19 ms·

FastMail loses customers, faces calls to move over anti-encryption laws

378 points by qzervaas 8y ago

vikingcaffiene 8y ago
It's amazing to me that the people who write these laws are the least capable of understanding their impact. If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. Only a lawmaker who has the technical acumen of say, my grandmother, would decree something like that and think it was a good idea. Australia deserves better than these clowns. Then again, I live in the US so...
- CamperBob2 8y ago
  In any protracted discussion of US politics, it's pretty common for someone to raise the point that other countries have better voting systems than the one we use, where a winner-take-all paradigm inevitably devolves to a contest between only two dominant parties, and where there is little incentive for the victorious party to form a working coalition with the other. Australia's use of ranked-choice voting is frequently cited as one area where our first-past-the-post system is behind the curve, and in fact we're starting to consider adopting ranked choice voting in some limited areas [1]. We also hear frequent arguments in favor of Australia's compulsory voting law as a way to combat the sort of voter apathy that led to the... unexpected outcome in our last Presidential contest. Stories like this serve as good counterpoints for Americans to raise in those debates, I think. Yes, Australia has implemented a number of progressive electoral reforms... but those progressive electoral policies are obviously not getting them better leadership or better laws. So why should we, in the US, follow their example? [1]: https://bangordailynews.com/2018/08/28/opinion/contributors/a-century-of-ranked-choice-voting-in-australia-offers-lessons-for-maine/ https://bangordailynews.com/2018/08/28/opinion/contributors/...
  - rickycook 8y ago
    well, australian voting systems aren’t exactly progressive (it’s just a few steps above the worst case), and neither is the voting populace id say our government matches closer to our electorate than what the US government does, but we still have only 2 major parties which severely limits choice. there are ways to combat this (NZ, Germany for example) this example is also a fairly poor one, because it’s possible this law came as a “test the waters” as part of 5 eyes, so it could be followed in other counties. where spying and secrets are concerned, we shouldn’t draw too many conclusions because we don’t know all the facts
    - A2017U1 8y ago
      It doesn't necessarily have to be enacted in other 5 eyes countries. The specific wording of the law said they can enlist citizens to put in backdoors at the request of other Governments. Even more absurd is that it also mentions this regarding economic espionage purposes. They legally could ask a developer to commit large scale theft of industrial secrets from say Germany for the benefit of Canadian enterprises. Anyone refusing faces penalties in secret court rooms. The open ended nature of the wording is staggering.
  - Jaepa 8y ago
    That's an interesting notion. Not to follow this tangent to far, but I think that most likely it is a more representative democracy. If you were to ask the people in the US if they want a bill that would allow law enforcement to "read the private messages of terrorist", I'd guess that most people would say yes, not knowing or understanding the ramifications of what the law would mean, or what a clear definition of what terrorist are. But to the point, I do agree that mandatory voting may be actively harmful as it values all degree of civic engagement the same. That being said here in the states we have actively installed barriers to make voting more difficult. We aren't really getting better leadership or better laws from it.
  - getmoheb 8y ago
    Actually the political logic on national security legislation here is a little more complicated and not really related to the electoral system or compulsory voting. National security policy has been used as a wedge issue here in the last 20 years, like in lots of other places. So the raft of security legislation that's been passed since the conservatives took office in 2013 has actually been as a result of both major parties voting together. If the Labor Party (centre-left) opposes security legislation, they're painted as soft on terror, weak on border security, etc. Security agencies have given a shopping list to the Liberal (i.e. conservative) government - data retention, citizenship, and encryption amongst others. The Libs have put bill after bill forward in an attempt to generate opposition from Labor and thereby get an effective national-security wedge. Some of them have been 'genuine' reforms but some have been less so. Labor knows this of course. But it's ahead in the polls and wants to be a small target come the election, so it has refused to bite. The result has been a bunch of shitty new security laws. It can be wonderfully disheartening to watch, especially given that lots of people on both sides of politics know perfectly well that they're bad laws but can't say it out loud due to the the politics of it. They're not all idiots who don't understand tech. So while the electoral system here has delivered slim majorities for successive governments (or indeed minorities at times), it's not really relevant here. When the major parties vote together the laws are going to pass. Sorry if that's off topic but I find it very interesting, albeit depressing sometimes.
- CharlieSpeaks 8y ago
  > Australia deserves better than these clowns. Australia's abysmal record on climate change affords it no sympathy. Australia, do your part. (Australia resident and happy Fastmail customer.)
  - mking1024 8y ago
    I'm not sure what you are trying to say here. The party that pushed for these news laws is the same party that has been opposing real action on climate change for years. So yes, we do deserve better than these clowns.
    - CharlieSpeaks 8y ago
      Over the past 20 years, most developed nations have been working to reduce GHG emissions, through multiple governments and across multiple industries. Australia shirked responsibility during the Kyoto protocol, letting the rest of the world tackle this problem. Australia's current government cannot be solely blamed for this.
      - mking1024 8y ago
        Of those 20 years you mentioned, the party we're discussing has been in power for around 14 of them - and the 6 years preceding that. I'd say the party that has been in power for over 75% of the last 25 years - and has actively campaigned against acting to reduce emissions - is somewhat responsible. But what I don't understand is the relevance of climate change to the topic at hand: the assistance and access legislation harming Australian tech companies. And I'm still not sure what your original point was ("Australia's abysmal record on climate change affords it no sympathy"). Were you saying saying that Australia's tech industry deserves to be destroyed because a slim majority of the country keeps voting for a party that is, among other things, hesitant to act to reduce emissions?
- cbsks 8y ago
  > If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it I interpreted it as they could be forced to secretly add a backdoor, but I guess if they are sworn to secrecy on it, who knows. Maybe it’s time for me to switch from FastMail...
  - deleted 8y ago
    [deleted]
- Jedi72 8y ago
  If I remember correctly from their statement on this issue before they were baaically unaffected by the new laws as they do not off end-to-end encryption, so they were already open to lawful intercept requests.
  - bad_user 8y ago
    Email services claiming e2e encryption are snake oil. It’s interesting to me how a demographics like that of HN can fall for it.
    - isostatic 8y ago
      So when I send my gpg mail, it’s not encrypted?
      - ownagefool 8y ago
        Yes, it is. But if this is a feature of a mail service rather than a mail client, then the service has the keys and, given GPG has no perfect forward secrecy, they have the ability to decrypt all emails you send and recieve. If you go down the road of the mail service owning a mail client that promises e2e, then the issue moves to worrying about the code that runs on your device. If it's webmail, the JavaScript can easily be changed, so you really want a thick client. Then you need to worry about the thick client sending data that it's really not supposed to i.e. can it read your key and send it to $vendor? Even then, GPG without Perfect Forward Secrecy means that when your key is brute forced or side channel attacked, which we assume will happen, you lose all your secrecy, so you need to think about this as a temporary state.
        bad_user 8y ago
        Note that the key could be client side and the email service could encrypt the email in a way as to not find out your private key. However, and this is key, a majority of email is sent and received unencrypted via their servers, because that's just how email works. In other words, email at rest might be encrypted, but most of the email in transit is not. This means that a man in the middle (e.g. the NSA) can still intercept all your communications. And even with PGP encryption, which is e2e, the meta data is still unencrypted because that's what the email protocol demands. Having the ability to see whom you're communicating with, that's enough in many cases. Email is simply not a good solution for e2e encryption. If you have secrets to protect, there are now other solutions available, like Signal and even Signal has some issues (like its reliance on phone numbers for identification).
- Gaelan 8y ago
  "Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." I'm reading that as "we don't encrypt customer emails, so we already had to share them." That's consistent with what they've said in the past.
  - brongondwana 8y ago
    Exactly correct. We already share customer emails under limited circumstances and for explicitly requested accounts only (we've never participated in dragnets and we don't believe this legislation will require us to either). We have a standard process for verifying each request with the AFP and ensuring that they have followed due process to get a warrant for the data. We strongly support (also spelled out in that submission) keeping judicial oversight of requests - which this legislation does still require for the access requests themselves - hence saying that nothing has changed for us, since we have existing capabilities and we already respond to legal requests.
    - fauigerzigerk 8y ago
      Due process is not the only question though. FastMail users will also be wondering whether the content of their email has to comply with other laws made by the very same lawmakers that have just shown their complete disregard for privacy and a shocking level of technical incompetence.
  - dbrgn 8y ago
    To be fair, they also explicitly point out in their docs that encryption on their end is pointless (since they have the keys) and that you should encrypt your e-mails on the client side with something like PGP (where you control the keys). E-Mail sucks, that's all. Fastmail is transparent about it and does a good job. (PS: I still think that they encrypt their storage servers, but again, this will only protect against someone physically taking away their servers, not against a warrant or an intruder.)
- dbg31415 8y ago
  Australia is significantly behind the US in terms of tech, and Australian lawmakers are also significantly behind. Ignorant, and draconian. Not a good mix. With no Bill of Rights to protect people. It's borderline funny how inept the Australian government is with tech. NBN cost a fortune, and still sucks. My Health Record debacle. New anti-encryption laws, and leaders who think they can change the laws of math. ScoMo forgetting to set his domain on auto-renew... It's been a mess. * Victorian couple quoted up to $1.2m to connect to NBN Co's fibre service - ABC News (Australian Broadcasting Corporation) || https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-up-to-1.2million-for-fibre-connection/9842444 https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-... * My Health Record: privacy, cybersecurity and the hacking risk | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/jul/16/my-health-record-privacy-cybersecurity-and-the-hacking-risk https://www.theguardian.com/australia-news/2018/jul/16/my-he... * Scotty Doesn't Know: prankster takes over Scott Morrison's website | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/oct/19/scotty-doesnt-know-prankster-takes-over-scott-morrisons-website https://www.theguardian.com/australia-news/2018/oct/19/scott... * Prime Minister Says The Laws Of Mathematics Are Trumped By Australian Law || https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths Add to this how messed up the visa situation is in Australia, and the crazy high taxes they put on immigrants, and they wonder why their economy can't keep up and homes have dropped 20% in the last 2 years... They coasted on energy / natural resources for so long, but didn't invest any of the money correctly into tech training / startup scenes. Now that China took their foot off the gas, Australia will be in for a world of hurt.
  - anotherevan 8y ago
    You forgot the last national census, where they decided our privacy was not that important[1], and they were liberally threatening everyone with severe fines if they didn't fill it out anyway. So when the most predicable result on the planet happened and twenty million people all tried to fill out the online form on the "census" evening they claimed it was a denial of service attack. The shame of it was, the ABS had a pretty good reputation up until that point (I believe). Now they're just another joke and have no good will left. [1] And which today we discover they've cocked it up even more so. https://www.itnews.com.au/news/algorithm-flaw-meant-census-responses-could-be-identified-519775 https://www.itnews.com.au/news/algorithm-flaw-meant-census-r...
- stone-monkey 8y ago
  To be fair, this is basically the software developer's dilemma in reverse. You're building out systems for areas of business with no domain expertise. End users constantly wonder why the developers built the software in such profoundly stupid ways. Lawmakers face the same problem in that they're barraged with constant problems from completely different fields that they're unlikely to be subject matter experts in. How do they learn about it? By consulting subject matter experts. Who are these subject matter experts? Well established businesses in their field. This can lead to laws that are incentivized towards large businesses. That's just considering a situation where everyone is working in good faith. Now consider lawmakers having to cater towards what is currently trending with the populace, kickbacks from companies, pull from different governments/organizations/political parties etc. And it's easy to see why politics is the way it is.
  - giancarlostoro 8y ago
    I would expect anybody worth their salt to consult experts from said field they with to bridge into. Otherwise, why the hell are you blindly passing out laws? Sheer incompetence.
  - shakna 8y ago
    > By consulting subject matter experts. Experts were consulted, and ignored. A lot of experts came right out and said these laws were insane. The Australian tech industry were not in favour, and the consulted experts were not favourable. However, the experts that were listened to were the ones who worked for ASIO, who said that these laws were absolutely necessary just for the agency to continue operating, and it was urgent that they were deployed in the last few days of Parliament. So the laws got rushed.
    - stone-monkey 8y ago
      > Experts were consulted, and ignored. This led to my point, though I made it in a roundabout way. None of these laws are made in a vacuum. When you get a law that seems to cause undue harm to industries or to general consumers, it's unlikely the case that lawmakers wrote up something due to negligence of the issues, but because another entity specifically pushed to have these laws written in this way.
- femto 8y ago
  They understood the impact. https://www.smh.com.au/politics/federal/bill-shorten-says-labor-achieved-half-a-win-on-encryption-legislation-20181207-p50ksx.html https://www.smh.com.au/politics/federal/bill-shorten-says-la... They just put their own political skins ahead of good government and passed a law that they knew was flawed. There's been no mention of the touted amendments to fix it, as there is a federal election looming and if either side of politics proposes an amendment, the other will take the opportunity to manufacture a scare campaign and score political points.
- deleted 8y ago
  [deleted]
- bad_user 8y ago
  > If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. No, that’s not what they said. Such statements can hurt a business and in this case it would be a pity since the business in question is doing everything they can to serve their customers.
  - brongondwana 8y ago
    Thank you :) That is indeed not what we said - though we were pretty sure we would be taken out of context and the "there's a risk of somebody being asked to do this and that creates staff uncertainty" would be seen as "we've definitely already done this" :( Unsurprisingly, that's happened.
- brongondwana 8y ago
  We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors. Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of. Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability. We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.
  - larkeith 8y ago
    Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard
    - cyphar 8y ago
      Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.
- craftyguy 8y ago
  > It's amazing to me that the people who write these laws are the least capable of understanding their impact. Kind of makes you wonder about the other laws they write that touch things you aren't as familiar with...
mrmondo 8y ago
I’m sure Bron, Rob or Nigel will weigh in shortly. Fastmail is a damn fine service, I now trust Australian internet privacy even less due to recent law changes and this does concern me not just with Fastmail but as someone that designs and hosts platforms for software the organisation I work with writes - which is also in Australia.
- a012 8y ago
  They can ensure something, but law is law. If Fastmail employees pressed by Australia authority, they must obey, doesn't it?
- goatsi 8y ago
  This is covered in the article. >“Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." The new laws would apply to something like Whatsapp or Signal, which do not have the ability to access the communications of users (thanks to end to end encryption). Fastmail already has enough access that if a legal demand is issued they can hand it over.
  - yarosv 8y ago
    I think point is, that with backdoor you don't need the warrant. Which opens the possibility of the abuse.
    - caf 8y ago
      FWIW, as currently legislated, the "backdoor" scheme still requires warrants to be issued for data captured under it.
      - brongondwana 8y ago
        Yes, that. The law allows for requiring new backdoors to be requested up-front, but still requires warrants to activate those backdoors for specific requests, and it still doesn't give firehose access. It's not as awful as it's made out to be by some, but it's still pretty ham-handed in some of its implementation, and that's what we're proposing they look at changing.
koenigdavidmj 8y ago
The way you get this to end is by annoying the common people of Australia. The Internet death penalty would be one way—have FAANG completely stop doing business in Australia until this is repealed, and block Australians from their services. No Facebook, no new copies of Windows, no new Macs, nothing that runs on AWS. It’s a small enough country that it wouldn’t really be a dent in their bottom lines. Congratulations, you just got most of a country to angrily write their parliament-critters.
- jaytaylor 8y ago
  You may not realize: AWS has a data center region in Sydney, AUS
  - mirimir 8y ago
    You'd think that they'd want to close that sucker.
  - sargun 8y ago
    Does amazon own and operate it?
    - lewisinc 8y ago
      Yes? Of course they do.
      - yjftsjthsd-h 8y ago
        Not completely a given; their China footprint isn't directly them.
      - latch 8y ago
        Why "of course"? At one point in time (and this is probably still true), AWS was a client of various wholesale (and even wholesale/direct to consumer) in some regions. Equinix, Tata, Digital Realty Trust, ... AWS is is big, but there are a number of much bigger players.
just_one_time_ 8y ago
I just read that they are no longer accepting Bitcoin payments as well. Is this part of Adam Backs big push to make Bitcoin a settlement only layer?
pmoriarty 8y ago
So what's a good alternative to FastMail?
- rishav_sharan 8y ago
  Protonmail is great in terms of feature/security balance. Personally, I like using mail.disroot.org
  - fvargas 8y ago
    Protonmail has also given in and paid out thousands* to criminals who DDoS their systems, no? *In my original post I mistakenly wrote "millions"
    - xref 8y ago
      All I’ve heard is they once paid $6000 to stop a ddos in 2015 at the demand of their hosting isp.
    - tonyztan 8y ago
      (Note: The parent comment claimed that ProtonMail paid "millions" in ransom. It appears to have been edited to say "thousands" now.) I am not affiliated with ProtonMail, but the answer is no. ProtonMail has paid a ransom exactly once, back in 2015 when it was just launched and suffered a DDOS attack that caused a lot of collateral damage to third parties, who pressured ProtonMail to pay the ransom. ProtonMail has since committed to "never pay another ransom" and invested in advanced DDOS mitigation capabilities, including by becoming its own ISP. Sources: https://protonmail.com/blog/protonmail-ddos-attacks/ https://protonmail.com/blog/protonmail-ddos-attacks/ https://protonmail.com/support/knowledge-base/email-ddos-protection/ https://protonmail.com/support/knowledge-base/email-ddos-pro...
  - playpause 8y ago
    I switched from ProtonMail after a few months (despite having paid up front for a year) because the UX is so bad. You are forced to use their client apps, which are full of annoying bugs and design flaws. They ignored my support requests. Eventually I switched to MailFence, which has even worse UIs, straight out of the 90s, but you can use any IMAP client so it doesn’t really matter. (ProtonMail does have a bridge tool so you can use IMAP, but only on a desktop OS.) Still on the lookout for something better.
fvargas 8y ago
> Your 1-year Standard subscription expires on Sunday, February 24, 2019. Good timing?
linux2647 8y ago
Anyone know of a FastMail alternative? I was considering opening an account with them, but after reading this, I am concerned with the privacy implications, especially as I am trying to get off of Gmail.
- austhrow743 8y ago
  What privacy implications?
- PopeDotNinja 8y ago
  ProtonMail? It supposedly has encryption that prevents ProtonMail from reading your email.
  - mirimir 8y ago
    If you believe that, yes. But that's not really novel. CounterMail had that a decade ago. Tutanota does too. Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff.
    - askmike 8y ago
      > Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff. Yes but no one can either :( In the last 5 years I received 2 encrypted emails, and thousands of non encrypted emails. The problem with PGP is that almost no one is using it. Maybe the people you email with do use it though.
      - mirimir 8y ago
        As I understand it, ProtonMail basically uses PGP. It just does it in Javascript or whatever. But whatever. The ability to use GnuPG serves as a filter ;)
        askmike 8y ago
fvgs 8y ago
"We won't release any data without the required legal authorisation from an Australian court. As an Australian company, we do not respond to US court orders." [1] [1] https://www.fastmail.com/help/ourservice/security.html https://www.fastmail.com/help/ourservice/security.html
- qbaqbaqba 8y ago
  But legal systems cooperate. Ask Kim dot Com.
Felz 8y ago
If anyone's considering moving their email addresses over this, please take the time to get your own custom domain to host email on. That way you can switch providers more easily and actually own your email address. As a shameless plug: Purelymail, the mail service I'm working on, could use some more beta testers. It's (to my knowledge) the cheapest way to get email on a custom domain right now. https://purelymail.com/ https://purelymail.com/
- jchw 8y ago
  Yandex offers custom domains similar to G Suite, for free. So if people want a free option, even just to try this concept out, I can say that is a formidable option.
  - rgbrenner 8y ago
    If you have a problem with AU's law, I don't see how moving it to Russia is an improvement.
    - x0x0 8y ago
      Russia is unlikely to cooperate with the US government for the foreseeable future.
    - jchw 8y ago
      Valid concern, but I'm mostly pointing this out in the context of the parent comment. Emphasis on the fact that it's free, and may be a decent stepping stone for those interested in custom domain email.
    - webmobdev 8y ago
      Well, you can be sure that Russia won't share your data with the US or UK unlike the Aussies! ;)
- fvargas 8y ago
  I only took a brief look, but I like the premise. The service seems far from something I would trust with handling my email. I still trust Fastmail (for reference). But I strongly welcome more alternatives to Gmail and services which prioritize user privacy. The attempt at monetization strikes me as extremely premature, given the competition. But I hope to see more.
anotherevan 8y ago
Related: Mozilla may treat Aussie staff as 'insider threats' to code base https://www.itnews.com.au/news/mozilla-may-treat-aussie-staff-as-insider-threats-to-code-base-519793 https://www.itnews.com.au/news/mozilla-may-treat-aussie-staf... https://news.ycombinator.com/item?id=19243630 https://news.ycombinator.com/item?id=19243630
- rovyko 8y ago
  Contents of the TOLA act in question: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
- kkarakk 8y ago
  shouldn't all staff be treated as threats really? esp on projects with global impact(and hence global interest in compromising)
  - pjc50 8y ago
    Don't know why this got downvoted; it's difficult and expensive to build systems that require multiple coordinated actors for critical changes, so few companies do, but that doesn't mean it's not a risk. https://www.pcmag.com/news/366493/email-providers-servers-wiped-in-catastrophic-hack https://www.pcmag.com/news/366493/email-providers-servers-wi...
  - Bartweiss 8y ago
    Given Yahoo's experience, yes. The guy in charge of security and data access had a backbone and a reputation, so when somebody wanted a backdoor they simply went around him and got other people to hide it. (Which, of course, meant that the experts didn't review it and the thing was insecure.) I don't think Mozilla is wrong to treat Aus staff as a possible source for government privacy intrusion, but by that standard they really ought to view US (et al) employees as risks too. Of course, the Yahoo compromise was allegedly approved by Marissa Meyer and corporate counsel. (Which suggests some ugly things about trusting behavior up the corporate ladder.) I guess that could mean Mozilla expects a US intrusion to show up at the executive level, while an Australian intrusion would be more likely to threaten random employees with legal consequences.
BFLpL0QNek 8y ago
It saddens me when I’ve been a Fastmail customer for 4 years, happy with the pricing, happy with the service as a temporary resident my only way to make a stand about the laws is to move away from Australian service providers. I’ll likely start migrating mail shortly after purchasing a .dev domain. If it wasn’t for my Australian partner I’d likely of left by now as tech work is limited here, severely behind places like London, currently feeling like it’ll be difficult to progress beyond where I am now within the AU. A lot of it is also now dubious big data, I.e what can we snoop on to sell you more or sell the data collected for dubious purposes.
rawmodz 8y ago
Gee, is almost like the political grubs had absolutely no idea about encryption and how it works and how it will be virtually impossible to implement these stupid laws. Who would have thought that's the case? So very disappointed in all politicians at the moment, in my opinion, they're all scum bags
password4321 8y ago
I was surprised to learn last month that "you can impersonate other Fastmail customers by just spoofing the email address". https://news.ycombinator.com/item?id=18996200#18997054 https://news.ycombinator.com/item?id=18996200#18997054
webmobdev 8y ago
Not surprised - I dumped Fastmail when Australi passed a lot of intrusive and anti-privacy laws. And as it is a part of the 5 eyes program.
markstos 8y ago
I'm a long time Fastmail customer and will consider moving over this. I would prefer Fastmail moved their servers and place of business incorporation to an encryption and privacy-friendly country.
- deleted 8y ago
  [deleted]
- accatyyc 8y ago
  Why? Fastmail always complied with warrants to get your data, so nothing changes because if this law. If you want to hide something, encrypt your e-mails before they reach Fastmail (and do the same regardless of provider you use, why trust anyone?)
  - markstos 8y ago
    It's a signal to Australia as well as to Fastmail. I like Fastmail. American companies invert their corporate structure to avoid taxes. They become Irish companies with an American subsidiary. Fastmail can become a Dutch company with remote employees in Australia. If the law is seen has having negative economic impact on the tax base, perhaps it will change. Undermining encryption for some weakens security for all.
  - markstos 8y ago
    If I leave Fastmail, I think I'll most likely switch to self-hosting email with Helm instead: https://thehelm.com/ https://thehelm.com/ For a family of four, the annual cost would be about half of Fastmail's standard plan.
  - jolmg 8y ago
    There is the change that warrants are apparently not needed anymore. The PDF linked in the article says that there's now no judicial oversight over these requests. I haven't decided myself if I'll switch, but if I do, it's more of a matter of principle. I just don't like how the world is becoming more authoritarian-like, and I feel it will continue to move this way unless people demonstrate their unwillingness to put up with such policies.
mescalito 8y ago
If I may, I want to share my recently pleasant experience with MailU[1]. I am in no way related to them, but it worked very nicely, it wasn't difficult to setup, and it sorts a lot of things out that have always been a pain for me when setting up my own mail server. [1]: https://mailu.io/ https://mailu.io/
aboutruby 8y ago
Also I learned recently that Australia's internet is getting more censored every year: https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...
lettergram 8y ago
When I saw the most recent provacy stripping law pass (maybe 3 months ago?), it pushed me to move everything to my own custom domain. I also signed up with ProtonMail and have started the migration. I’m not the only one, people I know who have used FastMail for years have decided to jump ship.
rbritton 8y ago
I understand the concern over the law in general, but I don't agree with the sentiments about email in particular. Email is not and should not be considered completely secure, so if that is a need, something else should be used. In my opinion, the Australian law does not make it any more insecure or less private -- everything that could have been obtained via warrant prior to the law's passage is the same data that is accessible with it. If that's a concern, set up your email in a different jurisdiction. I am currently a FastMail customer because I like the product, and this does not make me think I need to move. Unless something else changes, I'll keep it where it is.
- hedora 8y ago
  No technology is completely secure. Email is particularly bad, but there’s a huge gap between what a secured system would allow, and what one without encryption at rest allows. Without encryption at rest, you can grab all non-deleted emails for the entire population in one go. With due process and encryption at rest, the most authorities can do is get a warrant to sniff smtp relays to selectively catch emails involving a single user while they are in transit. In practice, unless the target is an ongoing criminal operation, the latter option is more difficult and less likely to succeed than other investigative options, so the fact that it’s possible is nearly a moot point for law abiding citizens.
LinuxBender 8y ago
I put a few domains on FastMail for family members to avoid using Google and also avoid using my fascist BOFH mail servers. They know that if anything is sensitive, they and their friends will need to pgp or 7-zip encrypt the payload. I will gladly continue to use Fastmail if that is the only way to keep people I care about from staying logged into Google.
oriettaxx 8y ago
Yes, I just moved from free gmail to fastmail maily for privacy: hope they can solve it, 'cause I like fastmail, a lot!
dade_ 8y ago
Yes they are. I decided to leave O365 business and was ready to switch to FastMail when this law was passed. I decided to keep looking and found German mailbox.org and chose them instead. So far so good.
Ixiaus 8y ago
I am a happy FastMail customer. The service is great, it is indeed fast and they're a small company devoted to doing email and serving their customers. I don't plan on leaving FastMail.
lysp 8y ago
Here is FastMail's response to the Government inquiry. https://www.aph.gov.au/DocumentStore.ashx?id=ec39b475-9559-4fa4-94ca-d45294534200&subId=666615 https://www.aph.gov.au/DocumentStore.ashx?id=ec39b475-9559-4... [pdf]
turok 8y ago
I'm currently in Western Europe waiting for the delivery of forms to cancel my Australian business number, this law has destroyed industry confidence in the Australian government for customers and service providers. Even if rolled back, the political and social environment that spawned it remains, and committing to development resources in Australia now is a fool's errand if you have any alternative.

378 points by qzervaas 8y ago

It's amazing to me that the people who write these laws are the least capable of understanding their impact. If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. Only a lawmaker who has the technical acumen of say, my grandmother, would decree something like that and think it was a good idea. Australia deserves better than these clowns. Then again, I live in the US so...

CamperBob2 8y ago
In any protracted discussion of US politics, it's pretty common for someone to raise the point that other countries have better voting systems than the one we use, where a winner-take-all paradigm inevitably devolves to a contest between only two dominant parties, and where there is little incentive for the victorious party to form a working coalition with the other. Australia's use of ranked-choice voting is frequently cited as one area where our first-past-the-post system is behind the curve, and in fact we're starting to consider adopting ranked choice voting in some limited areas [1]. We also hear frequent arguments in favor of Australia's compulsory voting law as a way to combat the sort of voter apathy that led to the... unexpected outcome in our last Presidential contest. Stories like this serve as good counterpoints for Americans to raise in those debates, I think. Yes, Australia has implemented a number of progressive electoral reforms... but those progressive electoral policies are obviously not getting them better leadership or better laws. So why should we, in the US, follow their example? [1]: https://bangordailynews.com/2018/08/28/opinion/contributors/a-century-of-ranked-choice-voting-in-australia-offers-lessons-for-maine/ https://bangordailynews.com/2018/08/28/opinion/contributors/...
- rickycook 8y ago
  well, australian voting systems aren’t exactly progressive (it’s just a few steps above the worst case), and neither is the voting populace id say our government matches closer to our electorate than what the US government does, but we still have only 2 major parties which severely limits choice. there are ways to combat this (NZ, Germany for example) this example is also a fairly poor one, because it’s possible this law came as a “test the waters” as part of 5 eyes, so it could be followed in other counties. where spying and secrets are concerned, we shouldn’t draw too many conclusions because we don’t know all the facts
  - A2017U1 8y ago
    It doesn't necessarily have to be enacted in other 5 eyes countries. The specific wording of the law said they can enlist citizens to put in backdoors at the request of other Governments. Even more absurd is that it also mentions this regarding economic espionage purposes. They legally could ask a developer to commit large scale theft of industrial secrets from say Germany for the benefit of Canadian enterprises. Anyone refusing faces penalties in secret court rooms. The open ended nature of the wording is staggering.
- Jaepa 8y ago
  That's an interesting notion. Not to follow this tangent to far, but I think that most likely it is a more representative democracy. If you were to ask the people in the US if they want a bill that would allow law enforcement to "read the private messages of terrorist", I'd guess that most people would say yes, not knowing or understanding the ramifications of what the law would mean, or what a clear definition of what terrorist are. But to the point, I do agree that mandatory voting may be actively harmful as it values all degree of civic engagement the same. That being said here in the states we have actively installed barriers to make voting more difficult. We aren't really getting better leadership or better laws from it.
- getmoheb 8y ago
  Actually the political logic on national security legislation here is a little more complicated and not really related to the electoral system or compulsory voting. National security policy has been used as a wedge issue here in the last 20 years, like in lots of other places. So the raft of security legislation that's been passed since the conservatives took office in 2013 has actually been as a result of both major parties voting together. If the Labor Party (centre-left) opposes security legislation, they're painted as soft on terror, weak on border security, etc. Security agencies have given a shopping list to the Liberal (i.e. conservative) government - data retention, citizenship, and encryption amongst others. The Libs have put bill after bill forward in an attempt to generate opposition from Labor and thereby get an effective national-security wedge. Some of them have been 'genuine' reforms but some have been less so. Labor knows this of course. But it's ahead in the polls and wants to be a small target come the election, so it has refused to bite. The result has been a bunch of shitty new security laws. It can be wonderfully disheartening to watch, especially given that lots of people on both sides of politics know perfectly well that they're bad laws but can't say it out loud due to the the politics of it. They're not all idiots who don't understand tech. So while the electoral system here has delivered slim majorities for successive governments (or indeed minorities at times), it's not really relevant here. When the major parties vote together the laws are going to pass. Sorry if that's off topic but I find it very interesting, albeit depressing sometimes.
CharlieSpeaks 8y ago
> Australia deserves better than these clowns. Australia's abysmal record on climate change affords it no sympathy. Australia, do your part. (Australia resident and happy Fastmail customer.)
- mking1024 8y ago
  I'm not sure what you are trying to say here. The party that pushed for these news laws is the same party that has been opposing real action on climate change for years. So yes, we do deserve better than these clowns.
  - CharlieSpeaks 8y ago
    Over the past 20 years, most developed nations have been working to reduce GHG emissions, through multiple governments and across multiple industries. Australia shirked responsibility during the Kyoto protocol, letting the rest of the world tackle this problem. Australia's current government cannot be solely blamed for this.
    - mking1024 8y ago
      Of those 20 years you mentioned, the party we're discussing has been in power for around 14 of them - and the 6 years preceding that. I'd say the party that has been in power for over 75% of the last 25 years - and has actively campaigned against acting to reduce emissions - is somewhat responsible. But what I don't understand is the relevance of climate change to the topic at hand: the assistance and access legislation harming Australian tech companies. And I'm still not sure what your original point was ("Australia's abysmal record on climate change affords it no sympathy"). Were you saying saying that Australia's tech industry deserves to be destroyed because a slim majority of the country keeps voting for a party that is, among other things, hesitant to act to reduce emissions?
cbsks 8y ago
> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it I interpreted it as they could be forced to secretly add a backdoor, but I guess if they are sworn to secrecy on it, who knows. Maybe it’s time for me to switch from FastMail...
- deleted 8y ago
  [deleted]
Jedi72 8y ago
If I remember correctly from their statement on this issue before they were baaically unaffected by the new laws as they do not off end-to-end encryption, so they were already open to lawful intercept requests.
- bad_user 8y ago
  Email services claiming e2e encryption are snake oil. It’s interesting to me how a demographics like that of HN can fall for it.
  - isostatic 8y ago
    So when I send my gpg mail, it’s not encrypted?
    - ownagefool 8y ago
      Yes, it is. But if this is a feature of a mail service rather than a mail client, then the service has the keys and, given GPG has no perfect forward secrecy, they have the ability to decrypt all emails you send and recieve. If you go down the road of the mail service owning a mail client that promises e2e, then the issue moves to worrying about the code that runs on your device. If it's webmail, the JavaScript can easily be changed, so you really want a thick client. Then you need to worry about the thick client sending data that it's really not supposed to i.e. can it read your key and send it to $vendor? Even then, GPG without Perfect Forward Secrecy means that when your key is brute forced or side channel attacked, which we assume will happen, you lose all your secrecy, so you need to think about this as a temporary state.
      - bad_user 8y ago
        Note that the key could be client side and the email service could encrypt the email in a way as to not find out your private key. However, and this is key, a majority of email is sent and received unencrypted via their servers, because that's just how email works. In other words, email at rest might be encrypted, but most of the email in transit is not. This means that a man in the middle (e.g. the NSA) can still intercept all your communications. And even with PGP encryption, which is e2e, the meta data is still unencrypted because that's what the email protocol demands. Having the ability to see whom you're communicating with, that's enough in many cases. Email is simply not a good solution for e2e encryption. If you have secrets to protect, there are now other solutions available, like Signal and even Signal has some issues (like its reliance on phone numbers for identification).
Gaelan 8y ago
"Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." I'm reading that as "we don't encrypt customer emails, so we already had to share them." That's consistent with what they've said in the past.
- brongondwana 8y ago
  Exactly correct. We already share customer emails under limited circumstances and for explicitly requested accounts only (we've never participated in dragnets and we don't believe this legislation will require us to either). We have a standard process for verifying each request with the AFP and ensuring that they have followed due process to get a warrant for the data. We strongly support (also spelled out in that submission) keeping judicial oversight of requests - which this legislation does still require for the access requests themselves - hence saying that nothing has changed for us, since we have existing capabilities and we already respond to legal requests.
  - fauigerzigerk 8y ago
    Due process is not the only question though. FastMail users will also be wondering whether the content of their email has to comply with other laws made by the very same lawmakers that have just shown their complete disregard for privacy and a shocking level of technical incompetence.
- dbrgn 8y ago
  To be fair, they also explicitly point out in their docs that encryption on their end is pointless (since they have the keys) and that you should encrypt your e-mails on the client side with something like PGP (where you control the keys). E-Mail sucks, that's all. Fastmail is transparent about it and does a good job. (PS: I still think that they encrypt their storage servers, but again, this will only protect against someone physically taking away their servers, not against a warrant or an intruder.)
dbg31415 8y ago
Australia is significantly behind the US in terms of tech, and Australian lawmakers are also significantly behind. Ignorant, and draconian. Not a good mix. With no Bill of Rights to protect people. It's borderline funny how inept the Australian government is with tech. NBN cost a fortune, and still sucks. My Health Record debacle. New anti-encryption laws, and leaders who think they can change the laws of math. ScoMo forgetting to set his domain on auto-renew... It's been a mess. * Victorian couple quoted up to $1.2m to connect to NBN Co's fibre service - ABC News (Australian Broadcasting Corporation) || https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-up-to-1.2million-for-fibre-connection/9842444 https://www.abc.net.au/news/2018-06-07/nbn-co-quotes-couple-... * My Health Record: privacy, cybersecurity and the hacking risk | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/jul/16/my-health-record-privacy-cybersecurity-and-the-hacking-risk https://www.theguardian.com/australia-news/2018/jul/16/my-he... * Scotty Doesn't Know: prankster takes over Scott Morrison's website | Australia news | The Guardian || https://www.theguardian.com/australia-news/2018/oct/19/scotty-doesnt-know-prankster-takes-over-scott-morrisons-website https://www.theguardian.com/australia-news/2018/oct/19/scott... * Prime Minister Says The Laws Of Mathematics Are Trumped By Australian Law || https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths https://www.buzzfeed.com/markdistefano/turnbull-war-on-maths Add to this how messed up the visa situation is in Australia, and the crazy high taxes they put on immigrants, and they wonder why their economy can't keep up and homes have dropped 20% in the last 2 years... They coasted on energy / natural resources for so long, but didn't invest any of the money correctly into tech training / startup scenes. Now that China took their foot off the gas, Australia will be in for a world of hurt.
- anotherevan 8y ago
  You forgot the last national census, where they decided our privacy was not that important[1], and they were liberally threatening everyone with severe fines if they didn't fill it out anyway. So when the most predicable result on the planet happened and twenty million people all tried to fill out the online form on the "census" evening they claimed it was a denial of service attack. The shame of it was, the ABS had a pretty good reputation up until that point (I believe). Now they're just another joke and have no good will left. [1] And which today we discover they've cocked it up even more so. https://www.itnews.com.au/news/algorithm-flaw-meant-census-responses-could-be-identified-519775 https://www.itnews.com.au/news/algorithm-flaw-meant-census-r...
stone-monkey 8y ago
To be fair, this is basically the software developer's dilemma in reverse. You're building out systems for areas of business with no domain expertise. End users constantly wonder why the developers built the software in such profoundly stupid ways. Lawmakers face the same problem in that they're barraged with constant problems from completely different fields that they're unlikely to be subject matter experts in. How do they learn about it? By consulting subject matter experts. Who are these subject matter experts? Well established businesses in their field. This can lead to laws that are incentivized towards large businesses. That's just considering a situation where everyone is working in good faith. Now consider lawmakers having to cater towards what is currently trending with the populace, kickbacks from companies, pull from different governments/organizations/political parties etc. And it's easy to see why politics is the way it is.
- giancarlostoro 8y ago
  I would expect anybody worth their salt to consult experts from said field they with to bridge into. Otherwise, why the hell are you blindly passing out laws? Sheer incompetence.
- shakna 8y ago
  > By consulting subject matter experts. Experts were consulted, and ignored. A lot of experts came right out and said these laws were insane. The Australian tech industry were not in favour, and the consulted experts were not favourable. However, the experts that were listened to were the ones who worked for ASIO, who said that these laws were absolutely necessary just for the agency to continue operating, and it was urgent that they were deployed in the last few days of Parliament. So the laws got rushed.
  - stone-monkey 8y ago
    > Experts were consulted, and ignored. This led to my point, though I made it in a roundabout way. None of these laws are made in a vacuum. When you get a law that seems to cause undue harm to industries or to general consumers, it's unlikely the case that lawmakers wrote up something due to negligence of the issues, but because another entity specifically pushed to have these laws written in this way.
femto 8y ago
They understood the impact. https://www.smh.com.au/politics/federal/bill-shorten-says-labor-achieved-half-a-win-on-encryption-legislation-20181207-p50ksx.html https://www.smh.com.au/politics/federal/bill-shorten-says-la... They just put their own political skins ahead of good government and passed a law that they knew was flawed. There's been no mention of the touted amendments to fix it, as there is a federal election looming and if either side of politics proposes an amendment, the other will take the opportunity to manufacture a scare campaign and score political points.
deleted 8y ago
[deleted]
bad_user 8y ago
> If I am reading FastMails statement right, they have been forced to add backdoors to their codebase and not been allowed to tell their team about it. No, that’s not what they said. Such statements can hurt a business and in this case it would be a pity since the business in question is doing everything they can to serve their customers.
- brongondwana 8y ago
  Thank you :) That is indeed not what we said - though we were pretty sure we would be taken out of context and the "there's a risk of somebody being asked to do this and that creates staff uncertainty" would be seen as "we've definitely already done this" :( Unsurprisingly, that's happened.
brongondwana 8y ago
We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors. Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of. Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability. We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.
- larkeith 8y ago
  Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard
  - cyphar 8y ago
    Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.
craftyguy 8y ago
> It's amazing to me that the people who write these laws are the least capable of understanding their impact. Kind of makes you wonder about the other laws they write that touch things you aren't as familiar with...

mrmondo 8y ago

I’m sure Bron, Rob or Nigel will weigh in shortly. Fastmail is a damn fine service, I now trust Australian internet privacy even less due to recent law changes and this does concern me not just with Fastmail but as someone that designs and hosts platforms for software the organisation I work with writes - which is also in Australia.

a012 8y ago
They can ensure something, but law is law. If Fastmail employees pressed by Australia authority, they must obey, doesn't it?
goatsi 8y ago
This is covered in the article. >“Our particular service is not materially affected as we already respond to warrants under the Telecommunications Act." The new laws would apply to something like Whatsapp or Signal, which do not have the ability to access the communications of users (thanks to end to end encryption). Fastmail already has enough access that if a legal demand is issued they can hand it over.
- yarosv 8y ago
  I think point is, that with backdoor you don't need the warrant. Which opens the possibility of the abuse.
  - caf 8y ago
    FWIW, as currently legislated, the "backdoor" scheme still requires warrants to be issued for data captured under it.
    - brongondwana 8y ago
      Yes, that. The law allows for requiring new backdoors to be requested up-front, but still requires warrants to activate those backdoors for specific requests, and it still doesn't give firehose access. It's not as awful as it's made out to be by some, but it's still pretty ham-handed in some of its implementation, and that's what we're proposing they look at changing.

koenigdavidmj 8y ago

The way you get this to end is by annoying the common people of Australia. The Internet death penalty would be one way—have FAANG completely stop doing business in Australia until this is repealed, and block Australians from their services. No Facebook, no new copies of Windows, no new Macs, nothing that runs on AWS. It’s a small enough country that it wouldn’t really be a dent in their bottom lines. Congratulations, you just got most of a country to angrily write their parliament-critters.

jaytaylor 8y ago
You may not realize: AWS has a data center region in Sydney, AUS
- mirimir 8y ago
  You'd think that they'd want to close that sucker.
- sargun 8y ago
  Does amazon own and operate it?
  - lewisinc 8y ago
    Yes? Of course they do.
    - yjftsjthsd-h 8y ago
      Not completely a given; their China footprint isn't directly them.
    - latch 8y ago
      Why "of course"? At one point in time (and this is probably still true), AWS was a client of various wholesale (and even wholesale/direct to consumer) in some regions. Equinix, Tata, Digital Realty Trust, ... AWS is is big, but there are a number of much bigger players.

just_one_time_ 8y ago

I just read that they are no longer accepting Bitcoin payments as well. Is this part of Adam Backs big push to make Bitcoin a settlement only layer?

pmoriarty 8y ago

So what's a good alternative to FastMail?

rishav_sharan 8y ago
Protonmail is great in terms of feature/security balance. Personally, I like using mail.disroot.org
- fvargas 8y ago
  Protonmail has also given in and paid out thousands* to criminals who DDoS their systems, no? *In my original post I mistakenly wrote "millions"
  - xref 8y ago
    All I’ve heard is they once paid $6000 to stop a ddos in 2015 at the demand of their hosting isp.
  - tonyztan 8y ago
    (Note: The parent comment claimed that ProtonMail paid "millions" in ransom. It appears to have been edited to say "thousands" now.) I am not affiliated with ProtonMail, but the answer is no. ProtonMail has paid a ransom exactly once, back in 2015 when it was just launched and suffered a DDOS attack that caused a lot of collateral damage to third parties, who pressured ProtonMail to pay the ransom. ProtonMail has since committed to "never pay another ransom" and invested in advanced DDOS mitigation capabilities, including by becoming its own ISP. Sources: https://protonmail.com/blog/protonmail-ddos-attacks/ https://protonmail.com/blog/protonmail-ddos-attacks/ https://protonmail.com/support/knowledge-base/email-ddos-protection/ https://protonmail.com/support/knowledge-base/email-ddos-pro...
- playpause 8y ago
  I switched from ProtonMail after a few months (despite having paid up front for a year) because the UX is so bad. You are forced to use their client apps, which are full of annoying bugs and design flaws. They ignored my support requests. Eventually I switched to MailFence, which has even worse UIs, straight out of the 90s, but you can use any IMAP client so it doesn’t really matter. (ProtonMail does have a bridge tool so you can use IMAP, but only on a desktop OS.) Still on the lookout for something better.

fvargas 8y ago

> Your 1-year Standard subscription expires on Sunday, February 24, 2019. Good timing?

linux2647 8y ago

Anyone know of a FastMail alternative? I was considering opening an account with them, but after reading this, I am concerned with the privacy implications, especially as I am trying to get off of Gmail.

austhrow743 8y ago
What privacy implications?
PopeDotNinja 8y ago
ProtonMail? It supposedly has encryption that prevents ProtonMail from reading your email.
- mirimir 8y ago
  If you believe that, yes. But that's not really novel. CounterMail had that a decade ago. Tutanota does too. Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff.
  - askmike 8y ago
    > Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff. Yes but no one can either :( In the last 5 years I received 2 encrypted emails, and thousands of non encrypted emails. The problem with PGP is that almost no one is using it. Maybe the people you email with do use it though.
    - mirimir 8y ago
      As I understand it, ProtonMail basically uses PGP. It just does it in Javascript or whatever. But whatever. The ability to use GnuPG serves as a filter ;)
      - askmike 8y ago

fvgs 8y ago

"We won't release any data without the required legal authorisation from an Australian court. As an Australian company, we do not respond to US court orders." [1] [1] https://www.fastmail.com/help/ourservice/security.html https://www.fastmail.com/help/ourservice/security.html

qbaqbaqba 8y ago
But legal systems cooperate. Ask Kim dot Com.

Felz 8y ago

If anyone's considering moving their email addresses over this, please take the time to get your own custom domain to host email on. That way you can switch providers more easily and actually own your email address. As a shameless plug: Purelymail, the mail service I'm working on, could use some more beta testers. It's (to my knowledge) the cheapest way to get email on a custom domain right now. https://purelymail.com/ https://purelymail.com/

jchw 8y ago
Yandex offers custom domains similar to G Suite, for free. So if people want a free option, even just to try this concept out, I can say that is a formidable option.
- rgbrenner 8y ago
  If you have a problem with AU's law, I don't see how moving it to Russia is an improvement.
  - x0x0 8y ago
    Russia is unlikely to cooperate with the US government for the foreseeable future.
  - jchw 8y ago
    Valid concern, but I'm mostly pointing this out in the context of the parent comment. Emphasis on the fact that it's free, and may be a decent stepping stone for those interested in custom domain email.
  - webmobdev 8y ago
    Well, you can be sure that Russia won't share your data with the US or UK unlike the Aussies! ;)
fvargas 8y ago
I only took a brief look, but I like the premise. The service seems far from something I would trust with handling my email. I still trust Fastmail (for reference). But I strongly welcome more alternatives to Gmail and services which prioritize user privacy. The attempt at monetization strikes me as extremely premature, given the competition. But I hope to see more.

anotherevan 8y ago

Related: Mozilla may treat Aussie staff as 'insider threats' to code base https://www.itnews.com.au/news/mozilla-may-treat-aussie-staff-as-insider-threats-to-code-base-519793 https://www.itnews.com.au/news/mozilla-may-treat-aussie-staf... https://news.ycombinator.com/item?id=19243630 https://news.ycombinator.com/item?id=19243630

rovyko 8y ago
Contents of the TOLA act in question: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6195 https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
kkarakk 8y ago
shouldn't all staff be treated as threats really? esp on projects with global impact(and hence global interest in compromising)
- pjc50 8y ago
  Don't know why this got downvoted; it's difficult and expensive to build systems that require multiple coordinated actors for critical changes, so few companies do, but that doesn't mean it's not a risk. https://www.pcmag.com/news/366493/email-providers-servers-wiped-in-catastrophic-hack https://www.pcmag.com/news/366493/email-providers-servers-wi...
- Bartweiss 8y ago
  Given Yahoo's experience, yes. The guy in charge of security and data access had a backbone and a reputation, so when somebody wanted a backdoor they simply went around him and got other people to hide it. (Which, of course, meant that the experts didn't review it and the thing was insecure.) I don't think Mozilla is wrong to treat Aus staff as a possible source for government privacy intrusion, but by that standard they really ought to view US (et al) employees as risks too. Of course, the Yahoo compromise was allegedly approved by Marissa Meyer and corporate counsel. (Which suggests some ugly things about trusting behavior up the corporate ladder.) I guess that could mean Mozilla expects a US intrusion to show up at the executive level, while an Australian intrusion would be more likely to threaten random employees with legal consequences.

BFLpL0QNek 8y ago

It saddens me when I’ve been a Fastmail customer for 4 years, happy with the pricing, happy with the service as a temporary resident my only way to make a stand about the laws is to move away from Australian service providers. I’ll likely start migrating mail shortly after purchasing a .dev domain. If it wasn’t for my Australian partner I’d likely of left by now as tech work is limited here, severely behind places like London, currently feeling like it’ll be difficult to progress beyond where I am now within the AU. A lot of it is also now dubious big data, I.e what can we snoop on to sell you more or sell the data collected for dubious purposes.

rawmodz 8y ago

Gee, is almost like the political grubs had absolutely no idea about encryption and how it works and how it will be virtually impossible to implement these stupid laws. Who would have thought that's the case? So very disappointed in all politicians at the moment, in my opinion, they're all scum bags

password4321 8y ago

I was surprised to learn last month that "you can impersonate other Fastmail customers by just spoofing the email address". https://news.ycombinator.com/item?id=18996200#18997054 https://news.ycombinator.com/item?id=18996200#18997054

webmobdev 8y ago

Not surprised - I dumped Fastmail when Australi passed a lot of intrusive and anti-privacy laws. And as it is a part of the 5 eyes program.

markstos 8y ago

I'm a long time Fastmail customer and will consider moving over this. I would prefer Fastmail moved their servers and place of business incorporation to an encryption and privacy-friendly country.

deleted 8y ago
[deleted]
accatyyc 8y ago
Why? Fastmail always complied with warrants to get your data, so nothing changes because if this law. If you want to hide something, encrypt your e-mails before they reach Fastmail (and do the same regardless of provider you use, why trust anyone?)
- markstos 8y ago
  It's a signal to Australia as well as to Fastmail. I like Fastmail. American companies invert their corporate structure to avoid taxes. They become Irish companies with an American subsidiary. Fastmail can become a Dutch company with remote employees in Australia. If the law is seen has having negative economic impact on the tax base, perhaps it will change. Undermining encryption for some weakens security for all.
- markstos 8y ago
  If I leave Fastmail, I think I'll most likely switch to self-hosting email with Helm instead: https://thehelm.com/ https://thehelm.com/ For a family of four, the annual cost would be about half of Fastmail's standard plan.
- jolmg 8y ago
  There is the change that warrants are apparently not needed anymore. The PDF linked in the article says that there's now no judicial oversight over these requests. I haven't decided myself if I'll switch, but if I do, it's more of a matter of principle. I just don't like how the world is becoming more authoritarian-like, and I feel it will continue to move this way unless people demonstrate their unwillingness to put up with such policies.

mescalito 8y ago

If I may, I want to share my recently pleasant experience with MailU[1]. I am in no way related to them, but it worked very nicely, it wasn't difficult to setup, and it sorts a lot of things out that have always been a pain for me when setting up my own mail server. [1]: https://mailu.io/ https://mailu.io/

aboutruby 8y ago

Also I learned recently that Australia's internet is getting more censored every year: https://en.wikipedia.org/wiki/Internet_censorship_in_Australia https://en.wikipedia.org/wiki/Internet_censorship_in_Austral...

lettergram 8y ago

When I saw the most recent provacy stripping law pass (maybe 3 months ago?), it pushed me to move everything to my own custom domain. I also signed up with ProtonMail and have started the migration. I’m not the only one, people I know who have used FastMail for years have decided to jump ship.

rbritton 8y ago

I understand the concern over the law in general, but I don't agree with the sentiments about email in particular. Email is not and should not be considered completely secure, so if that is a need, something else should be used. In my opinion, the Australian law does not make it any more insecure or less private -- everything that could have been obtained via warrant prior to the law's passage is the same data that is accessible with it. If that's a concern, set up your email in a different jurisdiction. I am currently a FastMail customer because I like the product, and this does not make me think I need to move. Unless something else changes, I'll keep it where it is.

hedora 8y ago
No technology is completely secure. Email is particularly bad, but there’s a huge gap between what a secured system would allow, and what one without encryption at rest allows. Without encryption at rest, you can grab all non-deleted emails for the entire population in one go. With due process and encryption at rest, the most authorities can do is get a warrant to sniff smtp relays to selectively catch emails involving a single user while they are in transit. In practice, unless the target is an ongoing criminal operation, the latter option is more difficult and less likely to succeed than other investigative options, so the fact that it’s possible is nearly a moot point for law abiding citizens.

LinuxBender 8y ago

I put a few domains on FastMail for family members to avoid using Google and also avoid using my fascist BOFH mail servers. They know that if anything is sensitive, they and their friends will need to pgp or 7-zip encrypt the payload. I will gladly continue to use Fastmail if that is the only way to keep people I care about from staying logged into Google.

oriettaxx 8y ago

Yes, I just moved from free gmail to fastmail maily for privacy: hope they can solve it, 'cause I like fastmail, a lot!

dade_ 8y ago

Yes they are. I decided to leave O365 business and was ready to switch to FastMail when this law was passed. I decided to keep looking and found German mailbox.org and chose them instead. So far so good.

Ixiaus 8y ago

I am a happy FastMail customer. The service is great, it is indeed fast and they're a small company devoted to doing email and serving their customers. I don't plan on leaving FastMail.

lysp 8y ago

Here is FastMail's response to the Government inquiry. https://www.aph.gov.au/DocumentStore.ashx?id=ec39b475-9559-4fa4-94ca-d45294534200&subId=666615 https://www.aph.gov.au/DocumentStore.ashx?id=ec39b475-9559-4... [pdf]

turok 8y ago

I'm currently in Western Europe waiting for the delivery of forms to cancel my Australian business number, this law has destroyed industry confidence in the Australian government for customers and service providers. Even if rolled back, the political and social environment that spawned it remains, and committing to development resources in Australia now is a fool's errand if you have any alternative.