Ask GOS: email service provider

lackofhumor

Good morning everyone,

I currently am a Tuta user.

I guess in this forum there is no big need to explain the reasons behind this choice, but if I had to be short I could over-simplify with: It's somewhat like Proton (which is probably more known to masses).

I am trying to understand if this is the correct service for me or not.

I would like to start saying that I believe that for the most part, one could argue that also gmail with gpg encryption is good enough, but you know, we are GOS users lol
Also, if we have to do a reality check, services online are not going to encrypt it for me, so having a service that is encrypting email, server-side is already a very good thing.
If, on top of that, they also allow me to send encrypted email to people that are not registered, even better.

I agree that emails would not be my primary way of communicating with people, but still, they are an important part of how most of the services are working right now, so instead to avoid them, I would like to make the best choice that fits my needs.

I have to add that I currently am NOT using any calendar/contacts feature from Tuta and I am not planning to change this, but I am open to try the syncronization to a different provider.

Recently I stumbled upon mailbox.org and I kind of like it, but I do not know anyone that could give me a real or honest feedback.
I guess this is the first question: Do you have any feedback to give me?
Everything is good: technical insight, practical usage feedback, you name it.

Second thing: I was thinking about hosting my email server.
I would like two different approaches.
First approach, kind of "old school", installing dovecot, postfix, rspamd and all the rest to have a full functional mail box.
Second approach, kind of newer approach, installing stalwart and let it manage everything.

I guess these four options are good for me:

Keep my Tuta account
Migrate to mailbox
Host my "old school" mail box
Host my "new school" mail box

Of course, if you are aware of another email service provider you would like to suggest, it's welcome :)

I would like to have also healthy criticism for every option, if possible.
Things like why Tuta or mailbox are bad choices or how hosting my mail box will fail lol

Thank you for your time, I am eager to know your 2 cents

God

lackofhumor Tuta mail is great, I would also recommend owning a domain and using private email aswell, what is your end goal?

AcclaimSublevel19

lackofhumor Second thing: I was thinking about hosting my email server.
I would like two different approaches.
First approach, kind of "old school", installing dovecot, postfix, rspamd and all the rest to have a full functional mail box.
Second approach, kind of newer approach, installing stalwart and let it manage everything.

As someone who has done a bit of research and actually tried this: it sounds both better and easier than it actually is. I won't go into full detail here, but for me at least here's how it compares to other solutions:
Benefits:

Full control over the mail server. You've verified it's secure and trusted. But email is still unencrypted and it will pass through a bunch of unencrypted relays before reaching the recipient (whose provider will happily read your email too and use it to "improve their services")
Depending on how many users you'd host for and what plan you'd normally be on on another provider, maybe it comes out cheaper? But then again domains and VPSes are expensive and if you host on your own hardware you've got a huge upfront equipment cost which will take years to pay off.

Drawbacks:

A couple decades ago, the email people™ decided that spam was annoying, so they created all sorts of blocklists to flag known spam servers, spam addresses, etc. It's extremely hard to get a mail server to be trusted by others. You have to make sure all your DKIM, DMARC and SPF records are good (I got them right fairly quickly but it takes some planning 😁). Depending on the IP you host from, you may already be on a blocklist, thanks to the previous VPS user with the same IP or just because you happen to be using a static IP and refuse to pay your ISP an extra $5/month for a static one, which you later find out is only available in business contracts. If you get past all that and try sending people a couple more emails than you should (as determined by the blackbox algorithms running in the world's mail servers) you'll get into a blocklist which will quickly propagate to every mail provider out there. You need to do a magic dance of starting out slowly, to make it trusted and whatever. Not fun.
Privacy? Goodbye. Everything is linked to your domain. It's a different thing to see two emails from Gmail and another to see two emails from a random domain which you happen to own. I can be much more confident you're the one behind both of them. Your domain is probably also linked in some way or other to your identity (you've either published it, linked your accounts there or at least given it to your domain registrar), so guess what can happen...
You have to manage the mail server. Update the system and the server to address vulnerabilities, migrate configurations to new versions, handle backups, spam and you're also in charge of maintaining a secure configuration. Is it possible? Yes. By the time you can do all this, you'll know so much about email that you'll still want to avoid doing it.

tl;dr: I wouldn't recommend it. It's too complicated and provides negligible benefits.

As for my own setup: I got a VM with Mailcow running on my server. I set everything up but all my email is rejected just because I have a dynamic IP. I can still receive emails though. I've just left it running there and haven't ever seriously used it. It's a good all-in-one solution if you want it though. Should be better than manually configuring Postfix, Dovecot, RSpamd and co.

PetePuk

lackofhumor I guess the most important thing is that I miss what you're looking for exactly. The only thing I can read is that you'd like to be able to send encrypted emails. If that's the only demand then you're settled.

Personally I have Proton for a variety of reasons. I'll tell you my considerations.

I guess it depends on who you're trying to protect yourself from. There are 3 kind of threats: malicious private parties/hackers, commercial parties trying to invade your privacy and state actors. Because of where I live and where Proton resides state actors are the least of my concern as I am not a criminal and we have laws to protect human rights. Even though Switzerland might pass a law that will force parties like Proton to modify the implementation of their encryption due to more surveillance capabilities...But as for now I trust state actors more than the others.
Client side encryption: this is an important one for me. Being sure noone else can (easily) access my data. Combined with open source and auditing this is a major one for me. Tuta does that too. But most emailproviders don't have client side encryption.
Self hosting: this could have been an alternative to client side encryption. A server with full disk encryption that I have the key from. This, however requires a large amount of maintenance, not lastly in terms of security. I either have to do it on my own internet connection, meaning I rely on VPN for my email to work outside of the house, or rent a server which also costs money and hugely increases the attack vector of any malicious parties.
Location of hoster: I trust European hosters more than, let's say, a Russian or Chinese company. Or US for that matter. So I chose European.
Geopolitical considerations: seeing how the USA is sliding to a form of authoritarion-light but also owning most influencial tech companies, I attribute great value to indepence of the EU even more than before. That means giving my money and supporting local companies. Proton is relatively local to me. We need parties to become a viable alternative to companies from outside the EU.
Ecosystem: ecosystems provide enhanced usability and comfort through integration between applications. They also cause at least some form of vendor lock in. But I can't do everything myself so in this case I decided I'm valueing the comfort above not having any vendor lock in. Also, considering the previous point we need an alternative to Google app suite and Microsoft Office. If everyone chooses a small party which offers just 1 solution that alternative will probably never be. Yes, theoretically and technically it shouldn't be a problem if applications use well developed API's to give access to eachothers applications. Commercial reality will probably prevent that from ever coming to fruition.
Time: as said, I can't do everything myself. I have a family and aa job. There is no absolute privacy and security. The question is, what do you find best to put emphasis on in your particular situation. Human rights activists in Iran will not care for privacy invasion by Google and I also think hackers will be of less concern. The state actor is by far the biggest threat. It would be better to store your email at Google than your own server in house. Just an example.

For my personal situation:

Free e-mail - hell no. I do not want any company to be able to access my e-mail. Privacy invasion is a big concern for me and all email providers with decent size email boxes are not client side encrypted. Mostly ulnerable to privacy invasion and state actors.
Self hosted at my own property - either only accessible by VPN or I have to expose a server to the internet. Both are maintenance intensive and especially the latter option is a concern due to the possibility of being hacked. It's an attack surface that me as an amateur would need to secure. I think commercial parties will do a better job of preventing that. Come to think of it, I do not have any backup in case Proton ever gets attacked. Something to think about. But mostly vulnerable to hackers, less so to state actors if server is encrypted.
Self hosted at a data center - costs money every month just like a service provider like Proton and Tuta, needs maintenance and also has the same attack surface that I'd need to take care of. Mostly vulnerable to hackers, less so to state actors if server is encrypted.
Hosted solution like managed NextCloud instance - maintenance is taken care of so that's a plus. It's easy to choose a party local to you. Privacy invasion should be less of a concern as scanning your data is not really part of the agreement. There is no absolute guarantee that they won't look into your data but I think privacy concern is the least risk in this construction. Since your instance is exposed to internet there is a big attack surface but one could at least expect that software like Nextcloud is decent in security. Still, having your data encrypted renders your data unusable even to hackers and state actors. For this reason I decided against this option. I would mostly be concerned with hacking and state actors as hackers can read your data when hacked and state actors.
Payed not client side encrypted provider - this speaks for itself I think, privacy concerns. State actors are also a concern.
Track record of service provider - Proton has shown that it really doesn't store much information. The only time they did that was AFTER they got a court order, they started logging ip addresses of that 1 user only. That's not something I am concerned about as I think we need a justice system and a reasonable amount of authority to go with that. I like anonimity but I also like a safe society. It's a checks and balances act. If a prosecutor can prove to a judge that there is good reason to capture data then I think it's not something negative. I do not long for a provider that operates completely outside of our justice system. In case there is a provider that is, I would not be sure of their integrity and if they respect my privacy.
Support a growing eco system to become an alternative to USA big tech.
The comfort of an eco system with several integrated services that I use, such as e-mail, VPN, client side encrypted file storage, email aliases etcetera. I'll take some vendor lock in for granted to save a lot if time and hassle. I do a lot of stuff myself (not only digital) so I have to cut corners in some ways. This is one of them.

Assumptions:

When talking about hackers I talk about malicious parties. Obviously state hackers can also hack. By state actors I meant the state applying more classic methods of obtaining your data like seizing and court orders.
Where I live digital human rights are reasonably protected, at least a lot better than most parts of the world. Therefor I have put my priorities with the other 2 type of threats.
You will never be able to fully mitigate all risks. When considering the reasonable, viable options, I think you need to prioritize what risks are top priority for you. Then choose the option that fits best. Or even consider wether e-mail is the right medium at all.

gristle-cause

lackofhumor Recently I stumbled upon mailbox.org and I kind of like it, but I do not know anyone that could give me a real or honest feedback

I would not recommend Mailbox.org, they have demonstrated enough security issues over a long enough period to cause concern. Here is a fairly decent starting point, a thread covering the past 18 months with links and discussion

I personally feel Tuta and Proton are the best games in town, Posteo gets an honorable mention

lackofhumor

God

There are two main reasons, one is practical and one is "religious".

The practical one is the lack of bridges to use Tuta with other services (like a selfhosted vaultwarden or a selfhosted Nextcloud, etc.).
I would argue that this is actually a security feature, but alas it also falls under user experience semantics, because suddenly I need a different email service to achieve the same result.

The "religious" one is what they are publishing recently and how they are leaving out GOS from the equation in favor of other OSes.
I know it might be silly, and probably is, but I think that they kind of did that on purpose at a certain point, and on my mind it started to be a matter of principle... We are irrational beings, we cannot fight that lol

A smaller technical reason is that some websites (rarely) are not accepting Tuta.
My mobile service provider forced me to use my old gmail account, for example.

Overall I am happy with Tuta, but I would gladly take into consideration other services if they solve these little things for me, even if they are silly :)
There's always space for improvement.

If, on top of that, mailbox (or another email provider) can achieve the same for less money, it's welcome lol

Johnnyloans

lackofhumor The "religious" one is what they are publishing recently and how they are leaving out GOS from the equation in favor of other OSes.

What is going on with this? I am out of the loop.

God

lackofhumor Instead of providing your tuta mail or any mail directly to a service, I would recommend using firefox relay (random string forwarding mail), and of course a VPN together to mitigate the danger of db leaks.

God

Johnnyloans Also curious about this, source lackofhumor?

userofgos

Johnnyloans

God

See this Mastodon thread: https://grapheneos.social/@GrapheneOS/115827564704231822. There was a forum thread on this which included a different Mastodon thread but I can't seem to find it.

Edit: found the forum thread: https://discuss.grapheneos.org/d/30357-does-tuta-have-major-security-issues

lackofhumor

I am sorry about all the fuss, I specifically underlined that the "religious" reason is silly, even if it there with other more tangible reasons, like the lack of bridges, and Tuta not being accepted everywhere.

Johnnyloans What is going on with this?

God Also curious about this, source lackofhumor?

I guess @userofgos already covered the story.
The only thing I would add is:
The real problem is not Tuta skipping GrapheneOS from the list of reccomendations, but including alternatives that are not that privacy friendly.
This could give a better insight on how they think of privacy and/or commercial agreements.

Johnnyloans It could have been edited after.

This, plus some posts deleted, make the story a little bit different, if you lost the original messages it is hard to prove it now, I could not find copies in Wayback Machine either.

That said, please let's move on and try to focus on the technical aspect of the question.
The thread is still valid without all of this, reason why I didn't include it in the first post in the first place lol

God i would recommend privateemail.com and a firefox relay setup

Do you have any first hand experiences or some good readsabout that I can use?

AcclaimSublevel19 But email is still unencrypted and it will pass through a bunch of unencrypted relays before reaching the recipient

This is true also if I send an unencrypted email from Tuta, which unfortunately sometimes (more often than I would like) I have to do, because the average user usually complains about what they receive from Tuta, sometimes they think it's phishing...

To be fair, emails today are not emails from the 90s and now there is encryption between transfer agents (almost everywhere). I get how every agent can get a cleartext copy, tho.

Thank you for your insight, I will definetly look into Mailcow.

I was hoping also to have someone that could explain me a little bit better what privacy concerns should I have in having my own server (let's say in my home) with server encryption instead of having a paid service like Proton, Tuta or Mailbox.

Also, if anyone has experienced Mailbox, I am eager to hear about that, thank you :)

God

userofgos It looks like tuta mail and its apps will work on gos regardless of the back and forth gos and tuta had, is there any reason to hold that in regard?

userofgos

God It looks like tuta mail and its apps will work on gos regardless of the back and forth gos and tuta had

Yes this is true.

God is there any reason to hold that in regard?

Not sure what you mean

God

userofgos as in what reason does it hold over your use of tuta products?

Johnnyloans

Tuta

Ready to #deGoogle 💯 per cent?

Note: 100%

Tuta

Good morning, we explicitly mentioned GrapheneOS because it is one of the most secure options out there - but running on a Pixel, we can't really call it deGoogle, that's why it didn't get more space in the article. In any case, we'd like to change anything that's wrong in this article about GrapheneOS so please let us know what we should update. Thanks.

Seems fair enough. Just as the devs say: "people use GOS for different things and have different threat models."

Tuta in, seemingly, 1 article can have their opinion that giving money to google isnt a 100% degoogle. Just as people with GOS could install every spyware imaginable or be FOSS pure.

Can't get pissed about every outlet that doesn't glaze you. Some will rate 3 stars or 5 stars. It's life.

Tuta has an infographic with grapheneos as the first option for an alternative to android.

We dont have to crucify Tuta over this. Every company is "evil" in some way. You can't boycott the entire world because everyone didn't do what you'd do or did a greedy, business move or whatever.

If the other suggestions are a scam, insecure, not private, etc. It is fine to point that out.

userofgos

Johnnyloans Sure everyone, including companies are entitled to their own opinion but companies that are in the privacy and security space should be held to a higher standard.

Johnnyloans

Johnnyloans Can't get pissed about every outlet that doesn't glaze you.

I spoke before reading the tuta article. It could have been edited after.

After a 2 paragraph intro, they speak highly of grapheneos, and then get into the rest of it.

They even say grapheneos has the best app compatibility out of everyone. They said it isn't a headliner in this article because you pay google for Google hardware so not a 100% degoogle but GOS is getting a new OEM.

Grapheneos just didn't get on the cover.

God

userofgos If you want to avoid tutamail due to that then i would recommend privateemail.com and a firefox relay setup, although if you're looking to prevent the mail server from reading contents, you'd need to setup PGP.

userofgos

God I appreciate the recommendation, however I was not looking for one. Just providing additional context to what the OP mentioned which both you and @Johnnyloans asked for. :)

God

userofgos my misunderstanding, I had confused your username with OPs.

tux_

AcclaimSublevel19 You have to manage the mail server. Update the system and the server to address vulnerabilities, migrate configurations to new versions, handle backups, spam and you're also in charge of maintaining a secure configuration. Is it possible? Yes. By the time you can do all this, you'll know so much about email that you'll still want to avoid doing it.

As someone who operates their own email server, there is virtually no maintenance on something like Debian stable. There was a rather large initial setup cost because I chose to roll out everything from scratch using postfix/dovecot, but it's been trouble-free since.

But yes, you do absolutely need a clean fixed IP if you expect to send email reliably, or use an outbound relay. The privacy benefits are still immense if most of your email is inbound (and not coming or passing through Google or Outlook).

TrustExecutor

PetePuk That's a reasonable explanation. Thank you for that.

AcclaimSublevel19

lackofhumor I was hoping also to have someone that could explain me a little bit better what privacy concerns should I have in having my own server (let's say in my home) with server encryption instead of having a paid service like Proton, Tuta or Mailbox.

I do not know much about email encryption, but I'm fairly sure the providers who advertise privacy have taken a careful look at their server security settings and will make sure the email is encrypted wherever possible. Also please remember that using alias1@johndoe.com is not more private than john.doe@gmail.com.

God

lackofhumor having an email for active use logins + having emails forward there from its own firefox relay account, dualy a second setup for single use logins is what I recommend (unique passwords aswell), minimizing your data with complete generalization in case of databreaches/handling of the service itself is a great way to secure yourself.

lackofhumor

AcclaimSublevel19 Also please remember that using [alias1@johndoe.com](mailto:alias1@johndoe.com) is not more private than [john.doe@gmail.com](mailto:john.doe@gmail.com).

This is a very important point for privacy. As for now, no domain I own contains any information about me, also the registrar (njal.la) is very privacy focused.

To be honest I still need an identifiable email address, there are some scenarios where a random alias or a nickname won't fit.

gristle-cause Here is a fairly decent starting point

Thank you for this, has been very insightful.

God having emails forward there from its own firefox relay account

Can you address what are the implications of using a relay account for emails?
I never used this service but I would think they somehow (can) have a copy of the emails (?)

Thank you very much for all of your input, they are very valuable
To be honest I am ok-ish with Tuta, I am also searching for the possibility to use a mailbox with some of my servers to send emails.

Being used with self hosting things I thought about having "yet another" service in my home lab and add the email service, but as someone pointed out, it will add complexity and I need to check for IP 'ranking' anyway.

As for now I think I will keep Tuta, it serves me well and the support has been good until now, even if I am still curious about new opportunities!