4 ms·

+1 for Migadu or ProtonMail, both offer great service, but Migadu with $19 yearly plan and amount of features is just incomparable to any other service.

by monkin 6y ago

omnimus 6y ago
Worth noting i suspect they had some issues and maybe the company was sold? It was quite young company. I had it for few years but there was very litle activity, no bug fixes, updates, messages. It was a bit worrysome. Now they have changed branding and pricing so hopefuly its moving again.
- monkin 6y ago
  I remember they had some issues at the beginning of a year when international lockdown struck. That huge surge of remote workers made problems for many companies. But I’m using them for few years and never been happier. :)
Fnoord 6y ago
ProtonMail (and ProtonVPN, ...) is unrealistically expensive. Posteo [1] runs on green energy, and does support TOTP (in constrast to Migadu). 12 EUR/year. [1] https://posteo.de https://posteo.de
- monkin 6y ago
  Unrealistic? The same pricing like many other commercial products in this area, and even cheaper than Google. EDIT: Posteo doesn’t have custom domains, total deal breaker for me.
- dejan 6y ago
  Posteo is not very transparent there. They do not mention SMTP/IMAP/POP access on their 2FA docs. 2FA is not supported by any email client for generic IMAP/POP/SMTP[1]. Just think of that experience, providing a token on every sync or sending. This is why we sometimes take such a harsh stand in our copy. You need to tell users about these things and not throw marketing BS counting on information asymmetry. We (Migadu) do support TOTP + Yubikey on the admin account. We also support TOTP on the webmail just like Posteo does. However, we call that B.S. ourselves and are working on a real solution for mailboxes. If you do setup 2FA on Posteo, how is your e.g. IMAP access protected? They most likely offer an app-specific password which is very different than 2FA. We do those too, they are called _identities_ in our context. We have a long and bumpy road behind and ahead of us, but one thing we made clear on day one is that we will not B.S. users. Email is not perfect, it has serious conceptual issues due its age, but one should not go about it as "there we fixed it!" (Hey hey.com!) [1] https://security.stackexchange.com/questions/173807/does-imap-pop3-asp-undermine-two-factor-auth https://security.stackexchange.com/questions/173807/does-ima...
  - Fnoord 6y ago
    > You have been mislead by Posteo intentionally it seems. I don't like such tone. TL;DR I didn't verify how Posteo's TOTP works. FWIW, I've never used Posteo; I have some German friends who are happy with it. I'm staying local, using Soverin as my primary e-mail provider. The reason for using a token for authorization is that the user can revoke the token (e.g. when device is lost), instead of having to change their password. These are indeed not TOTP because they are not time-based, nor do they depend on another factor (ie. password); they replace that factor. It is indeed dishonest to call such MFA/2FA. Its perfectly possible to get IMAP to work with TOTP though. For example, you can use PAM to authenticate, and PAM can use TOTP or FIDO2 (ignoring the issues with PAM every major OS barring OpenBSD uses it). We use something similar for OpenVPN because of requirement of ISO 27k1. I don't trust webmail at all because I don't audit the JavaScript. Nor can I verify that every visit. Same issue with OpenPGP.js. Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Which is why I wouldn't pay much for it; as I would not and do not use it much, since its fundamentally broken. For example, at rest and at transit there is not enough data integrity/authenticity. A lot of people are using a weak password as first factor, btw. Do you protect against such?
    - dejan 6y ago
      > I don't like such tone. Corrected, not intention to make a "tone", just pointing out that information is intentionally omitted. > Its perfectly possible to get IMAP to work with TOTP Yes, but that's not available in generally available email clients. There are OTP extensions to IMAP. > I don't trust webmail at all because I don't audit the JavaScript This. We are working on one that uses no JS or just conditinaly for enhancements. > Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Glad I am not the only one thinking that =) > A lot of people are using a weak password as first factor, btw. Do you protect against such? No, we set a minimum 6 char password. However we think it is less secure to have a complex one you canot remember than one of average strength.
      - 6y ago
- herbst 6y ago
  I pay like 7$ a month for a few domains and aliases. Not sure what you consider expensive but for such a crucial service as email i think its fair. Most my domains are just forwarded, guess i save a lot on that front tho
herbst 6y ago
I use Protonmail, the spam protection feels a lot more on my side than i ever experienced with gmail (which was my main reason for staying way to long) You can use it free or upgrade with a fair tiered model. Would recommend it anyone.

+1 for Migadu or ProtonMail, both offer great service, but Migadu with $19 yearly plan and amount of features is just incomparable to any other service.

by monkin 6y ago

+1 for Migadu or ProtonMail, both offer great service, but Migadu with $19 yearly plan and amount of features is just incomparable to any other service.

omnimus 6y ago

Worth noting i suspect they had some issues and maybe the company was sold? It was quite young company. I had it for few years but there was very litle activity, no bug fixes, updates, messages. It was a bit worrysome. Now they have changed branding and pricing so hopefuly its moving again.

monkin 6y ago
I remember they had some issues at the beginning of a year when international lockdown struck. That huge surge of remote workers made problems for many companies. But I’m using them for few years and never been happier. :)

Fnoord 6y ago

ProtonMail (and ProtonVPN, ...) is unrealistically expensive. Posteo [1] runs on green energy, and does support TOTP (in constrast to Migadu). 12 EUR/year. [1] https://posteo.de https://posteo.de

monkin 6y ago
Unrealistic? The same pricing like many other commercial products in this area, and even cheaper than Google. EDIT: Posteo doesn’t have custom domains, total deal breaker for me.
dejan 6y ago
Posteo is not very transparent there. They do not mention SMTP/IMAP/POP access on their 2FA docs. 2FA is not supported by any email client for generic IMAP/POP/SMTP[1]. Just think of that experience, providing a token on every sync or sending. This is why we sometimes take such a harsh stand in our copy. You need to tell users about these things and not throw marketing BS counting on information asymmetry. We (Migadu) do support TOTP + Yubikey on the admin account. We also support TOTP on the webmail just like Posteo does. However, we call that B.S. ourselves and are working on a real solution for mailboxes. If you do setup 2FA on Posteo, how is your e.g. IMAP access protected? They most likely offer an app-specific password which is very different than 2FA. We do those too, they are called _identities_ in our context. We have a long and bumpy road behind and ahead of us, but one thing we made clear on day one is that we will not B.S. users. Email is not perfect, it has serious conceptual issues due its age, but one should not go about it as "there we fixed it!" (Hey hey.com!) [1] https://security.stackexchange.com/questions/173807/does-imap-pop3-asp-undermine-two-factor-auth https://security.stackexchange.com/questions/173807/does-ima...
- Fnoord 6y ago
  > You have been mislead by Posteo intentionally it seems. I don't like such tone. TL;DR I didn't verify how Posteo's TOTP works. FWIW, I've never used Posteo; I have some German friends who are happy with it. I'm staying local, using Soverin as my primary e-mail provider. The reason for using a token for authorization is that the user can revoke the token (e.g. when device is lost), instead of having to change their password. These are indeed not TOTP because they are not time-based, nor do they depend on another factor (ie. password); they replace that factor. It is indeed dishonest to call such MFA/2FA. Its perfectly possible to get IMAP to work with TOTP though. For example, you can use PAM to authenticate, and PAM can use TOTP or FIDO2 (ignoring the issues with PAM every major OS barring OpenBSD uses it). We use something similar for OpenVPN because of requirement of ISO 27k1. I don't trust webmail at all because I don't audit the JavaScript. Nor can I verify that every visit. Same issue with OpenPGP.js. Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Which is why I wouldn't pay much for it; as I would not and do not use it much, since its fundamentally broken. For example, at rest and at transit there is not enough data integrity/authenticity. A lot of people are using a weak password as first factor, btw. Do you protect against such?
  - dejan 6y ago
    > I don't like such tone. Corrected, not intention to make a "tone", just pointing out that information is intentionally omitted. > Its perfectly possible to get IMAP to work with TOTP Yes, but that's not available in generally available email clients. There are OTP extensions to IMAP. > I don't trust webmail at all because I don't audit the JavaScript This. We are working on one that uses no JS or just conditinaly for enhancements. > Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Glad I am not the only one thinking that =) > A lot of people are using a weak password as first factor, btw. Do you protect against such? No, we set a minimum 6 char password. However we think it is less secure to have a complex one you canot remember than one of average strength.
    - 6y ago
herbst 6y ago
I pay like 7$ a month for a few domains and aliases. Not sure what you consider expensive but for such a crucial service as email i think its fair. Most my domains are just forwarded, guess i save a lot on that front tho

herbst 6y ago

I use Protonmail, the spam protection feels a lot more on my side than i ever experienced with gmail (which was my main reason for staying way to long) You can use it free or upgrade with a fair tiered model. Would recommend it anyone.