Hacker News Reader

Comment by josephg | Hacker News Reader

I got into a discussion at IETF with some people over email security a few years ago. The reality is, email was invented in the 70s. It’s missing all the modern messaging related crypto innovations (E2E security, signing, encryption, otr messaging, etc). And there’s very little interest amongst the big email providers in overhauling email to add these features. Even if some niche email providers have good security, if the person you’re communicating with uses gmail or something you’re still screwed.

If you want a communications system that’s safe from government snooping, don’t use email. Stick to signal or maybe WhatsApp. Or if you must, self host. At least then the court order to see your server will come to you.

View on HN

Protonmail is perfectly safe (for now) as long as you use it through Tor (https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...) or a VPN so they don't log your IP and don't provide real recovery information.

Have you tried registering an account on proton via Tor? I get a prompt to verify my phone number or give them a recovery mail (trash mailers are blocked) 99% of the time.

it might have changed recently but i have previously created accounts by providing trash mailer addresses during creation.

do they not verify the recovery email before account activation? how do you not provide a real recovery mail?

you can get around by using disposible mail services.

No, those are generally blacklisted by Proton.

You can remove the recovery info after registration.

Get a free domainname, set up a mail server and receive your confirmation email. Then switch to a recovery phrase, get rid of the whole domainname.

so, the question is here how safe tor is.

Its only safe if you're only talking to other people who also use protonmail. (Ideally also through tor.). As soon as your email thread includes people on gmail, the government can just ask them for the email thread.

And if you're restricting your conversation to people on protonmail for security, why bother with email at all? Seems easier to just put the conversation on signal anyway. And then you get all of signal's other security benefits, like E2E encryption, crypto ratcheting, disappearing messages and so on.

It is not possible to sign up over Tor (neither through their .onion nor through proton.me) without providing a non-disposable verification email address or a non-cryptocurrency payment method.

This second restriction is especially damning: They accept cryptocurrency, but only for existing accounts - after you've already doxxed yourself.

Those services require coughing up your phone number to use. And since recovery emails are apparently the weakness used in proton's case, not the encryption of the mailbox, that sounds worse.

You don't have to have a recovery method on your Proton account, it's optional. You can also use a recovery phrase instead of having a recovery email on your account: https://proton.me/support/set-account-recovery-methods.

i self host email now. for the past 3 years. It's been relatively painless experience so i can only sing praises.

The idea that "as the webmaster of the email server, i could get a notice and i can conveniently, confidently say "fuck off" sounds fun".

This isn't about protecting pedos or serious bad people but dmca nonsense or such "legal requests" that you are confident you can say no.

For a very long time I saw articles on self hosting, where people complain that their emails are filtered out by big providers and it is no longer feasible. How do you deal with this part?

The easiest way is to use an SMTP service like smtp2go to send the emails but I am not sure if it invalidates the point (you still host the email server, just not the SMTP side).

this is useful for doing mailing lists delivery and other mass email stuff. for regular office/personal use, self-hosted email works fine

I run my own self-hosted email server for the last 15 years but I had to move to this hybrid system recently because Microsoft (outlook.com, hotmail.com, etc) blocked all the IPs of my hosting company. It is a shame but there's no point appealing (which I tried anyway). So it may or may not work, it depends on luck mostly.

yes. i will give you my personal experience from 3 years ago and last month.

3 years ago:

gmail/outlook was an ass. They marked all emails as spam. I had to call recipients to check spam and mark as not spam. this was on-off for the first few months. then things went good on their own. They would mark spam initially all emails, then emails with attachments then once marked as not spam, things got better.

today i have 0 issues in outgoing email. funnily, i have a website that sends me emails and there is some unknown problem on "receiving emails". just one website so haven't had much look into it.

last month: followed the same setup and gmail/outlook made no complaints. this was surprising to me as i deliberately sent attachments but nothing.

one thing to note. i once send 15-20 mails in bulk (not cc/bcc but separate) at once and that triggered some spam response. marked as not spam fixed it though on recipient side.

both times i used mailinabox and a cheap vps from lowendbox deals. racknerd or something on offer.

takes 1 hour almost from domain/vps purchase to full setup and sending emails. backup on backblaze b2.

takes 5 minutes every 6 odd months to update the software but that's about it.

Choose a host that is not lax on spammers and guard your IP well. Don't use something with a fast moving shared IP pool like a vm. A dedicated server is best.

Do not bring your server up without securing the email setup and setting up essentially useless things like DKIM, SPF (and DMARC). Large providers want to see those.

If you get into a block list, know quickly and fix quickly.

Use a well established domain suffix like .com. The cheap vanity ones are usually blocked more.

If you need software recommendations, there is nothing Postfix+Dovecot cannot do.

I recently set up my own self-hosted email solution again and made sure to do all of these things:

    * Proper A and MX record set up in DNS per SMTP standards
    * Proper SPF record in DNS
    * Proper DMARC record in DNS
    * Proper DKIM record in DNS
    * SMTP server (postfix) is not configured as an open relay
    * SMTP server is configured with a DKIM milter to sign outgoing messages

I used basic guides for the DMARC/DKIM stuff since that was new to me and tested with a Gmail account. The first few messages were marked as spam but I was able to unmark them. Once I was able to verify a correct SMTP setup, after two or three unmarkings, all messages were just delivered normally and no longer marked as spam. Google will even email you a report to help debug issues if your DMARC record is set up for it.

As far as I know this is about the best you can do. Everything else is pretty much getting your mail server IP addresses removed from various blacklists which can be easy to impossible depending on the service. The other option would be to forward to another service that allows relaying and has IP addresses with better spam scores but I personally prefer to avoid that.

You forgot mixing. Even with E2E encryption, 5 eyes could still capture traffic metadata and identify who is talking to who.

>Stick to signal or maybe WhatsApp

Or Session?

I just googled that to be polite. Looks like signal, except missing all my contacts. What advantage does Session have over signal that might make it worth moving my social network?

I believe session does not require a phone number to create an account, vs signal which (from memory) does which has privacy implications.

No phone number or email to use Session. Session is a fork of Signal. Each communication is decentralised. My biggest concern is they are based in Australia, which has even worse backdoor baying for blood than USA. Some details here. https://optf.ngo/

(typo - wrong link corrected)

Reply on news.ycombinator.com