7 ms·

Hmm I was just the other day contemplating moving my domain and email off of Google/Gsuite nd ProtonMail was one alternative I was considering. Now I'm hesitant

by spraak 7y ago

Hmm I was just the other day contemplating moving my domain and email off of Google/Gsuite nd ProtonMail was one alternative I was considering. Now I'm hesitant - what other options are there?

slenk 7y ago
Hosting it for $5/month on a Linode VPS using mailinabox.email
- dbmueller 7y ago
  I'm tempted to do that, but how much effort does it take to have something rock solid with no downtime? Or in general, what are the `uptime` over `time investment` and `security` over `time investment` curves like?
  - gervu 7y ago
    No downtime is "unicorn feathers" territory. Extremely low downtime requires redundant systems and a dedicated support team actively trying to head off potential problems. And Gmail still has downtime. But you're asking the wrong questions. Email itself has retries built in, it doesn't need perfect uptime. What you should be asking is how badly Gmail deciding you might be a spammer and not caring about fixing that for one person is going to torpedo your deliverability rate.
  - optmzr 7y ago
    I haven't tried mailinabox.email, but I've run a mailcow-dockerized instance for about 4 months. It took about 1 day to set it all up, where most of the time was spent waiting for DNS changes and for Microsoft to de-list my IP from their blacklist (I probably got a bad IP from DigitalOcean). After that I have logged in to the instance every two weeks to update the machine, haven't had any problems as of yet. The uptime shouldn't be any problem, as the other mail providers should retry sending their mail, it's even mentioned in the RFC: https://tools.ietf.org/html/rfc5321#section-4.5.4 https://tools.ietf.org/html/rfc5321#section-4.5.4 Hopefully I haven't missed any mail when updating mailcow-dockerized, I'll never know, hehe. Really easy and a great experience, compared to doing it from scratch.
    - dbmueller 7y ago
      Good to know, thanks for sharing your experience!
  - slenk 7y ago
    I have done mailinabox.email and recently I switched to mailcow-dockerized like optmzr. By default, they both apply strict security practices so you won't have an open relay, worried about domain masking etc. Either are about a day to set up and its mostly DNS.
- Ajedi32 7y ago
  What are Linode's legal obligations regarding real-time surveillance though? Is there any reason to believe they're any better than ProtonMail?
  - slenk 7y ago
    I am sure they can record IPs if neeeded. The difference is linode doesn't know who I am sending email to/receiving from.
    - virusduck 7y ago
      You just have to be sure and disable most logging if you're using something like mailinabox. Defaults are still pretty loquacious.
    - gsnedders 7y ago
      Don't they? They certainly have access to the VPS file system. But even beyond that, can they be compelled by a court order to install software on the VPS (and securing against someone with unlimited access to the VM host is… about as practical as securing against someone with physical access)? I'd assume so?
      - slenk 7y ago
        Probably? The main benefit to me for runnign my own email is owning my own data/domain, and not having to allow third parties (aka google) full access to all my emails.
  - LinuxBender 7y ago
    Long time user of Linode. I assume like any other provider, they would be obligated to make a best effort to obtain forensic data. i.e. logs from your ext4 filesystem. If you use a raw disk and encrypt it, then I assume they would live-snapshot your VM (they can live migrate them) and dump memory contents. Some of the lower-end VPS providers do not have live migrate capabilities (or at least, don't have an easy way to use them in their tooling). It is your call how long you save/enable logs and if you save them to tmpfs and encrypt your swap. You can also encourage your users to 7-zip encrypt sensitive contents. You can also add specific MX routes in transport maps to use VPN connections to make connection logging less useful. Tinc (open source VPN) is great for this, as traffic routes in user-space through your mesh and therefor traffic can end up at its destination without a direct connection.
Lowkeyloki 7y ago
I have almost completely moved my email from Google to ProtonMail. Now this. It makes me sad. I'm using ProtonVPN as well. So, what are the alternatives?
- w8vY7ER 7y ago
  In the same boat and now actively considering just self-hosting as these threads will so often advocate for. What a pain.
  - Lowkeyloki 7y ago
    I've heard lots of horror stories about self-hosted mail bouncing as spam. I'd only consider that a last resort, personally.
    - raintrees 7y ago
      I have been self-hosting for over 20 years using self-signed certificates, now widely described by current browsers as "unsafe and suspicious." My clients receive my emails without issue, whether they have Microsoft-hosted, Google-hosted, email servers, etc. or their own private self-hosted servers. As do any other service I interact with via email. Being bounced as spam not an issue for me.
    - JohnFen 7y ago
      I'm guessing those horror stories are from people who've misconfigured their mailserver. I've been running my own mailserver for over 20 years now, and have never encountered this problem.
    - amaccuish 7y ago
      Started self-hosting around a year ago. Followed online guides with some tweaks to integrate with my home's Active Directory. Other than that, only had outgoing mail bounce once from mimecast, and after a while they started accepting mail (presumably because of change of my server's ips). Configure rspamd properly and spam isn't an issue.
    - 7y ago
jlamberts 7y ago
I tried a few: runbox, protonmail, and fastmail, and ended up staying with fastmail. The web interface isn't pretty but is functional and the service has been great so far. Very easy to set up with my own domain.
- ashton314 7y ago
  I've been on fastmail for a while too an I'm quite satisfied. Yes, web interface is ugly, but I use a mail client on my computer most of the time (mutt!) so it doesn't matter that much for me.
ziddoap 7y ago
I don't quite understand this line of thought. If you are concerned about privacy, you shouldn't be on Google at all. Move to almost any other provider and you are already a step ahead in terms of privacy. You aren't going to get absolute privacy in a single step, if ever. You do the best you can, iterate, and do better. Moving away from Google is step 1. Step 2 is to continue research, and potentially move again if it fits your threat model.
- spraak 7y ago
  Migration is non trivial - i.e. it is a lot of work. You're right, I'm not looking for perfection, but to just jump to something because it's marginally better than Google isn't worth it. I want the difference to be great enough for my time investment. So I think it's quite sensible to carefully consider where to move. Getting off of Google is indeed important, but if I'm in only a slightly better situation, that's hasty and a waste. I don't expect absolute privacy anywhere, but I am looking for "pretty damn good". Maybe if DDG offered email it'd fit that.
  - ziddoap 7y ago
    I take slight issue with "marginally better than Google". Any of the services mentioned here (Posteo, Fastmail, etc.) including Protonmail are _much_ more than "marginally" better when it comes to privacy. The issue that you have with Protonmail seems to be that they enabled IP logging in response to a lawful government request. Google logs IP by default, scans your messages, etc. It baffles me that there is less outrage at that than this single case. I agree, it's non-trivial and perhaps my comment came across in a negative light. But, I think people are overstating the implication of the issue at hand - especially when you compare Protonmail (and others) to the big providers such as Google and Microsoft.
    - deleted 7y ago
      [deleted]
    - guuhv 7y ago
      >The issue that you have with Protonmail seems to be that they enabled IP logging in response to a lawful government request. Google logs IP by default, scans your messages, etc. It baffles me that there is less outrage at that than this single case. So in case the government is out to get you, both options will lead to the same outcome: your IP address is revealed.
imbusy111 7y ago
Migration of any existing account data to ProtonMail is a complete disaster and to be avoided. Speaking from experience.
maverickmax90 7y ago
Migadu.com
- gruez 7y ago
  How are they better? Your emails aren't even encrypted so they can read your emails anytime they want.
meruru 7y ago
tutanota.com is a good one.
JohnFen 7y ago
> Now I'm hesitant - what other options are there? I think you'll have a very hard time finding an email provider that behaves any differently from ProtonMail on this count.
protonmail 7y ago
The allegations are false. The Swiss prosecutor in question, has also publicly clarified that. See our other comment at the top.
alpaca128 7y ago
Mailbox is a german email service with calendar sync, online office suite and stuff like that. Also it allows completely anonymous payment if you're into that. Posteo is similar as far as I know.
- _Codemonkeyism 7y ago
  Posteo has no custom domains. I currently use Gmail to SPAM filter and forward to Posteo. This at least removes Gmail at-rest-mails.

by spraak 7y ago

Hmm I was just the other day contemplating moving my domain and email off of Google/Gsuite nd ProtonMail was one alternative I was considering. Now I'm hesitant - what other options are there?

slenk 7y ago

Hosting it for $5/month on a Linode VPS using mailinabox.email

dbmueller 7y ago
I'm tempted to do that, but how much effort does it take to have something rock solid with no downtime? Or in general, what are the `uptime` over `time investment` and `security` over `time investment` curves like?
- gervu 7y ago
  No downtime is "unicorn feathers" territory. Extremely low downtime requires redundant systems and a dedicated support team actively trying to head off potential problems. And Gmail still has downtime. But you're asking the wrong questions. Email itself has retries built in, it doesn't need perfect uptime. What you should be asking is how badly Gmail deciding you might be a spammer and not caring about fixing that for one person is going to torpedo your deliverability rate.
- optmzr 7y ago
  I haven't tried mailinabox.email, but I've run a mailcow-dockerized instance for about 4 months. It took about 1 day to set it all up, where most of the time was spent waiting for DNS changes and for Microsoft to de-list my IP from their blacklist (I probably got a bad IP from DigitalOcean). After that I have logged in to the instance every two weeks to update the machine, haven't had any problems as of yet. The uptime shouldn't be any problem, as the other mail providers should retry sending their mail, it's even mentioned in the RFC: https://tools.ietf.org/html/rfc5321#section-4.5.4 https://tools.ietf.org/html/rfc5321#section-4.5.4 Hopefully I haven't missed any mail when updating mailcow-dockerized, I'll never know, hehe. Really easy and a great experience, compared to doing it from scratch.
  - dbmueller 7y ago
    Good to know, thanks for sharing your experience!
- slenk 7y ago
  I have done mailinabox.email and recently I switched to mailcow-dockerized like optmzr. By default, they both apply strict security practices so you won't have an open relay, worried about domain masking etc. Either are about a day to set up and its mostly DNS.
Ajedi32 7y ago
What are Linode's legal obligations regarding real-time surveillance though? Is there any reason to believe they're any better than ProtonMail?
- slenk 7y ago
  I am sure they can record IPs if neeeded. The difference is linode doesn't know who I am sending email to/receiving from.
  - virusduck 7y ago
    You just have to be sure and disable most logging if you're using something like mailinabox. Defaults are still pretty loquacious.
  - gsnedders 7y ago
    Don't they? They certainly have access to the VPS file system. But even beyond that, can they be compelled by a court order to install software on the VPS (and securing against someone with unlimited access to the VM host is… about as practical as securing against someone with physical access)? I'd assume so?
    - slenk 7y ago
      Probably? The main benefit to me for runnign my own email is owning my own data/domain, and not having to allow third parties (aka google) full access to all my emails.
- LinuxBender 7y ago
  Long time user of Linode. I assume like any other provider, they would be obligated to make a best effort to obtain forensic data. i.e. logs from your ext4 filesystem. If you use a raw disk and encrypt it, then I assume they would live-snapshot your VM (they can live migrate them) and dump memory contents. Some of the lower-end VPS providers do not have live migrate capabilities (or at least, don't have an easy way to use them in their tooling). It is your call how long you save/enable logs and if you save them to tmpfs and encrypt your swap. You can also encourage your users to 7-zip encrypt sensitive contents. You can also add specific MX routes in transport maps to use VPN connections to make connection logging less useful. Tinc (open source VPN) is great for this, as traffic routes in user-space through your mesh and therefor traffic can end up at its destination without a direct connection.

Lowkeyloki 7y ago

I have almost completely moved my email from Google to ProtonMail. Now this. It makes me sad. I'm using ProtonVPN as well. So, what are the alternatives?

w8vY7ER 7y ago
In the same boat and now actively considering just self-hosting as these threads will so often advocate for. What a pain.
- Lowkeyloki 7y ago
  I've heard lots of horror stories about self-hosted mail bouncing as spam. I'd only consider that a last resort, personally.
  - raintrees 7y ago
    I have been self-hosting for over 20 years using self-signed certificates, now widely described by current browsers as "unsafe and suspicious." My clients receive my emails without issue, whether they have Microsoft-hosted, Google-hosted, email servers, etc. or their own private self-hosted servers. As do any other service I interact with via email. Being bounced as spam not an issue for me.
  - JohnFen 7y ago
    I'm guessing those horror stories are from people who've misconfigured their mailserver. I've been running my own mailserver for over 20 years now, and have never encountered this problem.
  - amaccuish 7y ago
    Started self-hosting around a year ago. Followed online guides with some tweaks to integrate with my home's Active Directory. Other than that, only had outgoing mail bounce once from mimecast, and after a while they started accepting mail (presumably because of change of my server's ips). Configure rspamd properly and spam isn't an issue.
  - 7y ago

jlamberts 7y ago

I tried a few: runbox, protonmail, and fastmail, and ended up staying with fastmail. The web interface isn't pretty but is functional and the service has been great so far. Very easy to set up with my own domain.

ashton314 7y ago
I've been on fastmail for a while too an I'm quite satisfied. Yes, web interface is ugly, but I use a mail client on my computer most of the time (mutt!) so it doesn't matter that much for me.

ziddoap 7y ago

I don't quite understand this line of thought. If you are concerned about privacy, you shouldn't be on Google at all. Move to almost any other provider and you are already a step ahead in terms of privacy. You aren't going to get absolute privacy in a single step, if ever. You do the best you can, iterate, and do better. Moving away from Google is step 1. Step 2 is to continue research, and potentially move again if it fits your threat model.

spraak 7y ago
Migration is non trivial - i.e. it is a lot of work. You're right, I'm not looking for perfection, but to just jump to something because it's marginally better than Google isn't worth it. I want the difference to be great enough for my time investment. So I think it's quite sensible to carefully consider where to move. Getting off of Google is indeed important, but if I'm in only a slightly better situation, that's hasty and a waste. I don't expect absolute privacy anywhere, but I am looking for "pretty damn good". Maybe if DDG offered email it'd fit that.
- ziddoap 7y ago
  I take slight issue with "marginally better than Google". Any of the services mentioned here (Posteo, Fastmail, etc.) including Protonmail are _much_ more than "marginally" better when it comes to privacy. The issue that you have with Protonmail seems to be that they enabled IP logging in response to a lawful government request. Google logs IP by default, scans your messages, etc. It baffles me that there is less outrage at that than this single case. I agree, it's non-trivial and perhaps my comment came across in a negative light. But, I think people are overstating the implication of the issue at hand - especially when you compare Protonmail (and others) to the big providers such as Google and Microsoft.
  - deleted 7y ago
    [deleted]
  - guuhv 7y ago
    >The issue that you have with Protonmail seems to be that they enabled IP logging in response to a lawful government request. Google logs IP by default, scans your messages, etc. It baffles me that there is less outrage at that than this single case. So in case the government is out to get you, both options will lead to the same outcome: your IP address is revealed.

imbusy111 7y ago

Migration of any existing account data to ProtonMail is a complete disaster and to be avoided. Speaking from experience.

maverickmax90 7y ago

Migadu.com

gruez 7y ago
How are they better? Your emails aren't even encrypted so they can read your emails anytime they want.

meruru 7y ago

tutanota.com is a good one.

JohnFen 7y ago

> Now I'm hesitant - what other options are there? I think you'll have a very hard time finding an email provider that behaves any differently from ProtonMail on this count.

protonmail 7y ago

The allegations are false. The Swiss prosecutor in question, has also publicly clarified that. See our other comment at the top.

alpaca128 7y ago

Mailbox is a german email service with calendar sync, online office suite and stuff like that. Also it allows completely anonymous payment if you're into that. Posteo is similar as far as I know.

_Codemonkeyism 7y ago
Posteo has no custom domains. I currently use Gmail to SPAM filter and forward to Posteo. This at least removes Gmail at-rest-mails.