Ask GOS: email service provider

eggy

Tuta is a trash company that constantly spreads privacy and security misinformation. Why would you want to support such a company with your money?
As it stands, Proton is the best we've got in the privacy community. Everything else is unfortunately much worse unless you like juggling many services that you can get at a fraction of the price with Proton. Saying that, it's best not to put all your eggs into one basket and try not to use Proton services where there are already better free alternatives (ex. bitwarden over proton pass).

gristle-cause

lackofhumor Recently I stumbled upon mailbox.org and I kind of like it, but I do not know anyone that could give me a real or honest feedback

I would not recommend Mailbox.org, they have demonstrated enough security issues over a long enough period to cause concern. Here is a fairly decent starting point, a thread covering the past 18 months with links and discussion

I personally feel Tuta and Proton are the best games in town, Posteo gets an honorable mention

lackofhumor

AcclaimSublevel19 Also please remember that using [alias1@johndoe.com](mailto:alias1@johndoe.com) is not more private than [john.doe@gmail.com](mailto:john.doe@gmail.com).

This is a very important point for privacy. As for now, no domain I own contains any information about me, also the registrar (njal.la) is very privacy focused.

To be honest I still need an identifiable email address, there are some scenarios where a random alias or a nickname won't fit.

gristle-cause Here is a fairly decent starting point

Thank you for this, has been very insightful.

God having emails forward there from its own firefox relay account

Can you address what are the implications of using a relay account for emails?
I never used this service but I would think they somehow (can) have a copy of the emails (?)

Thank you very much for all of your input, they are very valuable
To be honest I am ok-ish with Tuta, I am also searching for the possibility to use a mailbox with some of my servers to send emails.

Being used with self hosting things I thought about having "yet another" service in my home lab and add the email service, but as someone pointed out, it will add complexity and I need to check for IP 'ranking' anyway.

As for now I think I will keep Tuta, it serves me well and the support has been good until now, even if I am still curious about new opportunities!

God

lackofhumor having an email for active use logins + having emails forward there from its own firefox relay account, dualy a second setup for single use logins is what I recommend (unique passwords aswell), minimizing your data with complete generalization in case of databreaches/handling of the service itself is a great way to secure yourself.

subwoofer

I am currently subscribed to Tuta and they host my domain for aliasing purposes.

The following are disappointing

The interface is very clunky eg if you multi select and delete emails it seems to try to refresh the display for each deletion which results in a scrambling mess until it's finished, and it's not even clear when it has finished.
The tools for using a custom domain for aliasing, considering their status as privacy/security kings are awful IMO. Eg there is no check or warning to stop you replying to an alias (which hasn't been preconfigured in tuta) using the wrong from address. This is a missing essential feature IMO, when you open an email the most natural thing is to bash out a reply and click send. Well for me it is and I've been caught out several times, originally replying from my main tuta email, which is the default default 🙄
Friction! Using the above example if you are someone smarter than me (likely) and notice that the alias you are about to reply to hasn't got a configured alias, instead of clicking a button to add one you have to navigate away from the email into the settings where the address alias facility is several clicks and some scrolling away, create the alias and then navigate back to the email to reply.
Other people. Most of them don't have secure email so even if they are still your friend after needing a password to read your email, what do they do with it? Copy it? Who knows. I've also had more than one financial organisation tell me they can't open encrypted emails due to their security policies.

So my position now is that I will prioritise functionality over supposed security / privacy. Currently in pole position for Tutas replacement is Fastmail.

As a footnote I'd like to add that Tuta are a great company to deal with, their support very responsive. I think it's a great shame they aren't focussed on becoming the specialist secure email service provider I thought they aspired to when I subscribed

AcclaimSublevel19

subwoofer Currently in pole position for Tutas replacement is Fastmail.

I've heard really good things about Fastmail and SimpleLogin. I don't know how they do with privacy though. SimpleLogin has the option to work as a relay, so you could make it work with your own server to gain some more privacy while self-hosting.

subwoofer

AcclaimSublevel19 I currently use SimpleLogin and Addy.io(paid) for aliasing. I have been tempted to configure Addy to use my custom domain as it would automatically generate "new"/aliases on the fly (as would simple login) but I'm put off by how messy my mailbox would look with the encoded addresses.
Fastmail provides masked and custom domain aliases which I believe replaces both tuta and Addy subscriptions.
Fastmail doesn't have the same privacy/security credentials as tuta but I've found in real life this isn't worth much where emails are concerned.

tux_

AcclaimSublevel19 You have to manage the mail server. Update the system and the server to address vulnerabilities, migrate configurations to new versions, handle backups, spam and you're also in charge of maintaining a secure configuration. Is it possible? Yes. By the time you can do all this, you'll know so much about email that you'll still want to avoid doing it.

As someone who operates their own email server, there is virtually no maintenance on something like Debian stable. There was a rather large initial setup cost because I chose to roll out everything from scratch using postfix/dovecot, but it's been trouble-free since.

But yes, you do absolutely need a clean fixed IP if you expect to send email reliably, or use an outbound relay. The privacy benefits are still immense if most of your email is inbound (and not coming or passing through Google or Outlook).

AcclaimSublevel19

tux_ As someone who operates their own email server, there is virtually no maintenance on something like Debian stable.

Yeah, I know. I've got a Debian VM with Mailcow running for a couple months. I haven't had the need to touch it much (although some times the spam filter is a little too aggressive and I have to tweak it).

tux_ The privacy benefits are still immense if most of your email is inbound

I was thinking of using mine for signing up to services (I can receive email just fine) but in case I need to recover an account, that's a problem for me.

TrustExecutor

PetePuk That's a reasonable explanation. Thank you for that.

« Previous Page