3 ms·

I got into a discussion at IETF with some people over email security a few years ago. The reality is, email was invented in the 70s. It’s missing all the modern

I got into a discussion at IETF with some people over email security a few years ago. The reality is, email was invented in the 70s. It’s missing all the modern messaging related crypto innovations (E2E security, signing, encryption, otr messaging, etc). And there’s very little interest amongst the big email providers in overhauling email to add these features. Even if some niche email providers have good security, if the person you’re communicating with uses gmail or something you’re still screwed. If you want a communications system that’s safe from government snooping, don’t use email. Stick to signal or maybe WhatsApp. Or if you must, self host. At least then the court order to see your server will come to you.

WithinReason 3y ago
Protonmail is perfectly safe (for now) as long as you use it through Tor (https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...) or a VPN so they don't log your IP and don't provide real recovery information.
- super256 3y ago
  Have you tried registering an account on proton via Tor? I get a prompt to verify my phone number or give them a recovery mail (trash mailers are blocked) 99% of the time.
  - zhfliz 3y ago
    it might have changed recently but i have previously created accounts by providing trash mailer addresses during creation.
- bharathyes 3y ago
  do they not verify the recovery email before account activation? how do you not provide a real recovery mail?
  - m00dy 3y ago
    you can get around by using disposible mail services.
    - flotzam 3y ago
      No, those are generally blacklisted by Proton.
  - WithinReason 3y ago
    You can remove the recovery info after registration.
  - pepa65 3y ago
    Get a free domainname, set up a mail server and receive your confirmation email. Then switch to a recovery phrase, get rid of the whole domainname.
- m00dy 3y ago
  so, the question is here how safe tor is.
- josephg 3y ago
  Its only safe if you're only talking to other people who also use protonmail. (Ideally also through tor.). As soon as your email thread includes people on gmail, the government can just ask them for the email thread. And if you're restricting your conversation to people on protonmail for security, why bother with email at all? Seems easier to just put the conversation on signal anyway. And then you get all of signal's other security benefits, like E2E encryption, crypto ratcheting, disappearing messages and so on.
- flotzam 3y ago
  It is not possible to sign up over Tor (neither through their .onion nor through proton.me) without providing a non-disposable verification email address or a non-cryptocurrency payment method. This second restriction is especially damning: They accept cryptocurrency, but only for existing accounts - after you've already doxxed yourself.
2Gkashmiri 3y ago
i self host email now. for the past 3 years. It's been relatively painless experience so i can only sing praises. The idea that "as the webmaster of the email server, i could get a notice and i can conveniently, confidently say "fuck off" sounds fun". This isn't about protecting pedos or serious bad people but dmca nonsense or such "legal requests" that you are confident you can say no.
- john_minsk 3y ago
  For a very long time I saw articles on self hosting, where people complain that their emails are filtered out by big providers and it is no longer feasible. How do you deal with this part?
  - cfn 3y ago
    The easiest way is to use an SMTP service like smtp2go to send the emails but I am not sure if it invalidates the point (you still host the email server, just not the SMTP side).
    - 2Gkashmiri 3y ago
      this is useful for doing mailing lists delivery and other mass email stuff. for regular office/personal use, self-hosted email works fine
      - cfn 3y ago
        I run my own self-hosted email server for the last 15 years but I had to move to this hybrid system recently because Microsoft (outlook.com, hotmail.com, etc) blocked all the IPs of my hosting company. It is a shame but there's no point appealing (which I tried anyway). So it may or may not work, it depends on luck mostly.
  - 2Gkashmiri 3y ago
    yes. i will give you my personal experience from 3 years ago and last month. 3 years ago: gmail/outlook was an ass. They marked all emails as spam. I had to call recipients to check spam and mark as not spam. this was on-off for the first few months. then things went good on their own. They would mark spam initially all emails, then emails with attachments then once marked as not spam, things got better. today i have 0 issues in outgoing email. funnily, i have a website that sends me emails and there is some unknown problem on "receiving emails". just one website so haven't had much look into it. last month: followed the same setup and gmail/outlook made no complaints. this was surprising to me as i deliberately sent attachments but nothing. one thing to note. i once send 15-20 mails in bulk (not cc/bcc but separate) at once and that triggered some spam response. marked as not spam fixed it though on recipient side. both times i used mailinabox and a cheap vps from lowendbox deals. racknerd or something on offer. takes 1 hour almost from domain/vps purchase to full setup and sending emails. backup on backblaze b2. takes 5 minutes every 6 odd months to update the software but that's about it.
IndySun 3y ago
>Stick to signal or maybe WhatsApp Or Session?
- josephg 3y ago
  I just googled that to be polite. Looks like signal, except missing all my contacts. What advantage does Session have over signal that might make it worth moving my social network?
  - bongobingo1 3y ago
    I believe session does not require a phone number to create an account, vs signal which (from memory) does which has privacy implications.
  - IndySun 3y ago
    No phone number or email to use Session. Session is a fork of Signal. Each communication is decentralised. My biggest concern is they are based in Australia, which has even worse backdoor baying for blood than USA. Some details here. https://optf.ngo/ https://optf.ngo/ (typo - wrong link corrected)
zoobab 3y ago
You forgot mixing. Even with E2E encryption, 5 eyes could still capture traffic metadata and identify who is talking to who.
yomlica8 3y ago
Those services require coughing up your phone number to use. And since recovery emails are apparently the weakness used in proton's case, not the encryption of the mailbox, that sounds worse.
- protonmail 3y ago
  You don't have to have a recovery method on your Proton account, it's optional. You can also use a recovery phrase instead of having a recovery email on your account: https://proton.me/support/set-account-recovery-methods https://proton.me/support/set-account-recovery-methods.

WithinReason 3y ago

Protonmail is perfectly safe (for now) as long as you use it through Tor (https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...) or a VPN so they don't log your IP and don't provide real recovery information.

super256 3y ago
Have you tried registering an account on proton via Tor? I get a prompt to verify my phone number or give them a recovery mail (trash mailers are blocked) 99% of the time.
- zhfliz 3y ago
  it might have changed recently but i have previously created accounts by providing trash mailer addresses during creation.
bharathyes 3y ago
do they not verify the recovery email before account activation? how do you not provide a real recovery mail?
- m00dy 3y ago
  you can get around by using disposible mail services.
  - flotzam 3y ago
    No, those are generally blacklisted by Proton.
- WithinReason 3y ago
  You can remove the recovery info after registration.
- pepa65 3y ago
  Get a free domainname, set up a mail server and receive your confirmation email. Then switch to a recovery phrase, get rid of the whole domainname.
m00dy 3y ago
so, the question is here how safe tor is.
josephg 3y ago
Its only safe if you're only talking to other people who also use protonmail. (Ideally also through tor.). As soon as your email thread includes people on gmail, the government can just ask them for the email thread. And if you're restricting your conversation to people on protonmail for security, why bother with email at all? Seems easier to just put the conversation on signal anyway. And then you get all of signal's other security benefits, like E2E encryption, crypto ratcheting, disappearing messages and so on.
flotzam 3y ago
It is not possible to sign up over Tor (neither through their .onion nor through proton.me) without providing a non-disposable verification email address or a non-cryptocurrency payment method. This second restriction is especially damning: They accept cryptocurrency, but only for existing accounts - after you've already doxxed yourself.

2Gkashmiri 3y ago

i self host email now. for the past 3 years. It's been relatively painless experience so i can only sing praises. The idea that "as the webmaster of the email server, i could get a notice and i can conveniently, confidently say "fuck off" sounds fun". This isn't about protecting pedos or serious bad people but dmca nonsense or such "legal requests" that you are confident you can say no.

john_minsk 3y ago
For a very long time I saw articles on self hosting, where people complain that their emails are filtered out by big providers and it is no longer feasible. How do you deal with this part?
- cfn 3y ago
  The easiest way is to use an SMTP service like smtp2go to send the emails but I am not sure if it invalidates the point (you still host the email server, just not the SMTP side).
  - 2Gkashmiri 3y ago
    this is useful for doing mailing lists delivery and other mass email stuff. for regular office/personal use, self-hosted email works fine
    - cfn 3y ago
      I run my own self-hosted email server for the last 15 years but I had to move to this hybrid system recently because Microsoft (outlook.com, hotmail.com, etc) blocked all the IPs of my hosting company. It is a shame but there's no point appealing (which I tried anyway). So it may or may not work, it depends on luck mostly.
- 2Gkashmiri 3y ago
  yes. i will give you my personal experience from 3 years ago and last month. 3 years ago: gmail/outlook was an ass. They marked all emails as spam. I had to call recipients to check spam and mark as not spam. this was on-off for the first few months. then things went good on their own. They would mark spam initially all emails, then emails with attachments then once marked as not spam, things got better. today i have 0 issues in outgoing email. funnily, i have a website that sends me emails and there is some unknown problem on "receiving emails". just one website so haven't had much look into it. last month: followed the same setup and gmail/outlook made no complaints. this was surprising to me as i deliberately sent attachments but nothing. one thing to note. i once send 15-20 mails in bulk (not cc/bcc but separate) at once and that triggered some spam response. marked as not spam fixed it though on recipient side. both times i used mailinabox and a cheap vps from lowendbox deals. racknerd or something on offer. takes 1 hour almost from domain/vps purchase to full setup and sending emails. backup on backblaze b2. takes 5 minutes every 6 odd months to update the software but that's about it.

IndySun 3y ago

>Stick to signal or maybe WhatsApp Or Session?

josephg 3y ago
I just googled that to be polite. Looks like signal, except missing all my contacts. What advantage does Session have over signal that might make it worth moving my social network?
- bongobingo1 3y ago
  I believe session does not require a phone number to create an account, vs signal which (from memory) does which has privacy implications.
- IndySun 3y ago
  No phone number or email to use Session. Session is a fork of Signal. Each communication is decentralised. My biggest concern is they are based in Australia, which has even worse backdoor baying for blood than USA. Some details here. https://optf.ngo/ https://optf.ngo/ (typo - wrong link corrected)

zoobab 3y ago

You forgot mixing. Even with E2E encryption, 5 eyes could still capture traffic metadata and identify who is talking to who.

yomlica8 3y ago

Those services require coughing up your phone number to use. And since recovery emails are apparently the weakness used in proton's case, not the encryption of the mailbox, that sounds worse.

protonmail 3y ago
You don't have to have a recovery method on your Proton account, it's optional. You can also use a recovery phrase instead of having a recovery email on your account: https://proton.me/support/set-account-recovery-methods https://proton.me/support/set-account-recovery-methods.