Best E-mail service

Which is the best email in terms of security and privacy? Protonmail?Tutanota?RiseUp or Disroot?

>>8350 self-hosting actually

I pay 3.50 per month to a local company i trust to host my email server, and provide me with reasonable configurations. Can't get more secure then that IMO.

>>8351 2Much Complex...

Here's a pretty good writeup about the privacy of many providers https://digdeeper.neocities.org/ghost/email.html And a spreadsheet comparing the techincal aspects https://dismail.de/serverlist.html

From https://digdeeper.neocities.org/ghost/email.html >What should be taken into account while choosing a provider? The most important thing is their privacy policy. I disagree. While the privacy policy may be important in egregious cases (by social, e.g. legal, action), it is never possible to know whether the privacy policy is enforced. It may well be that the privacy policy is only pretended to be enforced. What I recommend is to consider the mechanism, so to speak. What data do they require? Do they require anything that isn't technically necessary? If they require uncessesary data, don't use them (unless they're the least bad in a market of awfuls, which is like kicking dead whales down the beach, but no better options..). Cock.li requires only to specify your account name and passcode, except a simple text-based captcha. They also don't restrict access via TOR. If you access that cockmail account only via TOR (including account creation), encrypt all messages sent via that cockmail, and ensure all messages sent to that cockmail are encrypted (by extramechanical means, e.g. only communicating with persons who will encrypt their communication), you maintain complete pseudonymity in using that account. Additional privacy may be gotten by using the captcha text as the account name. Additional privacy may be gotten by having a separate cockmail account for each correspondent. Additional privacy may be gotten by scheduling mail downloads at random times. Additional privacy may be gotten if the mail download schedules conform to distributions reflecting demographics' usages (which may be difficult without germane data). I don't know many mail servers, so I will examine https://dismail.de/serverlist.html to learn more, but I do know cockmail, that it is possible (as aforementioned) to ensure good privacy, pseudonymity. The important factor is the minimal requirements to create and access accounts, and knowledge of good (irregarding customarity) practices. Of course, the privacy policy is not [i]useless[\i], as the pretense may be sufficient, however, it later may be broken.

*useless*

>>8350 I've heard good tings about Tutanota and Rise Up, but I personally use Posteo. I don't mind having to drop $12 a year for it, because it's secure, respects my privacy, has a lot of features, and i supposedly run on 100% green power. The people who host the service have even gone to court to defend user privacy. Pretty based. Don't fuarrrk with Protonmail. That soykaf is fuarrrking snake oil.

>>8358 Could you elaborate or drop a link about Proton? I've heard that before and I generally know a lot of security or privacy-focused projects these days are crap but I'd like to know in what way

>>8359 >>8350 Protonmail isnt soykaf, its secure but not private. Michael Bazzle from The Privacy, OSINT , and Security podcast talks about what this means alot: Privacy is protecting the distribution of your personal information. Security is ensuring CIA triad for resources at large. Google offers excellent security for their products: 2FA, hueristics, account logs, etc. but is horrible for privacy - they track distribute and sell your info. Protonmail is excellent at ensuring thr content and perhaps metadata of your email is protect but the largest problem i see is you are using the same e-mail for every service and not comparmentalizing. Services like 33mail and blur help a lot here. Depending on the contents of your email and threat model, widespread ise of aliases might be more useful than encrypted sever storage. Fastmail offers plwnty of aliases but isnt zero knowledge. PM want monthly money per 10 aliases with these permantly attachesd to your account. Ofc, long term, you will have to close account, rather than pay for hundreds of unused aliases forever. Each time you give the same unaliased email to vendors, you are enabling your own tracking. Same with phone numbers. I am looking into twillo elastic sip trunking for this. Privacy.com / bitcoin allows generation of new payment info on demand. 33mail/blur/fastmail are good for aliases. Pervasive online surveillance isnt the only issue at stake. There is wide spread commercial tracking that extends onto paper and pencil forms, and phycial presence in stores. Check out The Complete Privacy OSINT and Security Podcast for more.

>>8361 What proton can do to protect my data against CIA/NSA?

>>8364 >What proton can do to protect my data against CIA/NSA? Im not an expert. But here is what i will speculate what a generic Intel service might be able to do: If your not targeted, then 99% of your email is stored in sent boxes of major corps anyway. Its difficult to get a list of mail sent to you (outside your account) unless unless I collect everything and index it in a database. This has been done before. Even of protonmail honors there word, and is truely zero knowledge, I can probably read your mail anyway. Unless you and all friends use PM or zero knowledge providers or crypto like gpg. If your targeted, perhaps we can force pm to serve you trojaned js to capture client-side key. Or perhaps I can mitm, as a state level actor (this has been done before), and use a bogus but valid ssl key to deliver my own trojaned js. Perhaps i can compromise you end point via update mechanisms (notepad++ done before) , or perhaps windows update etc. Perhaps your cell provider can push you a malicious system update ota. If a state actor is truly your adversary, your probably in trouble. All network, and SSL become untrustworthy. I hope you have a good wot with gpg.

I host my own email through a server I rent. The main concern you'll have is setting SPF in your DNS and also setting up reverse DNS. Once you finish that, you'll be able to send email rather reliably, unless you're sending to Gmail, which will seemingly randomly reject your messages. Here's a fun fact: While Gmail blocks most of my emails, I believe every spam email I've ever received is from Gmail. That sums it up rather nicely. I'll be glad once they're gone, unless the next largest company starts doing the same thing.

>>8350 protonmail needs phone/donation to register. and you might as well kill yourself for using a service that states "hosted in abandoned bunkers" as one of their selling points >>8365 >webshit >secure protonmeme is soykaf and the idea of having a chain of trust up to some scripts to be run in the browser plus a bunch of crap to make sure neither the certs nor the code changed is asinine. you realize we can accomplish the same thing with real software in 100 lines of code and 1 or 2 standards, instead of hundreds of thousands of lines of codes and hundreds of standards, right? jesus christ what is wrong with you people. why do you want a "secure" or "private" email? just use GPG or some soykaf with a sane service like cock.li also unlike 8ch.net, governments weren't able to come up with a fake reason to take down cock.li, so it's the one thing that's actually battle tested (in the sense that you wont have to make a new address any time soon, it's still insecure like all mail until you add end to end crypto) >I hope you have a good wot with gpg. the GPG WoT is placebo ass bullshit. http://longpoke.github.io/f37c5de221cb361db07f046b31047f329ddb2ca2fe3ab5b674c858a6686c5151.html

>>8351 Don't take this advice. You'll probably fuarrrk your config and leave gaping holes. Email is garbage because even under best practices one key can decrypt a whole archive, but if you have to use email, use PGP on a service that isn't smart enough to track user activity, and only talk to it through a dedicated client. Or use Tutanota and only talk to other Tutanota users. >>8446 >the idea of having a chain of trust up to some scripts to be run in the browser plus a bunch of crap to make sure neither the certs nor the code changed is asinine They've admitted this is a problem, and their apps are fine. Protonmail solves two problems. 1. Your mailbox is full of persistent metadata, even if you use PGP 2. People are too stupid to figure out PGP It does a decent job at those. Tutanota solves different problems but is preferable because of forward secrecy, if both users are on Tutanota. It also gives you a desktop client without a paywall.

>>8446 >protonmail needs phone/donation to register Or solve a captcha.

>>8438 Don't forget DKIM signing. DMARC helps too. That's probably why gmail doesn't accept your email. Either that or the server you're renting has bad IP reputation.

>>8438 >I'll be glad once they're gone Do you expect that to happen? The way things are going, it seems like Google is going to be here to stay, at least until I'm dead. Why do you expect them to be disappear?

>>8506 >Don't forget DKIM signing. DMARC helps too. That's probably why gmail doesn't accept your email. The only reason I added SPF and reverse DNS is because a different email server rejected my emails without it. The Gmail is the only email server giving me any issues. Still, I suppose I don't have much choice but to add this crap. >Either that or the server you're renting has bad IP reputation. I doubt that's it, as my email occasionally gets through. >>8507 >Do you expect that to happen? The way things are going, it seems like Google is going to be here to stay, at least until I'm dead. Why do you expect them to be disappear? It's wishful thinking. One can hope the recent anti-trust action may amount to something, but Google is an NSA asset, so it's ultimately unlikely and I've read it's focusing on how Google hurts those poor competitors than all of the other awful soykaf it brews.

>>8506 >>8513 I solved the issue today and the reason is poor. I had the following line in my OpenSMTPd configuration: limit mta for domain gmail.com inet4 This was intended to ensure I only use IPv4 when sending mail to gmail, so I wouldn't need to comply with the IPv6 sender requirements. I wondered if, because I'm having issues with domains that are gmail underneath, if adding similar lines for every such domain would correct the issue, and it did. So, I'd prefer to think the OpenSMTPd programmers saved themselves some time with this behavior, at the cost of making it so unnecessarily arduous to figure out what was wrong. I'm glad I fixed this problem, but I refuse to recognize it as a problem I should've had to cope with to start with. Still, I feel some relief now that I can go through and send some emails I've wanted to for a while now.

Just curious, how does OpenSMTPD compare to Postfix? Been running my own server with the latter for a few weeks now, suprisingly has no issues with gmail or anything (I have dkim, dmarc, spf set up). Tried to get OpenSMTPD set up but debian only packages the old versions, because it doesn't package LibreSSL (compiling them from source didn't work for me, somehow). Anyways, is there a significant difference?

>>8446 >protonmail needs phone/donation to register No it doesn't.

if you use basically anything other than cock.li, you're a freedom-hating, police-state loving cunt and you are the reason the software industry is such garbage. even cock.li is garbge (e.g because it needs JS) but almost everything else is far worse >>8352 do you even use end to end encryption? you sound like a moron >>8495 show me the captcha, motherfucker. do you see one in this screenshot? >>8543 It does cunt. you just have an IP that didn't trigger it, or the time of day was different, or some other variable changed. i just tested it right now and as usual, got the block. the fact that they do this at all is garbage now please fuarrrk off and never talk about this garbage meme service again >>8466 >They've admitted this is a problem, and their apps are fine. oh you sure took care of my concerns there. i wouldnt have guessed that their apps are fine >PGP is complicated then use fuarrrking 7zip or rar. even that bullshit is better than webshit. or those debian meme tools (signify etc) or whatever is popular today

>>8350 >Which is the best email in terms of security and privacy? they're all absolutely equivalent because you should be using end to end encryption using your own tools and not their provided JS scripts >protonmail trash for above reasons. and im sure the GUI is DOG SHIT without even needing to try it also it probably has tons of vulns like all web based login sessions >disroot i went to sign up and got tired after looking at the login page and closed it >muh special snowflake password policy >muh recovery question >muh recover email what kind of pretentious fuarrrks require an email to make an email????? >riseup snobby invite only bullshit and they probably snoop on your account since there's only a tiny amount of users, and ban you after snooping long enough to find something they dont like. just as bad as autistici. why do people even talk about these trash? >Tutanota garbage GUI. and you have to reload the entire page and enter your user/password again each time you send an email

Posteo, but even then the German government forced them to log IP addresses

What do you think of https://lavabit.com/ ?

>>8583 Uhhhh didn't they voluntarily shut down a while back as their only alternative to installing an NSA backdoor on their product? While signal and telegram mysteriously stayed up and their canaries disappeared? So if they're back... hmmmmm

>>8587 Links?

>>8583 The fact it came back after being shuttered by alphabet soup makes it glow in the dark harder than the sun

aside from running your own server (if you know how to keep it secure), the best all-around free, encrypted, standard email client compatible, email service with an onion address is riseup.net. but i think they don't take applications any more, or at least not without an invite code from a current user.

I thought the Lavabit guy was trying to come up with an encrypted messaging standard after the whole government fiasco. DIME, I think it was called? DarkMail? I can't remember, too lazy to look it up.

>>8676 He is, but it doesn't seem to be going anywhere. The fancy client they were making for properly using it has yet to materialize. Also, if I recall, it is incompatible with normal Email so it's ultimately just another competing standard for end-to-end encrypted messaging.

>>8353 >MATH IS HARD

>>8547 why would you even suggest something that costs money and then admit that it's garbage??????????????????????????? paying for email in hopes of getting "security"/"privacy" is the textbook definition of snakeoil pls get off my internet people like you

>8351 >Self Hosting Security v.s. Anomity is important here, because If you self host, you are no where near as anonymous as a random gmail user. Any address at your domain is you, whereas, you can have tons of gmail, yahoo, etc. accounts and be indistinguishable from the masses. Same issue with self hosting a VPN. Of course, you have to continuously monitor and maintain your server. Self Hosting also grants 4th Amendment rights, provided its hosted at home (with an expensive business connection, and static IP). IMO, as much as I love self hosting, its a hard sell without anomity. Using 33mail , anonaddy , or blur forwarders might mitigate this privacy/anonymity issue.

>just use GPG This is a common attitude but really doesn't reflect the reality of e-mail. E-mail isn't really used much for two way communication any more, and corporations do not encrypt their e-mail to you with PGP. From a solving pervasiveness mass surveillance perspective, PGP isn't it. That said, PGP is awesome and should be used were possible for sensitive direct communications.

>>9652 It's good when you need a real or pseudonymous identity, but at the same time don't want to store your data at NSA's data banks.

Unfortunately e-mail is an inherently insecure protocol, since metadata isn't encrypted. Sure, you might stop Snoward Edwen from reading the content of your emails, but he can still see the metadata: Who sent the email, when he sent it, who was it sent to, etc.

>>8350 I'm happy with Tutanota. I never send E2E outside of other Tutanota users but it's there if needed. The desktop client is nice and the price for extra stuff is affordable unlike Protonmail.

>>8350 The only way to be sure your email host isn't reading your emails is to encrypt your emails.

>>9742 Depending on your threat model you might not care about metadata.

>>9742 You can not escape metadata in packet-switching networks, the computer A has to know where computer B is located to send them data. If you want your receiver to remain completely anonymous, use a radio broadcast then.

>>8350 The best paid Email service is Posteo, it has the best privacy policy and the best free Email Service is Disroot.org or Dismail.de because they also have an incredibly good and clear privacy policy.

>>8358 Also the thing about riseup is that it's maintained by a bunch of socialists (actually useful idiots as Vladimir Lenin used to call them) and you seriously cannot trust people like that with something as delicate and private as your email.

>>9745 The desktop client of Tutanota is a beta and also it hasn't been updated since it was announced

>>9800 It werks tho

>>8350 I'm quite surprised I haven't seen migadu [1] mentioned here. Hands down one of the greatest alternatives to popular email providers such as protonmail, posteo, tutanota, etc. It falls under more of security than privacy, though. Since you're using your own domain name which can potentially be tied back to you. However, I personally think it's a tradeoff worth it for me. I would encourage you at least check their website out to see what they have to offer. Setting up was relatively painless for me, support team is nice. Only thing would be that standard rates are quite expensive (4$/month) and it may turn you off. But they do sponsor students, and open source developers [2]. So if fall under any of the two, then maybe you can get it cheaper. The webmail isn't fleshed out either, but then again using webmail is just bad anyway in comparison to an email client like Thunderbird or neomutt. References: [1]: https://www.migadu.com/en/index.html [2]: https://www.migadu.com/en/faq.html#anchor_sponsor

What about secmail.pro? Anyone use that?

Anyone here used migadu?

>>9814 Well yeah. But I'm >>9803. You can see my thoughts there

>>9821 How do you feel about their privacy policy? Says their data is stored in france, and theu take ppace in compliance with eu gdpr as well l as swiss dpa. I guess they're half in swiss and half in France. But data is in france. Do you think as long as you use like pop3 and have it push and download to all your devices then delete itself from migadu servers after like 4 day grace period, all should be good?

>>9828 I think privacy policy is fine. You can always ask them to delete and restrict data processing under GDPR (which I have done). That's what I'm presuming. At least that's how I've set up my email on Thunderbird. If you want, I can get in touch with support and ask them the protocol for this.

>>9831 Can you give a template to use to email them to restrict data processing and delete? Also yeah It'd be cool to ask them

>>9821 On a sidenote, what do you reccomend using as your main email? For actual migadu login? Maybe a disroot account?

>>9833 Unfortunately, I am just using my work email for it. I couldn't be arsed to maintain more throwaway emails and so stuck with using work email. You could easily create a throwaway protonmail account or whatever that is exclusively only used for migadu login (note that they do not recommend using a migadu email as migadu login for obvious reasons such as misconfigured email). >>9832 I'll do that in a later post; currently it's rather late for me and I have been traveling around.

Someone willing to share a riseup red account invitation code ? prainacte@airmail.cc thanks in advance

>>9844 Bump

https://protonmail.com/security-details >protonmail >e2e encrypted I don't understand this. How can they possibly e2e encrypt your email if they have to send it in clear text 90% of the time? They also talk about having no data on you but their MS hosts would be receiving clear text email. Are they just talking about email between protonmail users? Also, does anyone know how your public key is obtained by your browser without it being stored on their servers?

>>9927 >public key meant to say private key

I think partitioning and using the right service for each job is the best way to do email. Self hosting on your own domain (as in VPS, not necessarily at home) is a good way to give a new email address to every service you sign up for. It also might make sense for a personal email account where the content of the emails will already deanonimize you. A service like proton or tutanota might also make sense for this role if you are worried about your VPS getting pwnd. For situations that call for anonymity, something like cockmail is the way to go. Use a random string as the account name and have different accounts for different roles. The more emails you have the harder you are to compromise either in terms of privacy or an actual security breach.

I've had Riseup, Proton, Tutanota, Autistici for a long time. I prefer Riseup. It's reliable, accessible via standard email clients, accessible via onion service, encrypted on disk and in transit. Autistici is pretty similar. Both Riseup and Autistici expect users not to be fascist, but you don't have to be politically fanatical. I find them to be pretty sensible ideologically.

>>9925 Ah crap. Forgot. Here's their response: Regarding data processing. No third parties are ever involved. No personal data processing here. Regarding POP3 - When you delete a message, it will be available for 7 days max (no guarantees though, it may be less but for sure not longer). We have these backups for user accidents (e.g. wiped mailbox) but they are not guaranteed at the moment for longer periods and will soon become a paid option as not everyone wants it and it is a significant cost to us. Thanks

>>9996 >and will soon become a paid option as not everyone wants it and it is a significant cost to us. that's actually pretty nice, I like that solution >>9994 Maybe it's not a thing any more, but what bothered me about Riseup was that you had to provide identification. Is cock.li a meme?

>>9999 You don't need ID to have a Riseup email. At least I never had to send them anything (registered YEARS ago so maybe something changed?) It was just a matter of writing a request explaining why you want an email address and I remember saying something among the lines: "I need it for my activist group" that was it. Done.

>>9999 Hm, that's the first I ever heard of Riseup requiring ID. I was never asked for ID when I signed up years ago.

>>9797 >Also the thing about riseup is that it's maintained by a bunch of socialists (actually useful idiots as Vladimir Lenin used to call them) and you seriously cannot trust people like that with something as delicate and private as your email. perhaps, but not for the reasons you're probably thinking of. what you really want to be worried about is the fact that leftist orgs are either on a metadata correlation surveillance list at best or just straight spooked up to the gills at worst. that's assuming you're right about them being socialists, i'm just taking your comment at face value without verification for the purposes of this discussion. on the other hand, a leftist organization has better incentive to not pursue vc funding, invest in decent security, and just treat your soykaf better in general. they know that they are actual targets of federal police and privateer union busters, not just hypothetical targets. a tech-libertarian organization grovels for vc funding and designs for hyperbolic advanced threats that they'll never face because their ego convinces them that their adversary is going to be a state tla that monitors foreign state adversaries, which is amusing because states don't consider libertarians adversaries, rather they're seen as useful consumers. they'll fall victim to hubris, gloating and advertising themselves as a service perfect for money launderers and illegal porn traders (like lavabit back in the day). a leftist organization has to stay quiet, trust not even the users, and design for threats that are actually at their doorstep. just a couple more things to think about since you felt like bringing ideology into the thread.

>>10006 In my experience, the Riseup team are very tech-savvy and trustworthy, regardless of what their politics may be. They have also possibly been infiltrated or otherwise subjugated by spooks, eg via national security letter at least once. However, since spooks are not my threat model, that doesn't bother me much. It's still a nice haven from corporate surveillance, Johnny Skiddy, and Ivan Haxki. I'd rather have FBI reading my mail than Google or Mitnick.

anyone use rainloop+ nextcloud or freedombone+ mailpile?

>>10009 https://riseup.net/en/about-us/press/canary-statement I think they handled it very well. Canary went down, everyone knew it was time to be careful, and Riseup is still around today.

>security and privacy Any email provider where you can sign up over tor so they dont know your identity :) Not sure it's a good idea to hook up accounts with payment information to cock.li... That guy offers hosting in exchange for monero, i mean that can't be safe ;-) Maybe he takes a peek at the boxes from time to time and makes sure his customers are not like the absolute mafia or something? I, for one, would be a little worried otherwise. Also, if you are going to use the account for any sort of important correspondence, make sure your email provider is in good standing with all effing spam blacklists, otherwise many big providers will just fuarrrking EAT your emails forever (rather than putting them in the spam somehow like they are supposed to) I run my own mailserver too and im proud of it but i can second that it's a terrible idea, for example im currently on some absolute fuarrrker's blacklist who now wants me to sell my soul to him for triggering unlisting More about anonymity: I wonder if running proxychains thunderbird actually works and makes sense (on a separate install of thunderbird, profile thingy maybe?) More about "best email": I think if I was a blackhat who was hijacking a company's DNS MX record i would try and spin up a mailserver on a hacked box somewhere to gobble up all the redirected emails into a single wildcard account or something, that would be handy to trigger some password resets, tho in that case 2fa would actually help for once ;)

>>10022 vince is a glitterboy but hes a cool glitterboy, ive spoken with him and soykafposted with him.

>>8546 >like all web based login sessions Someone explain? Is the vulnerability just that they can log you going online when you actually go online rather than random downloading?

>>10088 That guy seriously has no idea what he's talking about and you can safely ignore his entire message.

>>10089 https://medium.com/@ChandSingh/protonmail-xss-stored-b733031ac3b5

>>8350 I think the best email in terms of privacy would be D-Mail protocol, processed by a phonewave (name subject to change) server. Although this setup might attract the attention of SERN

>>8350 Self hosting on mutt, be sure to use your gpg to encryption ease of mind comfiness

I've self-hosted and paid for services. Here are some random eclectic thought. if you host yourself: you need to keep abreast with the latest updates and the breakage /downtime that can come with them. You must deal with setting up security for your server and your domain. Which can cause sufficient timeloss and possibly at unexpected times. you also need to acquire a PTR record (unless you don't care about sending mail classified by some providers as spam / rejected). if this is hosted on your own box then it needs to be from your ISP. Which means that at least the domain reverse lookup will be tied to your information. This kind of begs the question about where you are sending your mail to. Depending on the recipients' email provider and software they are using to receive this e-mail, it's quite possible metadata and even actual contents of email are being intercepted. Remember that under a simple setup your IP is being recorded by the servers and probably in the email header. if you have others using your mail server then you must think of even more. At the same time you can do things like have wildcard aliases which you can give out to people and use for websites so you can tell exactly who is giving out your email address, and anyone attempting to hack that address will need to acces your real one. with a managed service: you are trusting an outside service and the service can suspend your account at any time, they also probably can read your email, but less information is tied to you. remember that modern software can access phone contacts that users who know you have set up, wifi networks and a bunch of other nifty pivots. I would say in most cases that your email practices and practices in general are as important to overall privacy and security as the setups themselves I see all these services like protonmail and toolkits like age/GPG and see flaws in all of them. I think they are steps in the right direction in certain ways but that ultimately because of the way email protocols are built that a very very complex system must be made to have secure/private email.

>>9655 there are an increasing number of services where one can upload a GPG key and all messages from this service is sent through GPG

Self-hosted.

>>10679 How

>>10679 This is actually a pretty bad idea unless you have significant security competency and knowledge, but it is doable. There's probably people on here who could do it just fine but I think there's also a lot of people on here who think they could but would really be terrible at it.

>>8545 >show me the captcha works on my machine Present Day, Present Time! AHAHAHAHAHA!

>>11020 But do you use a VPN/Proxy? I believe that protonmail does show you the captcha if you connect to them directly. On the other hand, when I tried to register through Tor, the captcha option wasn't there.

Since I don't know what you're doing >soykafposts/burner Cockmail >professional but secure Tutanota >trash collector/niggercattle stuff mail.com, gandhi.net, gmail, yahoo, outlook >super sekrit self or remote hosted email server on tor/i2p Obligatory use pgp nigger.

Use CTemplar Email

Is there any decent free email provider out there? I know that I can't expect a super private service like tutanota or protonmail for free, but at least something that's a step up from gmail. >ib4 cock.li Still want it to look professional.

>>11082 >I can't expect a super private service like tutanota or protonmail for free They are free last I checked, unless you want certain features like using your own domain

>>11104 Oh that's pretty cool, thanks! Read a bit more in the features. Might go with tutanota. Unfortunately it does not support using my own email client (which I guess is understandable).

>>11082 Just use the firemail adress

What's the best way to communicate using end-to-end encryption? PGP, but what clients/services do you use?

>>11116 That's pretty much the only way to do it over email, right? (unless you rely on protonmail and tutanota). I use enigmail on thunderbird. Too lazy to configure mu4e or mutt.

http://hitler.rocks -----BEGIN PGP MESSAGE----- jA0ECgMKrhWx14Cvr9mn0lMBnfsW8s4NwBJJydwHERcf4FbE1QpPqpSP0i7bvqVN mVJ3d71MeykvyQwlpY/aAoUCuSJWzxiMaKVQ8ZTwMDZAdBsoR7cN980de4x8lDkn l3zPGw== =hFh3 -----END PGP MESSAGE-----

NO EMIALS R SECURE OR PRIVATE TL;DR - if u have to send an email: gmail for everyday and nonimportant emails. protonmail (only to other protonmails) with 3rd party encryption with password for important stuff. Otherwise use a direct message service with Snowden used lavabit (opensource and emphasized privacy) and they literally had to shut down their whole operation because the US gov came knocking. I doubt a profitable business like protonmail would shut down rather than hand over ur emails. Silent Cirlcle shut down because it realized that it would have to hand over emails if the gov told them to There are 3 email protocols: SMTP Port 25 - sending POP3 Port 110 - recieving (u store ur messages) IMAP Port 143 - recieving (server stores ur messages, all webmails use this) Inter-Domain - from one Message Transfer Agent (MTA) to a different MTA (google to protonmail, icloud to yahoo, etc) Uses SMTP. This method is UNENCRYPTED. It HAS to be in base64 plain text or the protocol wont work. Anyone with something like Wire Shark can listen in and get the machine name of the source computer, ip address of the sender, ip address of the server it connected to, time stamps, name + email adresses of both sender and reciever, the subject line, message body, and any attachments. This is how Hillary Clinton's emails got leaked. US law bans sending medical records via email and the irs doesnt send tax info via email for this reason. Intra-Domain - google to google, protonmail to protonmail, etc Most email providers have upgraded to the encrypted versions of the protocols for intra-domain, so those now become: Encrypted POP 3 Port 995, Encrypted IMAP Port 993, and Encrypted SMTP Port 465. This means that emails sent from google to google cannot be read by someone tapped into the Local Area Network (LAN) or Business Area Network. Emails that stay within the state department are secure, but Hillary Clinton had a private email server that she used. Since most poeple have gmail, less chance of a Wire Shark listening in. However, if u send an email from one gmail acct to another gmail acct, google can still obviously read that email. Whether they do or not is more of a question of if u trust them or not. Gmail - everyone knows that google datamines every service they can get their hands on. However, for everyday legal stuff, gmails hide in plain sight because its the needle in a haystack of trillions of other emails. Just make sure not to say like "underage girls" or "this is your password" in it or anything lol. Plus they have a policy of letting users know if a subpeona is ordered for their emails Protonmail - this is probably better for intra-domain. However, if i were the US gov and wanted to find out what cyber crime was going on, i'd check protonmail. John McAfee thinks (for whatever reason) that theyre in bed with the cia Solution - if u really need to send something via email that u cant have anybody reading, use a service like protonmail (intra-domain), but encrypt ur messages with a thrid party and dont use any real names, while using a vpn and tor. Thats what snowden did and thats why he had enough time to get the info out and escape even with the us gov watching him like a hawk. you'll have to agree to a password or key or whatever with the reciepient somehow, i'd recommend in person

I think I might pull the plug on Tutanota. I used it simply to have an e-mail that wasn't Google, no special security needs. They promised offline mode on their apps last year, still nothing. Their desktop app is a soykafty Electron client that fails to self-update or fetch emails and notifications. Their calendar is a joke. No IMAP/SMTP support. I might switch to Posteo but I heard it's a terrible provider. I don't mind paying some money every year as long as I get a few aliases all in one inbox.

>>11198 Protonmail can't hand over anyone's emails. It's encrypted on disk and they don't have the key, the customer does. Same with Riseup. All they can hand over is encrypted data without keys.

>>11199 If you want a paid email service, MyKolab in Switzerland has a good reputation for customer oriented security

>>11199 >No SMTP support So u just cant send emails? >>11200 lavabit claimed to do the same thing, yet this dude with child porn's acct was pretty wasy to find. Even if its encrypted, it just takes time to break. plus the headers (meta data) associated couldnt be encrypted. otherwise u couldnt send it https://www.docketalarm.com/cases/Maryland_District_Court/1--13-mj-00607/In_the_Matter_of_the_Search_of--_Lavabit_LLC_Email_Account_for_Joey006%40lavabit.com/

>>11200 How do they decrypt the email when they don't have the keys?

>>11200 Yet they provide you the client which handles the keys. Which means that they can trivially get the keys whenever necessary. -> Classic trap.

>>11201 At this point I care much more about IMAP/POP3 support so I can use a decent mail client than any l33t h4x00r security features wrapped in a soykafty web client riddled in bugs that notifies me of email 30 minutes later. As long as there are no ads and it costs under 20 bucks a year I'm good. It's not like there's anybody I talk to who is smart enough to use encryption. I was thinking about Runbox, Posteo apparently is a meme.

>>11212 >I was thinking about Runbox Can recommend Runbox, solid company and I've had no issues with them over the past 7+ years I've used them

>>11218 Do they get the same buzz as Tutanota/Protonmail? I've heard people say that they have a bad reputation because of all the criminals using it, and they're starting to get blocked on websites because of it. I still can't believe there's an email called cock.li

Runbox & Ctemplar

>>11758 You can use tutanota and protonmail with your own domain (may need to pay a little for premium)

Www.posteo.de

>>11210 You can upload your own public key if you don't trust the one they generate.

secmail.pro, it's sus but if you use GPG + {insert your favorite anonymous internet browsing setup } its good

While we're on this subject, I've been curious: can you sign up for soykafloads of accounts on email services by automating the verification email, sending it to your own server? Do you have to have a domain to actually get email, or can it be over simple IP?

>>12940 You can pull mail from multiple accounts using one client program. It doesn't matter what computer downloads mail from target address: an always on server, or a not always on personal one, they both operate on similar protocol, usually SMTP. Pulling mail with an always-on server makes sense when target addresses have very low inbox volume which fills up fast but personal server has plenty and makes regular checks for incoming messages.

none, email is not made to be secure.