Hacker News Reader

Comment by derefr | Hacker News Reader

You could "self-host" on a cloud server in, say, China, or Russia, or Iran (if they have any hosting services.)

I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care. And they have no treaties with the US to force their hand to turn anything over.

Think of your server as Edward Snowden. What country should it hide in, so the US can't legally get to it?

View on HN

> they have no treaties with the US to force their hand to turn anything over

Sure, but that doesn't mean they won't happily exchange that info as part of a deal with the US, assuming your data is valuable enough.

You're forgetting the possibility of rubber hose cryptanalysis applied on you. In fact just by hosting in such places, you're probably inviting more attention.

>the governments of those places will probably snoop your emails

Uhm, how? Gmail supports Transport Layer Security (TLS), and >80% of their emails to and from other providers do as well (https://www.google.com/transparencyreport/saferemail/). Reject non-TSL emails, give the server a public key and tell it to throw away the email plaintext, and the only remaining threat vectors seem like "get rubber hosed into disclosing your private key" and "server gets compromised, causing future emails (but not past ones) to get exfiltrated".

SMTP TLS doesn't and can't validate the certs. It is trivial to MITM it.

"I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care."

Can't you say the exact same thing about the US government?

Iceland.

Reply on news.ycombinator.com