, pretty satisfied overall.

Have you ever sent a CV over email? Seems like a huge risk, also one of the main uses for email these days.

>>7639 >Have you ever sent a CV over email? Seems like a huge risk, also one of the main uses for email these days. What is somebody going to do with your resume except give you a job? It sounds like you're doing something wrong there.