Hacker News Reader

Comment by elagost | Hacker News Reader

Fastmail is great, but as this list is supposed to be "privacy focused", Fastmail (company from Australia) is not a good alternative. https://www.wired.com/story/australia-encryption-law-global-...

View on HN

Privacy from whom though? I’d contend that more than 99% of people reading this would, in all honesty, consider their adversaries to be non-state actors—marketers, hackers and identity thieves. For the less than 1% of us for whom their adversary is a state actor, I would contend that any implementation of SMTP is non-viable, period.

If you’re sufficiently paranoid, the only thing you can say for certain is that there isn’t much you can truly trust.

This is the key. Model your threat and act accordingly.

There's (mostly) no reason for Joe Bloggs to want to protect themselves from a well funded state actor but they may want to prevent themselves being locked out of Google services because some bot triggered a threshold.

Reporting on Australia's encryption laws is wildly inaccurate. For one, it does not allow authorities to compel companies or individuals to introduce an encryption backdoor or otherwise weaken encryption. The law very explicitly addresses this issue in section 317ZG, which forbids any kind of "systematic weakness" or "systematic vulnerability" and very explicitly states that weakening encryption is included in those definitions.

What's permitted is to build something that targets a particular person in such a way that it cannot possibly affect another person's security.

The example I use (though IANAL) is that a request to backdoor WhatsApp's encryption would not be permitted under the law. However I think that pushing an update that checks for a particular person's hard-coded phone number and forwards messages to law enforcement would be permitted.

The law in question: http://www5.austlii.edu.au/au/legis/cth/consol_act/ta1997214...

The "E" in email is for Evidence.

It doesn't matter what service you use. No email is private, I don't care who they are.

p.s. - I'm a paid fastmail user.

You're right. Even if the email contents are encrypted, there is still the metadata.

I wonder if the Monero Message System is still being developed. It would solve the metadata problem.

Yandex might be a niche choice, if your main worry is "5/9 Eyes". Free, even to bring your own domain.

Yandex is Russian so will certainly keep you out of the way of the five eyes, provided you ensure decent encryption between you and their systems.

Russia is also famous for its cadre of crack Salisbury cathedral appreciators.

Yandex is a nice escape from the western law enforcement if that's a threat to one.

Some of what I want to send and receive by email might be considered illegal in Russia, so that's a hard no. I don't trust Russia's legal system to interpret the law in my favor. Does, for example, this email receipt for a book about a bi football player figuring out his sexuality count as propaganda? I wouldn't risk it.

https://en.wikipedia.org/wiki/Russian_gay_propaganda_law

Do you fear the Russian legal system though? Are you really doing anything so controversial that you’d motivate Russian Intelligence to care about a foreigner?

My concern is automated systems. YouTube videos get demonetized and cloud storage gets shut down because of automated copyright enforcement. They shut channels down and delete videos for the kinds of things I worry about, too.

This was not always the case. It might not be the case now that Russian companies scan for this stuff, but why risk it?

I'd be more concerned about being blackmailed by Russian intelligence services.

To what end? Seems like a lot of work for a tiny return relative to the size of their Government.

Not blackmail in the sense of "give us money". Think more "do us a favor".

"hey let us log into your digital ocean instance every once in a while. we'll even reimburse you for the VMs..."

Reply on news.ycombinator.com