8 ms·
Email providers – which one to choose?
- mahmoudhossam 6y agoVery nice and detailed analysis. I don't see zoho mail on that list though, they seem to be a popular email provider for businesses that don't want to go the usual Google/Microsoft route.
- igetspam 6y agoHaving used Zoho, the best thing I can say about their service is that it's not gmail. It's a very mediocre offering. Most email is but they have an all-in-one service that's entirely "meh."
- viraptor 6y agoWhat do you mean by meh? What are you missing specifically?
- igetspam 6y agoThe navigation was difficult, configuration and user management was a complicated mess, the service desk was slow and difficult to use, etc. So, by "meh," what I really mean is "No compelling differentiators and not well organized, making it an entirely unremarkable offering."
- organsnyder 6y agoAfter being on Zoho for over five years, I recently migrated to Outlook 365. O365 is much better, in my experience.
- hatmatrix 6y agoIt's not written for the layman but it's interesting to read about how terrible Proton Mail is for privacy since that's the one most people think about first. The assessment begins with the following and just gets worse. "SMS is the only option (unless you want to donate, which would reveal your personal information of course); therefore their claim that "ProtonMail does not require any personally identifiable information to register" is a shameless lie. Update: a contact told me that Proton now includes the option to solve a recaptcha (still an evil) for confirmation; however, the option disappears while using a VPN. They must really want that damn phone number if you are using anonymizers! And the claim that you can sign up without personal data is still false."
- vbezhenar 6y agoIf you won’t automatically fight bots, you’ll be spam house and everyone will blacklist your servers. Blacklisted mail service is not very useful.
- penagwin 6y agoThey could at least accept monero as payment so there's a cost to enter without giving away my identity.
- violetgarden 6y agoYyyyup. Wish I saw this a few weeks ago when I was choosing a new mail provider to get off Gmail.
- ClumsyPilot 6y agoI never understood this logic - if your email provider is trustworthy, why do you need to hide your identity from them? If they are not, how can you trust them with your emails? In my mind, email is a utility like telephone and water supply - I don't hide from them, they are meant to keep my identity secure.
- burlesona 6y agoReading this list matches my personal search history pretty well, which is to say, it’s hard to find a good email provider. I would have been interested to see an analysis of Apple’s iCloud email offering. Perhaps that’s not mentioned because it’s not popular enough?
- aduitsis 6y agoOne serious problem is that email, apart from a means of communication, is also a means of authentication. Taking away a person's email address could easily mean that they will have to spend a tremendous amount of time changing it with various parties that have it in their records. At least those of them that can actually accept to talk to you (e.g. your bank or the IRS). An non-optimal approach would be to actually own the domain name of one's email address and then use one of those providers listed there as the "backend" mailbox, by forwarding the "real" email address to the "backend" mail address. Most domain name providers will actually provide this kind of email forwarding for free. And it would be much much easier to switch between the backends. Or even use two of them simultaneously.
- jessaustin 6y agoProperly setting the MX DNS record is better than forwarding.
- aduitsis 6y agoI'm not sure this can work in general. You need some entity to forward and use the proper envelope headers for the mail to go through in the backend.
- jessaustin 6y agoAn SMTP server capable of responding to a forward would also be capable of responding to the original message, and would be accessible via the MX record. The only reason I see to introduce the additional server in the middle would be because the final destination is not always online or otherwise unreliable, and even then only if the forwarding server is more forgiving than typical mail senders.
- galago 6y agoI've owned a domain for 20 years and always had my mail hosted by one of the web hosting companies. I've used a couple hosting providers, but to be honest, I'm not certain how they've handled my mail in terms of privacy. It never seemed "non-optimal" to own the domain. I still think using gmail or other free services is a bad idea, but i don't generally say it out loud much anymore. People react negatively because they don't want to consider whether the services they depend on are misusing their personal information.
- alphabettsy 6y agoI didn’t read the full list, but I found it interesting that the writer noted that some providers store the sending and delivery IPs without acknowledging these are in the email headers. Doesn’t this mean that every provider fails that test, but only some disclosed that?
- jessaustin 6y agoDo they have to be in the headers? If they're in the headers normally, do they have to be saved by the email provider? Additionally, it seems that many of these providers will delete messages entirely when downloaded through IMAP and SMTP.
- andreareina 6y agoThe provider has to save the headers to forward them to you; if it doesn't then it's altering your emails. I've never heard of providers deleting messages upon being accessed through IMAP. Are you thinking of POP3?
- newscracker 6y agoA related point: for a very long time, Gmail has removed the sender’s IP address from mail headers. If you receive an email in Gmail, you can’t get the sender’s IP address from the headers (or from anywhere in that email). There are also email providers who, when sending your email out, remove your IP address from the header and substitute it with their own IP address for better privacy.
- fakedang 6y agoThink Gmail does the latter. I've seen all my mail pass through servers in California.
- newscracker 6y agoI haven’t checked the latter with Gmail, but it certainly does the former. You can verify it by sending an email from an address hosted by another provider to Gmail and checking the headers in the received email in Gmail. The headers will not have your (sender) IP address.
- modzu 6y agoThe downvotes gona rain but i laughed out loud at cock mail
- annoyingnoob 6y agoYou could always roll your own, works great for my personal domain. I do use a third-party provider for spam filtering, I did have to find someone I trust.
- smarx007 6y agoAdding https://www.migadu.com/privacy/ https://www.migadu.com/privacy/ to the list (migrated after trying to use Tutanota and Protonmail for a short while but they did not fit into my workflow). Full GDPR compliance and: > Beyond technical requirements for establishing a working session on our website and webmail, we do not use cookies or any form of tracking. > We do not collect data for the purpose of user behavior and do not integrate any website analytics. The only 2 parties they give data to are Stripe or Paypal.
- spurgu 6y agoSeconded. Have been using them for dozens of domains (through work) for 2-3 years now and have zero complaints.
- andreareina 6y agoHow's the delivery rate?
- smarx007 6y agoNever had a problem with large providers (YMMV, my domain is 5y+ and I have forwarding from Gmail set up) but had occasional greylisting issues with large enterprise systems (but I had the same with my work email account so that's nothing out of ordinary).
- ogre_codes 6y agoI like/ even prefer straight HTML pages, but this is one of the ugliest sites I've seen in a long time.
- no_protocol 6y ago> PGP is still fucking awesome and should always be used for any sensitive communication (best case scenario: all for every contact you can get to use it) - in addition to secure providers and all the other stuff we should be doing. Sorry, I actually live in the real world, not whatever fantasy land the author comes from.
- ClumsyPilot 6y agoI once had x509 email cert and I am yet to find a bank/government office/company/another software developer that could use it. PGP is even worse, software support is non-existant, etc.
- busterarm 6y agoSome open source projects that communicate primarily via email do make use of PGP signatures. Sourcehut has guidelines around how to use them on their lists and the aerc email client supports sending them and has a keyring for validation.
- technion 6y agoMost Government departments can support receiving and validating such certs now because they are using Exchange/Outlook, even if they don't know it. The funny part is when they modify emails with "THIS IS AN EXTERNAL SENDER", breaking the cert, and users just click through because the are used to it.
- ClumsyPilot 6y agoI disagree with the author right from the start, It appears the author wants an email service that is anonymous, free, and let's him access it through a VPN. I don't think that makes sence (how does the provider make money?) and I think it's not what 95% of the public needs. If you rely on your email for vital services your want email provide to operate like an (idealised) bank - store my private information with respect, and to be able to retrieve email even if my PC or account is stolen, and I am happy to pay for the privilege. Furthermore, handing over real money gives you standing to sue in the court of law if the provider doesn't uphold their side of the bargain. I don't mind providing real ID if it's a trustworthy institution with a real address and a phone number I can dial for customer support. By contrast if you Gmail is hijacked, there is no-one you can call for help and they can also ban you with no warning for no reason. You have almost no legal recourse on their misbehaviour because they can do anything for any reason and it's free. I was further surprised to read that the author sees no daylight between free Gmail, outlook, outlook Premium with your own domain (paid service), business office 365, etc. I don't think it's fair to call them all data collectors and the difference between then are not trivial. I am not claiming the author is misinformed or hasn't done his homework - just that this take is from the perspective of 'internet of anonymity' of 2000's, not 'internet of service I can trust my life with' that we deserve.
- busterarm 6y agoThere is no guarantee that your emails remain private in-transit. Email is totally insufficient for sending unencrypted secrets, so it shouldn't be thought safe to store them either. Many email clients will cache your mail unencrypted on your disk as well. It's actually better that people start to treat their mailboxes as somewhat ephemeral, as communicating that you are you encourages use of things like PGP signatures. And then people can send encrypted email for things that are worth keeping secret.
- ClumsyPilot 6y ago"Email is totally insufficient for sending unencrypted secrets, so it shouldn't be thought safe to store them either. Many email clients will cache your mail unencrypted on your disk as well." Suppose myself and the recipient are using x509 certs with outlook and our laptops have encrypted disks with bitlocker or equivalent - my impression is that it mostly covers the basis, is that unjustified? "It's actually better that people start to treat their mailboxes as somewhat ephemeral, as communicating that you are you encourages use of things like PGP signatures" Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.
- wyxuan 6y agoWhile I won't list them out here, the author takes some, frankly, crazy statements if you read through the whole thing. In addition, it seems unfortunate that some common sense measures against spam were simply unacceptable to the author. If you want to have a usable email, you have to have basic antispam protection.
- techsupporter 6y agoI was mostly taken by the author's stance that "storing" a customer's data is somehow unacceptable. This quote was the big one: "[Quoting Fastmail:] We also store information from your address book, calendar, notes and files on our servers. [The author writes:] Is there anything you guys don't store?" Is not the purpose of an e-mail provider to...store e-mail? On their servers? For me to access? I am very confused, and I genuinely mean that. Most of the author's complaints come from storing the data that I have paid them to store and then taking actions on that data in response to what I have asked them to do.
- apple4ever 6y agoI read that as well and was super confused as to the problem. That's the whole point of hosted email.
- mulmen 6y agoJust in the last couple of days I set up Fastmail with a personal domain. At the moment I am more concerned with divorcing myself from Google than I am about privacy. It seems to me self-hosting is the only option if you are concerned about privacy. Using an email hosting service requires trusting that service to do what they claim so by definition none of them are sufficient. Eventually I plan on self-hosting but that's been on the to-do list for years now. One step at a time.
- sam_bristow 6y agoI've had Fastmail on a personal domain for a couple of years. It's worked great for my needs. I used to want to self-host it but (IMO) running a secure, reliable email server is just too difficult these days. My privacy is probably better off with professionals running my email for me.
- holri 6y ago> I used to want to self-host it but (IMO) running a secure, reliable email server is just too difficult these days. I disagree. I am running my own small email server for years on Debian stable without any issues except the initial configuration. Freedombox has a mail server on their roadmap. It automates the configuration. You can even buy a small appliance (Olimex A20) ready to go.
- sam_bristow 6y agoOf course, the tradeoffs would be different for someone else. For me email is simultaneously important enough I don't want to risk me messing it up and uninteresting enough that i done want to spend the time really getting it right. The Freedombox mail server would be just as much of a black box to me as Fastmail except Fastmail comes with a SLA and someone else to fight fires. For now at least - $100/year to have someone else look after it for me is the right tradeoff for me.
- txtsd 6y agoSelf-hosting is impractical at this point in time. I had a self-hosted setup for my company, a couple of years ago, with correct DKIM and DMARC and whatever else goes into an email setup, and my emails still ended up in major providers' spam folders.
- Sirikon 6y agoSomeone please find out if the author is okay. After puking this herald of nonsense it surely fainted on top of his cheetos mountain.
- Aeolun 6y agoThe anger in this post is pretty palpable. The author wants an email service that doesn’t do any of the things the service needs to operate?
- hedora 6y agoReading through this, I’m ready for a spoiler. It says a few acceptable services exist. Which ones passed the author’s litmus test?
- newscracker 6y agoThe summary is linked right at the top of the post. Rise up and Disroot are the top choices, followed by Elude, Posteo and Countermail.
- opportune 6y agoOk so free email not only needs to have no ad or data monetization but also no analytics. That’s possible although I’m not actually sure you want to use a third party email service with no analytics since that means it will be hard for them to understand bugs and things of that nature. To me the requirement to not allow Tor or VPN with Captcha is just completely insane. So you’re expecting a free email service to have no monetization but also allow you to infinitely abuse its free services? Just host your own email rather than calling providers shit because they don’t allow unlimited abuse of their free email accounts (which can get them blacklisted). I do think it’s somewhat reasonable to expect Protonmail to be able to support a pro-privacy payment method like Monero to allow a “truly anonymous” sign up that at least costs money to prevent rampant spamming but at that point things are getting into “who cares” territory, as in, the company behind protonmail doesn’t give enough of a shit about the 48 users who would love to use the service if only they supported accounting creation via Tor and Monero to justify spending engineering or even legal time on making that work.
- upofadown 6y agoThis should really mention Mailvelope for those that insist on doing webmail. Only does inline PGP but that is the best you can do with a browser plugin. The guts of Mailvelope actually come from Protonmail (OpenPGP.js).