Hacker News Reader

Comment by yosito | Hacker News Reader

While I understand the feeling, if you're emailing with anyone who doesn't use an encrypted provider (which is probably >99% of your email), state actors are easily capable of surveiling all of your email anyway, no matter what provider you use. Email isn't a secure form of communication. The advantage of a provider like Fastmail is that they're not profiling you based on your data like Google would do.

View on HN

I get your point. As a EU citizen though, I want to at least have a way to realistically fight a lawful intrusion after the fact. If I understand the Australian laws correctly, they are mostly enabling hidden surveillance.

I'll be trying out https://mailbox.org/en as an alternative. They seem to have good PGP infra and are hosted in Germany.

I've been pretty happy with proton mail. The built-in PGP and signing is seamless and the domain functions work great.

German here. Do not trust our government, please. Our politicians are utterly incompetent, as is the EU parliament.

The last somewhat (!) safe haven is Switzerland.

Is there a mail service that you trust?

It is a myth that swiss-based providers are in any way safer/more anonymous than others. See here for a recent article (in German): https://steigerlegal.ch/2021/08/02/protonmail-daten-usa/

Is there any email service one could reasonably trust?

If trust is the main criteria, I guess self-hosting is the only option (albeit a time-intensive one). There are commercial providers like mailbox.org that offer the possibility to PGP-encrypt incoming mails so that only you can read them.

Mailbox.org looks interesting. I'll check them out some more

A significant portion of the emails I receive are encrypted in transit using TLS. So governments would have to routinely MITM TLS traffic in order to surveil every single email.

"Sent with TLS" does not mean "cannot be surveiled".

I never said that TLS "cannot be surveilled," nor did I imply it in my two short sentences. I simply laid out a technical requirement to carry out such an attack.

For attackers to passively surveil TLS en masse, they'd need to MITM those connections. That in turn requires rogue CAs signing the attacker's certificates in large numbers. If that happens, the public would notice and the CAs involved would be permanently banned. Not sensible if the attacker's goal is to carry out persistent mass surveillance.

Much easier to just obtain the emails directly from few popular email providers instead.

But could, for instance, the Australian government compel Fastmail to hand over and hide a silent password reset email for any of my accounts, more easily than they could another provider?

Unless that password reset is sent in an encrypted email, it can easily be intercepted, no matter what your email provider is.

Is this done at an infrastructure level? IE, what level of access is need to just sniff up emails? Can anyone set up a relay or do you have to be a trusted entity?

Reply on news.ycombinator.com