3 ms·

Not sure what FastMail has to do with anything, that wasn't the point, but ... I don't care if FastMail employees can read my email for support reasons. I actu

Not sure what FastMail has to do with anything, that wasn't the point, but ... I don't care if FastMail employees can read my email for support reasons. I actually expect FastMail employees to be able to read my email, since we aren't talking about end to end encryption. Unless end to end encryption is involved, then the stories of Google's encryption at rest are nothing more than bed time stories, since obviously their systems are not available to me for review. And that's not what my privacy concerns are about for Google. I don't care about random Google employees, because that's not the biggest threat. The biggest threat is me and my family being profiled and I've seen evidence of this time and time again. It's also a big and real threat due to Google's size and reach. FastMail is a better alternative first of all because FastMail is not Google, period. You may want security, but I want privacy and yes there's a difference. I don't need a better reason than that, but if I ever discover that FastMail is a problem (which I doubt, since they are awesome), I'll pick the next email provider in line that's not Google.

jkaplowitz 8y ago
At Google, the one time I'm aware of where a Gmail SRE read the mail of a woman he was interested in, he was detected, fired, and publicly called out officially by Google, which almost never happens in this industry and probably had permanent career consequences for him. They also locked things down further after this incident. I'd be surprised if FastMail has that level of ability and willingness to detect and react to a rogue employee. If the privacy threat you are concerned about is Google as a company allowing your data to be used in a way you're not happy with, such as profiling you can't sufficiently control, I can't argue with your logic beyond noting that they do offer lots of controls for most of the profiling they do. I similarly can't argue if you want to avoid providers within US jurisdiction. But if your privacy threat model includes things like "an intelligence agency wants to access your data without a legal right to demand it," "a rogue employee is hoping to access your data without an approved business need," or "foreign state-sponsored actors might want to target you," Google is one of the most private places to put your data to combat those threats. They have the resources to address those privacy attacks, and they do so. Of course your own operational security is also relevant for each of those privacy attack vectors, regardless of which third-party email provider you use. (Disclosure: I worked for Google 2011-2015. I never worked on Gmail, and neither work nor speak for them now.)

jkaplowitz 8y ago

At Google, the one time I'm aware of where a Gmail SRE read the mail of a woman he was interested in, he was detected, fired, and publicly called out officially by Google, which almost never happens in this industry and probably had permanent career consequences for him. They also locked things down further after this incident. I'd be surprised if FastMail has that level of ability and willingness to detect and react to a rogue employee. If the privacy threat you are concerned about is Google as a company allowing your data to be used in a way you're not happy with, such as profiling you can't sufficiently control, I can't argue with your logic beyond noting that they do offer lots of controls for most of the profiling they do. I similarly can't argue if you want to avoid providers within US jurisdiction. But if your privacy threat model includes things like "an intelligence agency wants to access your data without a legal right to demand it," "a rogue employee is hoping to access your data without an approved business need," or "foreign state-sponsored actors might want to target you," Google is one of the most private places to put your data to combat those threats. They have the resources to address those privacy attacks, and they do so. Of course your own operational security is also relevant for each of those privacy attack vectors, regardless of which third-party email provider you use. (Disclosure: I worked for Google 2011-2015. I never worked on Gmail, and neither work nor speak for them now.)