3 ms·

I wonder if their sysadmins will be able to read your mail or just promise not to. :/

by aorth 10y ago

satysin 10y ago
This is why you always encrypt on your machine not your email service. TBH I don't get why people get excited about things like Lavabit. You shouldn't be relying on one particular email service for security when email is not secure by design. Secure your content properly and then it shouldn't really matter what email service you use.
- mistaken 10y ago
  I agree with you, but sadly things like PGP are not universally adopted and can be a PITA to explain to someone not technically inclined. So it all boils down to the lack of standardized an universal encryption in e-mail.
  - nilved 10y ago
    There is a standard, and the fact that it's not universally adopted is more of a social problem than technical.
  - geocar 10y ago
    Then sadly you don't have security. Understanding the threat model is fundamental: If you don't know what this protects against, it might as well protect against nothing at all; My ISP received my emails in plaintext, so I have to assume that they've got a plaintext backup of those emails.
qwertyuiop924 10y ago
I believe the words Vincent Canfield, owner of cock.li (another secure email service) are relevant here: >How can I trust you? >You can't. Cock.li doesn't parse your E-mail to provide you with targeted ads, nor do I read E-mail contents unless it's for a legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). For privacy, I would recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail. This was originally followed by a quote from /g/, which has been redacted for obvious reasons (if you want it, you know where to find it), save this line: >Now that I think about it, administering a mail host is exactly like being a nurse, only people die slightly less often.

I wonder if their sysadmins will be able to read your mail or just promise not to. :/

by aorth 10y ago

I wonder if their sysadmins will be able to read your mail or just promise not to. :/

This is why you always encrypt on your machine not your email service. TBH I don't get why people get excited about things like Lavabit. You shouldn't be relying on one particular email service for security when email is not secure by design. Secure your content properly and then it shouldn't really matter what email service you use.

mistaken 10y ago
I agree with you, but sadly things like PGP are not universally adopted and can be a PITA to explain to someone not technically inclined. So it all boils down to the lack of standardized an universal encryption in e-mail.
- nilved 10y ago
  There is a standard, and the fact that it's not universally adopted is more of a social problem than technical.
- geocar 10y ago
  Then sadly you don't have security. Understanding the threat model is fundamental: If you don't know what this protects against, it might as well protect against nothing at all; My ISP received my emails in plaintext, so I have to assume that they've got a plaintext backup of those emails.

qwertyuiop924 10y ago

I believe the words Vincent Canfield, owner of cock.li (another secure email service) are relevant here: >How can I trust you? >You can't. Cock.li doesn't parse your E-mail to provide you with targeted ads, nor do I read E-mail contents unless it's for a legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). For privacy, I would recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail. This was originally followed by a quote from /g/, which has been redacted for obvious reasons (if you want it, you know where to find it), save this line: >Now that I think about it, administering a mail host is exactly like being a nurse, only people die slightly less often.