8 ms·

1. Rich webmail is an absolute must for me. I use too many different computers from too many different places for anything else to be remotely practical at this

• pavel_lishin 15y ago
  > 2. No open source webmail servers that I've seen come close to Gmail's functionality, and I don't have time to write one that is. Obligatory comment pointing out an opportunity for disruption, etc., why aren't we all millionaires., etc. etc.
  • Arelius 15y ago
    I'm not sure that an open source webmail is an easy way to become a millionaire. =P
  • mseebach 15y ago
    Because not even "extremely security and privacy aware" hackers care enough to use it. That said, Zimbra is pretty bloody decent.
  • rgrieselhuber 15y ago
    The business model isn't there. I have yet to see a large group of consumers willing to pay for secure email and the only other alternative, advertising, leads to the exact same problem that you face with GMail.
    • atdt 15y ago
      I would pay and so would many others.
      • ansy 15y ago
        That seems to imply you don't already. There are lots of paid email services that don't monetize user's emails. And many that are hosted outside the United States. For the extremely vigilant, there is always CounterMail https://countermail.com/ https://countermail.com/ The threat of email interruption and snooping can't be completely avoided. Undersea cables get cut, governments change, servers crash, data centers get raided, and companies disappear. At some point the data gets decrypted and everything is retrievable unless you are any extremely hard core PGP user. Even HushMail has to bend to the feds when it's all said and done. Even savvy people realize paranoia only gets you so far with email.
    • mrschwabe 15y ago
      +1 for willing to pay for secure email.
      • rdtsc 15y ago
        Ok that's 2 customers who are also HNers. I think you'd need to do better than that. We are hardly a representative of the general consumer. There is another problem, US govt' need to get access all these messages. For example http://en.wikipedia.org/wiki/Hushmail http://en.wikipedia.org/wiki/Hushmail, people seemed to have signed up, but Hushmail was forced to provide plaintext messages to US govt upon request. So they sort of compromised their main selling point. That is probably the largest problem, you'd be stuck between a rock and a hard place. You either please your security conscious customers or please Uncle Sam. You can't please both.
        • Zirro 15y ago
          "There is another problem, US govt' need to get access all these messages." You're assuming the service has to be located within the US. Why?
          • rdtsc 15y ago
            It doesn't have to, but unless it is located in Iran, NK or other US-unfriendly place, US govt can always pressure the local govt to pressure the local business to turn things over. I wouldn't, for example, count on countries like Switzerland, US is already getting to its banks to turn over US accounts, and is supposed to be one of the most independent and un-influenced countries. With the current legislation trend, eventually un-cooperative or "terrorist friendly" sites would just be filtered out and blocked, so you might have a hard time accessing your email. Some messages might never make it to you.
            • pyre 15y ago
              > US govt can always pressure the local govt That depends. In some places, the privacy laws are better than in the US. You would just have to choose wisely.
    • mike-cardwell 15y ago
      Hushmail would disagree - https://www.hushmail.com/ https://www.hushmail.com/
      • acavailhez 15y ago
        Nice to know, thanks for the tip Did you try it and can compare it to gmail? Especially on: - linking other accounts (POP and IMAPS) - spam detection
        • mike-cardwell 15y ago
          I actually host my own email. I developed an open source application for automatically encrypting all email with my public key as soon as it arrives, and I can't do this if somebody else hosts my email. You can read why and how here: https://grepular.com/Automatically_Encrypting_all_Incoming_Email https://grepular.com/Automatically_Encrypting_all_Incoming_E...
          • erikano 15y ago
            Brilliant! Thank you for sharing the post and code. I'd be interested in hearing thoughts on how to make it searchable. If you don't index, searching will take quite some time. I guess the best thing to do would be to index each e-mail (keywords?) before it is encrypted and then encrypt the index itself as well. There is a problem with the keyword approach though - if the index encrypts the words but the "link" between message id and encrypted keywords is not encrypted, then an attacker who is in posession of one or several other message bodies in plain text can see correlations between the content of known and unknown message bodies.
    • pyre 15y ago
      > advertising, leads to the exact same problem > that you face with GMail. Not necessarily. For some people that largest factor is that Gmail brings all of your email under US jurisdiction. It may be enough to just do advertising-funded Gmail clone that is solely based out of another jurisdiction. You may even be able to convince non-US businesses that this is a better alternative.
  • joejohnson 15y ago
    I would gladly switch to a different webmail provider (and pay a decent amount for this service) if they could replicate all of the benefits of gmail.
    • tonyarkles 15y ago
      As a curiosity, what is "a decent amount"? $5/mo? $10/mo? More?
      • joejohnson 15y ago
        I would probably pay $200-$300/year, so maybe $15-25/month if this hypothetical service could completely match gmail in features.
        • tonyarkles 15y ago
          I'd be really curious to see what Google makes off the advertisements served up in Gmail, compared to this price.
  • pavel_lishin 15y ago
    By the way, I meant someone creating an application you could install locally, instead of just being a gmail clone hosting everyone's e-mail at once.
• moreorless 15y ago
  There is Zimbra. http://www.zimbra.com/products/zimbra-open-source.html http://www.zimbra.com/products/zimbra-open-source.html
  • vetinari 15y ago
    Zimbra has a very heavy feel (it is more Outlook than usable client) and the mobile support is not a part of the open source edition.
  • eropple 15y ago
    We use Zimbra at work. I'd have a hard time recommending it unless you really, really want 80% of Exchange and 40% of the usability. (Outlook Web Access is still the only webmail client I've found that is in GMail's ballpark. Since running an Exchange server is beyond my skillset, my interest, and my budget, and trusting a managed Exchange host feels odd--at that point I might as well just stick with GMail. So I do. Google isn't going to find anything particularly interesting about me by my mail, anyway.)
    • tripzilch 15y ago
      Because if you got nothing to hide, you got nothing to fear! Yay!
      • eropple 15y ago
        A mischaracterization (and, given your tone, probably intentionally so). A useful mail system has value to me. It outweighs the (in my mind vastly overhyped) dangers of Google doing something nefarious with my data. If you disagree, you're welcome to run your own mail server. Nobody's stopping you.
    • a_a_r_o_n 15y ago
      "[Gmail/Facebook/USGov/etc] isn't going to find anything particularly interesting about me by my mail, anyway." There are two problems here: 1. We look at our data from our point of view. Other people and orgs have their own points of view, and it's their actions driven by their points of view that we need to worry and think about. For example, you think your mail is uninteresting, yet Google enhances the value of their ads by correlating your interests with the interests in your communication network. Government surveillance can also learn a lot just by recording and analyzing who you talk to. When a law enforcement agency cannot get a full wiretap warrant, they will sometimes settle for a pen register, which just records the telephone numbers of your calls. This allows them to find out who you know, and who you talk to the most. This lets them form more detailed opinions about you and your known associates, which may or may not be accurate. You know, like Google does for ads. https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register Oh, you're just not that interesting to the government? 2. Innocent behavior being observed by the government is enough to disrupt your life in minor and major ways. Consider the British couple that was recently denied entry to the United States, merely because their tweets contained boisterous comments about destroying the US (i.e. partying really hard), and digging up Marilyn Monroe's grave. Imagine if they had used the British slang term "crack." https://en.wikipedia.org/wiki/Champers#C https://en.wikipedia.org/wiki/Champers#C It takes nothing more than mere notice to disrupt your life. If you innocently have communication with someone who in turn has communication with a "person of interest," you could find your car carrying a GPS. Just from noting communication networks, never mind the communication content. I'm not trying to go all tinfoil hat, I'm just suggesting that your view of your data is completely different from corporate and government's view of your data. You could be served an ad (horror!), or you could be served a warrant (horror), based on accurate or mistaken interpretation of any facet of your communication.
• nupark2 15y ago
  > 1. Rich webmail is an absolute must for me. I use too many different computers from too many different places for anything else to be remotely practical at this point. That's what IMAP is for. If these are computers you don't directly control, then I'd say any downsides of using gmail pale in comparison to the security implications inherent in your usage model. [edit] Can't say I understand the negative downvotes. Maybe I inadvertently denigrated people's preference for webmail over mutt/mail.app/etc? Regardless, the fact is that if you're utilizing webmail for remote e-mail access on shared computers, then there are much more significant risk scenarios at play than those of gmail.
  • lukev 15y ago
    Secure webmail access over HTTPS is in theory just as strong as IMAP access can be made to be. Of course, by using untrusted hardware you are exposing yourself to various circumventions of the security protocols, but that's just as true of IMAP as it is of HTTPS. In fact, IMAP is probably slightly worse since it does actually download messages to the local machine by default, where they must be explicitly cleaned up.