Main email provider deciding to close shop.

[kasarberang]

1 hour ago, Kawaharu said:

I use PGP alot and it takes alot to learn about PGP and encryption. I have encrypt files that are sensitive and even encrypt messages as well. Encryption is a skill to learn and their are PGP programs that are worth using.

Think of it this way, Edward Snowden exposed the fact that Governments can read people's emails and Encrypting them, makes it alot harder to read and it would take all the computer power in the world to crack one email.

Sorry, but this is just not true. PGP and encryption are not hard to learn, they are exceptionally easy to use and learn, actually. 

The only reason Snowden's emails didn't get revealed was because his provider (Lavabit) shut itself down and force deleted all of their data, so federal agencies could not get him. If Lavabit didn't do that, Snowden would have never had a chance in hell.

Likely using PGP is probably more than acceptable for you, I assume you're just an average person who wants a little more freedom from big tech, ProtonMail and PGP will do that for you. I personally don't like ProtonMail for a handful of reasons, and that's why I don't use them anymore. PGP is good, but it's not perfect. It's probably more than enough for the type of communications most people are going to make (including myself) but it is not perfect and should not be trusted with truly sensitive information, if say you're an activist, journalist, person trying to fight against an oppressive regime, or other higher profile case.

[zzyzx]

On 4/30/2022 at 1:11 PM, kasarberang said:

ProtonMail has had a lot of controversies about it. They even lied about not keeping user's IP address and had to change their policies once they got caught. I moved from ProtonMail for this very reason, I don't care that they complied with law enforcement. I care that they actively mislead customers into thinking that it was virtually impossible for them to log user's IPs. They also made it out like getting a valid Swiss court order was practically impossible. Meanwhile, the reason they complied in catching the climate change activist was not because Switzerland had a problem, but because France (A country which is far less privacy/speech respecting) went through Switzerland to put a court order on ProtonMail.

I am now using Posteo which has a much cleaner track record than ProtonMail and also actively seems to collect as little data as possible, with a feature set that only helps further decrease the amount of data they have on you. Some of those features include: Transport Encryption, Encrypted Mail Storage (including attachments and metadata), Anonymous Payments even through non-anonymous methods and Inbound PGP encryption

@kasarberang @Kawaharu

I've been reviewing this thread as I'm getting too discussed with my current e-mail provider.  And if I'm going to make the switch, I figure I'd add security.

In reviewing Posteo, they are located in Germany, which means, Germany is part of 14 eyes....  As such, I think I trust Proton over Posteo at this point.... 

In any case, I need to move my main personal forwarding e-mail address because the current provider is blocking too much.  And if I'm going to move, I'm planning to move everything off the current provider.  It started as my ISP's service and then got sold off, and then sold off again....  : (

Probably go with a 2 year plan of Proton Unlimited which is 40% off through the end of the year....  Handles eMail, VPN, calendar and some cloud disk space....  Supposedly all securely....  From the comments it looks like at least some keys are stored on my personal computer so I need to dig in how to securely back that up....

I'm also considering adding a personalized DNS name, so I'm also willing to hear about DNS providers....

Open to other current comments on this. 

[ppdude]

On 4/28/2022 at 4:52 PM, AwakenEvil said:

Exchange 2016 and a go daddy domain! Yes yes yes I know 2025 I'm fucked... you know how much a copy of exchange costs with licensing!???

I found that process to be  extremely laborious and hard to do. So, being lazy, went with GoDaddy for the domain and using CPanel to handle the email. One Google account is used because the phone requires a gmail account. Otherwise I'd throw out gmail and any other (outlook.com) and bunches of others that aren't worth a pile  of spit. I leaned early on that you could only count on yourself.

 

 

[Little BabyDoll Christine]

Are there any free ABDL e;mail servers and domains?

[Firefly 35]

4 hours ago, zzyzx said:

From the comments it looks like at least some keys are stored on my personal computer

Not true.  They were also covid supporters back in 2020 thinking that contact tracing could be done "anonymously" via bluetooth.  Quite a shame.

[zzyzx]

My comment from above:  From the comments it looks like at least some keys are stored on my personal computer

3 minutes ago, Firefly 35 said:

Not true.

Based on setting up the free account, correct.  The only thing they are probably doing based on how the free account setup went and their claims, is that they must be storing a public / private key pair that they generate with the "private" key encrypted with your account password, probably salted with other personal info you enter.  Since access to old e-mail can be lost by changing passwords, you have to set up a (new) recovery key (that  you keep) every time you change the password to the account....  Interesting strategy, but that means keys are stored on their server for the encrypted mail, even if the decryption key is encrypted by the user's password....  That leaves decrypting the private  key to other methods.....  (i.e. user coercion, government seizure or personal computer, or ? etc.)

8 minutes ago, Firefly 35 said:

They were also covid supporters back in 2020 thinking that contact tracing could be done "anonymously" via bluetooth.  Quite a shame.

I probably shouldn't touch this statement in this thread.....    Any contact tracing requires some sort of database and opt in....  How anonymous this is depends on how much you trust the folks handling it.....  MAC addresses, etc., are supposed to be hardwired in the hardware....  and unique.....  But  that isn't true in current equipment, but most won't understand this level of what I'm talking about....

[kasarberang]

7 hours ago, zzyzx said:

@kasarberang @Kawaharu

In reviewing Posteo, they are located in Germany, which means, Germany is part of 14 eyes....  As such, I think I trust Proton over Posteo at this point....

Doesn't mean as much as you might think. Protonmail actually got the climate change activist because of a French court order which went through swiss government to make ProtonMail assist in taking the guy down. So you're not actually dealing with just the Swiss government here due to MLAT treaties. Something that Protonmail neglects to tell you about, except very briefly when discussing the incident regarding the climate change activist.

Posteo has some good features which allows you to not have to trust them, such as them being 100% open source, allowing you to encrypt your entire mailbox (including all content metadata) along with some other things. Posteo also supports PGP through integration with Mailvelope, so your PGP keys aren't actually stored on their servers, where with Protonmail, they are.

In the end, though, you shouldn't be sending anything truly sensitive over email, it's inherently insecure and should not be trusted with actually private/sensitive communication.

[zzyzx]

59 minutes ago, kasarberang said:

Doesn't mean as much as you might think. Protonmail actually got the climate change activist because of a French court order which went through swiss government to make ProtonMail assist in taking the guy down. So you're not actually dealing with just the Swiss government here due to MLAT treaties. Something that Protonmail neglects to tell you about, except very briefly when discussing the incident regarding the climate change activist.

Posteo has some good features which allows you to not have to trust them, such as them being 100% open source, allowing you to encrypt your entire mailbox (including all content metadata) along with some other things. Posteo also supports PGP through integration with Mailvelope, so your PGP keys aren't actually stored on their servers, where with Protonmail, they are.

In the end, though, you shouldn't be sending anything truly sensitive over email, it's inherently insecure and should not be trusted with actually private/sensitive communication.

@kasarberang

Thanks.  I agree that none of this is really secure.  And I was aware of the French court case from reading reviews....  With ProtonMail, I'm moving to a non US server, which means ALL email sent to me, and probably most (if not all) email I send out will cross the US  boarder, so for a brief bit, under the eyes of NSA.  (And probably appreciated by NSA better than what I'm doing now, since US based servers should be more hassle for them to get the needed court orders to spy on US citizens, among other things...  Ok, so it falls more to the FBI at that point.)  Since e-mail (basic) protocol is not encrypted, well....  The base messages can be captured if one is being targeted.....  Ok, a lot of servers have started to run SMTP over a TLS layer, so it isn't as bad as it used to be.  And the link from ProtonMail to me appears to be secured...

Thanks for the comments on Posteo.  After setting up the free account on ProtonMail, it is obvious that some keys have to be stored on their server for how things are set up....  And the only real security is your account password....  I do like the option to add VPN w/ some tor support, which would be nice to add, which Proton's paid accounts support.  And if I went to ProtonMail, I can tell I would want some features of the paid support, so I would probably go all the way in....  Currently testing with their free account.

Based on your comments, I need to investigate Posteo further.  And while Germany is in 14 eyes, from some reviews it is less of an issue than some others.  And agreed, being in Switzerland doesn't make the legal side immune from digging in.  I actually doubt any location is totally free from such attacks....  Unless I'm running my own system on my own hardware with a self destruct capability.....  Not something I care to go to......

[zzyzx]

@kasarberang:

I've now looked at Posteo secure mail system.  It is definitely a better product than ProtonMail for some one needing as strong a secure privacy protecting email service as they can get.  In my opinion, I don't "need" that level of security.....  I agree that someone needing it, this is a better option and someone needing it would work through the additional issues to make it secure.

I'd have to look closer, but their "promise" of blocking email not delivered of TLS based connections I suspect would not be correct for my planned usage (if enabled), as I'm using this via a mail forwarding server.  For those going direct, it probably works as advertised since most email is sent direct based on DNS information these days and not forwarded through a third party system, unless you are with in like a company subdomain structure.....  And I can understand the help in blocking spam this way....  So while this is a nice feature, it could block communication that I don't want blocked.  Ok, I don't have to activate the feature.  And while they allow one to test the setup for a short duration for free, I'd want to test some things that require a (very minor) payment...... 

Since I think ProtonMail better lines up with what I'm after, I'm still favoring that even though it is "less secure".

[kasarberang]

26 minutes ago, zzyzx said:

@kasarberang:

I've now looked at Posteo secure mail system.  It is definitely a better product than ProtonMail for some one needing as strong a secure privacy protecting email service as they can get.  In my opinion, I don't "need" that level of security.....  I agree that someone needing it, this is a better option and someone needing it would work through the additional issues to make it secure.

I'd have to look closer, but their "promise" of blocking email not delivered of TLS based connections I suspect would not be correct for my planned usage (if enabled), as I'm using this via a mail forwarding server.  For those going direct, it probably works as advertised since most email is sent direct based on DNS information these days and not forwarded through a third party system, unless you are with in like a company subdomain structure.....  And I can understand the help in blocking spam this way....  So while this is a nice feature, it could block communication that I don't want blocked.  Ok, I don't have to activate the feature.  And while they allow one to test the setup for a short duration for free, I'd want to test some things that require a (very minor) payment...... 

Since I think ProtonMail better lines up with what I'm after, I'm still favoring that even though it is "less secure".

Yeah, TLS sending/receiving is optional.

You should use whatever service you feel most comfortable with, in the end there's no perfect solution. You have to weigh the pros/cons for whatever provider and make sure that it's right for you.

[zzyzx]

2 hours ago, kasarberang said:

Yeah, TLS sending/receiving is optional.

You should use whatever service you feel most comfortable with, in the end there's no perfect solution. You have to weigh the pros/cons for whatever provider and make sure that it's right for you.

@kasarberang

Agreed.

Thanks for the discussion.  I'm long overdue getting rid of my prior email provider.  I appreciated the comments and discussion on this thread as it more quickly lead me to better services....

Again, thanks.

[zzyzx]

@kasarberang:

Finally found the option with Proton Mail to use keys I generate....  Haven't changed keys at this point as I don't believe I need to get "that secure" right now..... 

[Kawaharu]

Reclaim the Net has a list of good alternatives that value privacy and security.

https://reclaimthenet.org/private-email-providers/