51 ms·

Under U.S. laws, providers are often required to give information to the government if they have a warrant. If you want (more) security, host it yourself.

by hvs 15y ago

daniel1980fl 15y ago
question: wouldnt your ISP capture all traffic and "log it" on the run, so if you have your own mailserver, government can still ask ISP to get them your traffic packets? -- AFAIK mail runs in plain text over the net, right?
SageRaven 15y ago
True, however some providers make attempts to thwart this by making it impossible for even themselves to access mail by way of encryption. I haven't looked at it in a long while, but lavabit.com was one such company, and it's a pretty good raw POP/IMAP service (at last check the web interface and spam measures were somewhat lacking).
- mike-cardwell 15y ago
  I like what lavabit has done, but at the end of the day, if they are forced to, they can modify their server side software to log your password when you log in, and then use that password to decrypt all of your email on the server side. It also doesn't secure the email on the client side. If your IMAP client stores the email on disk, then you need to make sure it is encrypting it in a secure fashion first. Lavabit should offer an extra layer of encryption whereby they allow you to upload a public pgp key which they encrypt all your incoming email with using PGP/MIME.
  - earl 15y ago
    I don't think even what you said is sufficient -- as long as they are within the jurisdiction of the US court system, I think a judge can order them to start saving copies of incoming mail before encrypting, etc. I think fundamentally you can't circumvent the law with technical measures. You need to change the law to require warrants.
    - mike-cardwell 15y ago
      Sure. The method I stated would protect historical email, but it wouldn't prevent the capture of new email after an order has been made to start saving it.
deleted 15y ago
[deleted]

Under U.S. laws, providers are often required to give information to the government if they have a warrant. If you want (more) security, host it yourself.

by hvs 15y ago

Under U.S. laws, providers are often required to give information to the government if they have a warrant. If you want (more) security, host it yourself.

daniel1980fl 15y ago

question: wouldnt your ISP capture all traffic and "log it" on the run, so if you have your own mailserver, government can still ask ISP to get them your traffic packets? -- AFAIK mail runs in plain text over the net, right?

SageRaven 15y ago

True, however some providers make attempts to thwart this by making it impossible for even themselves to access mail by way of encryption. I haven't looked at it in a long while, but lavabit.com was one such company, and it's a pretty good raw POP/IMAP service (at last check the web interface and spam measures were somewhat lacking).

mike-cardwell 15y ago
I like what lavabit has done, but at the end of the day, if they are forced to, they can modify their server side software to log your password when you log in, and then use that password to decrypt all of your email on the server side. It also doesn't secure the email on the client side. If your IMAP client stores the email on disk, then you need to make sure it is encrypting it in a secure fashion first. Lavabit should offer an extra layer of encryption whereby they allow you to upload a public pgp key which they encrypt all your incoming email with using PGP/MIME.
- earl 15y ago
  I don't think even what you said is sufficient -- as long as they are within the jurisdiction of the US court system, I think a judge can order them to start saving copies of incoming mail before encrypting, etc. I think fundamentally you can't circumvent the law with technical measures. You need to change the law to require warrants.
  - mike-cardwell 15y ago
    Sure. The method I stated would protect historical email, but it wouldn't prevent the capture of new email after an order has been made to start saving it.

deleted 15y ago

[deleted]