Hacker News Reader

Comment by pragmatic | Hacker News Reader

Could anyone recommend a hosted email service that does not allow spying on users?

Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?

You could pgp encrypt anything that you really don't to be read in transit. Short of that, you might as well assume that your emails are being read and stored by third parties.

Even if you personally use the most secure email server in the world, it doesn't matter because everyone that you send email to or from is likely using hosted services like gmail, verizon, hotmail, etc.

One big point here is that PGP only works when both sender and receiver and doing it. Try sending Bank of America a PGP encrypted email about your account. See what happens.

Edit: Re-reading my response... I don't mean this in a condescending way and I agree that PGP is a good way to handle email privacy. I only meant to point out that the majority of people don't use it.

Depends. All of my incoming email is encrypted with my public key as soon as it hits my mail server:

https://grepular.com/Automatically_Encrypting_all_Incoming_E...

So if my mail server or any of my imap clients are compromised, my mail isn't.

All of your incoming email has travelled through so many insecure servers on it's way to you that encrypting it on receipt is like closing the barn door after the horse has bolted.

Untrue. A lot of my core correspondance run their own mail systems and use TLS.

Even for those who don't, having my mail encrypted on all of my clients and on my own server is still a big gain for me security-wise.

Just because I can't secure the senders system, doesn't mean I shouldn't bother securing my own.

Try sending Bank of America a PGP encrypted email about your account.

Well, you have to use their web form anyway, which is encrypted. The reason they require a web form instead of email is for exactly the reasons PGP exists: they need to know that you are sending the email, and they need to know that someone else isn't reading their reply to you. Webs of trust are hard, a text box on their SSL website is easy.

If you use a hosted service, then unless it is specifically set up to prevent it (as with tarsnap for backups, which requires key management on the end-user's part), the people hosting it will have access to your data.

If that's a major issue, then your only recourse is to host it yourself.

Running a mail server isn't terribly hard, but it does mean that when the server dies you're on the hook for fixing it. If you're not a sysadmin, then the pragmatic choice is probably to accept that Google doesn't care about the details of your email and will only be spying on you in aggregate to determine what adverts to display.

i host my own server, but the best i found - about a year ago when i looked into this - was a norwegian company called runbox http://www.runbox.com/

their support was also friendly, helpful, and technically clued up when i discussed some issues (i didn't go with them in the end because i've hosted my own email before, know how to do it, and decided it wasn't worth paying anyone else).

[edit: to be clear, not only do i have more faith in the impartiality and openness of a scandinavian govt than the usa, there's an advantage in simply not using a host in your own country, imho.

also, running your own server isn't hard. with opensuse, for example, it's pretty much just a case of (1) clicking the right options in yast and (2) configuring getmail to pull your email from your isp. although to get something anywhere close to gmail in functionality you also need to understand (and use) procmail and mairix. then you need a client - i use mutt over ssh, but you can also install a webmail soln like squirrelmail if you want.]

I used runbox for several years a long time ago. I was very happy with them then and would definitely recommend as well.

Also, rackspace has a hosted email offering - http://www.rackspace.com/apps/email_hosting/

We could ask Google. They've tested a PGP feature in Gmail back in Feb. 2009, so I'm sure they would (try to) release it publicly if we ask for it loud enough.

http://googlesystem.blogspot.com/2009/02/gmail-tests-pgp-sig...

Under U.S. laws, providers are often required to give information to the government if they have a warrant. If you want (more) security, host it yourself.

True, however some providers make attempts to thwart this by making it impossible for even themselves to access mail by way of encryption. I haven't looked at it in a long while, but lavabit.com was one such company, and it's a pretty good raw POP/IMAP service (at last check the web interface and spam measures were somewhat lacking).

I like what lavabit has done, but at the end of the day, if they are forced to, they can modify their server side software to log your password when you log in, and then use that password to decrypt all of your email on the server side.

It also doesn't secure the email on the client side. If your IMAP client stores the email on disk, then you need to make sure it is encrypting it in a secure fashion first.

Lavabit should offer an extra layer of encryption whereby they allow you to upload a public pgp key which they encrypt all your incoming email with using PGP/MIME.

I don't think even what you said is sufficient -- as long as they are within the jurisdiction of the US court system, I think a judge can order them to start saving copies of incoming mail before encrypting, etc.

I think fundamentally you can't circumvent the law with technical measures. You need to change the law to require warrants.

Sure. The method I stated would protect historical email, but it wouldn't prevent the capture of new email after an order has been made to start saving it.

It's not necessarily 'spying.' Many large service providers have such as system for logging in as a user to aid in troubleshooting. Yahoo's is known as AMT for example and lets customer service (or anyone with high enough access clearance) 'be' that user, to see first hand the issues the customer might be dealing with.

For everyone who thinks they're an email pro, or never come across problems, there's thousands of users calling any support number they can to try to understand why their junk mail folder won't empty.

For me, I use TrulyMail. If another TrulyMail user sends me a message, it doesn't go through any email server (just TrulyMail's server). Everything is automatically encrypted /decrypted on the client so even if someone access their servers, there is nothing readable. They also have email encryption. They are also priced right: free.

PGP is great and I used to use it but, as many posters have said, if the other party doesn't use it (or if they use it and you don't know they use it) it doesn't do much good. This is really true of all encryption systems.

Well you can have a secure in-box yourself, but your e-mail will still be sent to untrusted providers.

Another option is to give a certificate to your contact and send all conversations encrypted.

edit: oops, I did not notice bhousel's post (posting the same in other words)

You could try Hushmail (http://www.hushmail.com/). They claim to encrypt your e-mail but off course you can never be sure with third parties.

A good bet might be a Swiss hosted e-mail service such as Neomailbox which is what I use. Lavabit is another one which might be what you're looking for.

Living in Switzerland and knowing the laws, I would strongly recommend against that: since 2000 we have a law that forces all email providers to hand out communication logs to the authorities and to retain them for at least 6 months.

Granted: that's not the message contents, but it's bad enough. Also, from my experience I can tell you that the authorities do make use of this law even if it's just to track down a student anonymously badmouthing their teacher.

No. Stay away from Switzerland if you want your correspondence to be hidden.

That data-retention law is for the entire European Union.

6 months is the EU minimum, but for some reason the Netherlands decided to require triple that. I bet some idiot politician thought it must be "extra secure" ... :-/

You could check out https://countermail.com/.

Maybe hushmail.com ...

Yes: sdf.lonestar.org. Been running since 1987.

Haha, and a top contender for the record of having the most independent backdoors at a given time.

If you want privacy, the last place to host your email is on a shared shell box (especially a free one).

I had a sdf.lonestar.org account. Once, when their mail servers appeared to me to be down for a day, I asked on the discussion forums if I was the only one experiencing problems. The site administrator posted a response right away on the forums.

He told me to stop whining, then explained to everyone that I received too many emails per day. (I was receiving <100 emails per day, and I was nowhere near my disk quota) He then named the most common sender of the emails I received. He did all of this in a public forum.

Not only would I not trust SDF not to leak the content of your emails to unauthorized parties, I would not trust SDF not to simply read your emails for shits and giggles, or leak their contents in order to teach you a lesson for asking rude, nosy questions like, "Hey, is anyone else having problems with the mail server?"

hi i am mahesh

I currently use gmail. The only features I "need" are tags and searching.

Reply on news.ycombinator.com