5 ms·

A good alternative present today is Protonmail(https://protonmail.com https://protonmail.com). Aside from being secure and their encryption being open source, t

by otalp 10y ago

A good alternative present today is Protonmail(https://protonmail.com https://protonmail.com). Aside from being secure and their encryption being open source, their servers are also in Switzerland and subject to Swiss laws.

pvdebbe 10y ago
Can anyone compare this with Fastmail?
- ocdtrekkie 10y ago
  As a happy FastMail customer, I can tell you they do not attempt to have the end to end encryption that LavaBit or ProtonMail have. FastMail prefers to offer a lot of advanced features which do require their servers be able to see your data. There is a huge tradeoff between privacy and features, and while I'd argue by policy FastMail protects your privacy better than something like Gmail that uses your data for their own purposes, FastMail isn't that type of service.
- tyingq 10y ago
  The most noticeable difference is that Protonmail's approach means "no standards". No SMTP or IMAP. All emails must be sent and received via the web interface or mobile app. That also makes it hard to switch away if you choose to leave them. Your data is captive. I don't think that their intentions are bad...it's just the nature of how it's designed.
  - ahakki 10y ago
    That is true. But just so you know: I am a paying protonmail customer and received an email just today where they anounced tha IMAP/SMTP support is in closed beta. I do not know how this is implemented and what the exact security implications are. Here is an exerpt from the email: Dear ProtonMail Plus Subscriber, We are happy to announce the beta program for a new product that adds IMAP and SMTP support to ProtonMail. We call this project the ProtonMail Bridge. The ProtonMail Bridge is among the most requested features by the community and lets you send and receive encrypted emails from within your mail client of choice. The Bridge supports any client that uses IMAP/SMTP including Outlook, Thunderbird, and AppleMail. We will be choosing only a few dozen people to start so if you are interested in participating please fill out the following form by the end of this week:
_pferreir_ 10y ago
I'm not sure how Lavabit worked exactly, but ProtonMail, at least in its web version, is far from secure. An attacker could compromise their web servers and serve malicious JavaScript, thus intercepting the user's passkey.
desbest 10y ago
Protonmail is not anonymous. I tried to sign up with Tor and it asked me to validate my phone number. Also if you look at their Transparency Report, you'll see that they do data retention on the government's demand.
rsync 10y ago
"A good alternative present today is ... (blah blah I don't run a mail server)". No, that's not a good alternative. None of them are. The "good alternative" is to run your own mailserver on a physical piece of hardware, under a business name, not at your house. Technically speaking, it's childs play, so that's not a barrier. It does cost something to rent 1U of space somewhere but if you shop around and pay annually, etc., it's bearable. What you gain is huge: 1. Subpoenas/letters/writs go to you and you get to decide how to respond to them. You're the operator. 2. By you I mean your business entity which is a PO BOX somewhere. Not your house. 3. You get to control retention and encryption and certificates and security features. 4. Finally, instead of being a consumer/viewer of "the web" you get to be a peer on the network. For some people this will be truly using the Internet for the very first time.
- voxic11 10y ago
  The advantage to not running it yourself is if you trust a different government more then you're own. Maybe there isn't an advantage to using protonmail in the US because you trust the government won't simply come and take your server away. But if you were in a place like Thailand you may not have that same trust.
- sfifs 10y ago
  > 1. Subpoenas/letters/writs go to you and you get to decide how to respond to them. You're the operator. You're assuming here that the executive will actually follow the full.due process of law vs. "we raided X address on suspicion and grabbed a few servers". Not true in many parts of the world and having email encrypted and stored in a different jurisdiction may be safer.

by otalp 10y ago

pvdebbe 10y ago

Can anyone compare this with Fastmail?

ocdtrekkie 10y ago
As a happy FastMail customer, I can tell you they do not attempt to have the end to end encryption that LavaBit or ProtonMail have. FastMail prefers to offer a lot of advanced features which do require their servers be able to see your data. There is a huge tradeoff between privacy and features, and while I'd argue by policy FastMail protects your privacy better than something like Gmail that uses your data for their own purposes, FastMail isn't that type of service.
tyingq 10y ago
The most noticeable difference is that Protonmail's approach means "no standards". No SMTP or IMAP. All emails must be sent and received via the web interface or mobile app. That also makes it hard to switch away if you choose to leave them. Your data is captive. I don't think that their intentions are bad...it's just the nature of how it's designed.
- ahakki 10y ago
  That is true. But just so you know: I am a paying protonmail customer and received an email just today where they anounced tha IMAP/SMTP support is in closed beta. I do not know how this is implemented and what the exact security implications are. Here is an exerpt from the email: Dear ProtonMail Plus Subscriber, We are happy to announce the beta program for a new product that adds IMAP and SMTP support to ProtonMail. We call this project the ProtonMail Bridge. The ProtonMail Bridge is among the most requested features by the community and lets you send and receive encrypted emails from within your mail client of choice. The Bridge supports any client that uses IMAP/SMTP including Outlook, Thunderbird, and AppleMail. We will be choosing only a few dozen people to start so if you are interested in participating please fill out the following form by the end of this week:

_pferreir_ 10y ago

I'm not sure how Lavabit worked exactly, but ProtonMail, at least in its web version, is far from secure. An attacker could compromise their web servers and serve malicious JavaScript, thus intercepting the user's passkey.

desbest 10y ago

Protonmail is not anonymous. I tried to sign up with Tor and it asked me to validate my phone number. Also if you look at their Transparency Report, you'll see that they do data retention on the government's demand.

rsync 10y ago

"A good alternative present today is ... (blah blah I don't run a mail server)". No, that's not a good alternative. None of them are. The "good alternative" is to run your own mailserver on a physical piece of hardware, under a business name, not at your house. Technically speaking, it's childs play, so that's not a barrier. It does cost something to rent 1U of space somewhere but if you shop around and pay annually, etc., it's bearable. What you gain is huge: 1. Subpoenas/letters/writs go to you and you get to decide how to respond to them. You're the operator. 2. By you I mean your business entity which is a PO BOX somewhere. Not your house. 3. You get to control retention and encryption and certificates and security features. 4. Finally, instead of being a consumer/viewer of "the web" you get to be a peer on the network. For some people this will be truly using the Internet for the very first time.

voxic11 10y ago
The advantage to not running it yourself is if you trust a different government more then you're own. Maybe there isn't an advantage to using protonmail in the US because you trust the government won't simply come and take your server away. But if you were in a place like Thailand you may not have that same trust.
sfifs 10y ago
> 1. Subpoenas/letters/writs go to you and you get to decide how to respond to them. You're the operator. You're assuming here that the executive will actually follow the full.due process of law vs. "we raided X address on suspicion and grabbed a few servers". Not true in many parts of the world and having email encrypted and stored in a different jurisdiction may be safer.