Choosing an Email Provider

Let's talk about what email provider you might want to use.

Now, this is completely dependent on what you need email for.

There is no one answer fits all.

Is it security, privacy, anonymity, pseudo anonymity.

You have to consider who is your adversary?

What is the threat?

How powerful are they?

What are the consequences?

So as usual with security, the solution is individual to the problem.

So if you are only concerned about hacking.

Then I actually recommend Gmail as Google takes security very seriously.

They offer two factor authentication, which you should use.

If you can then for storage and transport encryption on the backend, they provide anti-spam phishing and malware features.

They send notifications of logins with the location and the device time, you can monitor your account.

And if you look here, I may or may not remember the story, but they even overhauled their whole network.

After finding out that the NSA was snooping on the Gmail and they made a hundred percent of the, uh, messages moving internally, encrypted.

I personally use Gmail for so many emails as the security solution is good enough.

And I don't send emails with this account that are particularly private.

A nation state would get nothing from these emails.

And I use an email client, not web mail to avoid the tracking aspect of Gmail.

I also have Log into Google, via a browser to avoid the tracking.

So Gmail for security against a hacker is a reasonable solution.

Now, if corporate tracking and privacy concerns you, then all the major free providers should be avoided and that's especially Gmail.

And you know, and that includes you who apple, Microsoft, and say,

They are able to view your email and provide advertising based on the content.

They can track you across the internet.

This has minimized if you use an email client and not web mail, though, if an email service is free, they are either collecting your data and selling it to third parties for advertisement, or they are running some sort of charity via donations. you have two examples of those.

So rise up, which is this one and autistic or examples of the latter who were supported by charity or donations, etc.

So you need to find out how your provider makes money.

This will tell you if they're selling your data.

Read the terms and conditions and the privacy policy look for clear language and no legal nonsense.

If they've got legal ease, then, you know, forget about.

But with any email provider, even those who are proponents of security, privacy, and anonymity, as usual, we adopt the zero trust model and mitigate the risk using additional security controls.

Unless your email is encrypted end to end application to application your emails are not private.

You know, that. They will be readable by the provider or by requests from a nation state or the such legal authority, any solution where you are generating or using a private key within the web client, isn't safe.

You need to generate and use your private key in isolation, away from the functionality of any browser.

Some providers offer GPG or encryption of some sort and web mail integration.

Just be aware that performing encryption and decryption within a web client is not really zero trust.

As a provider could get access to your private key.

There was a hacker named max vision who was caught this way.

He was using an email provider.

The encryption was being dumb client side normally, but then the email provider changed the driver script.

So the NSA could access his email.

You want to provide a who claims to do only minimal logging for maybe debugging and for short durations, no ./Attribution information, especially IP address and timestamps and absolutely doesn't log things like browser fingerprint information.

As that is completely unnecessary, but of course you're not going to know what they do, but they should at least claim that they don't do it.

Now, there are some email providers that offer what they claim is zero knowledge for internal communication.

So I emails to, and from within the same provider, two examples of those that I'm aware of are ghost mail, which is these guys.

And you've also got Tutanota, I think that's how you say.

So Tutanota also allows the adding of a password and encryption for sending external email.

But because you entered this password in the browser using their code, they could determine the password.

It's not zero knowledge. Ghostmail has a self-destruction option for internal emails, but nothing stops someone from copying the email to prevent this from being useful.

But what these providers are offering is still good and will be good for most situations.

I'm just pointing out that these are not perfect solutions.

There are weaknesses here.

If you have an adversary of sufficient means, they will take advantage of these things.

I'm also hammering home the point here that if you really, really need privacy, then you should encrypt away from the email application with a key only, you know, and then paste it into your email client or application.

But obviously this isn't super convenient, but it is more secure.

Avoid providers and servers in countries where they are forced to log under their local data retention laws.

As we discussed in the section on VPNs.

So the EU does have data retention, laws and VAT laws that would mean email providers would have to retain information about your identity.

This is a complex issue. As I mentioned before, with some countries complying and others flat out refusing to complete.

As a link here, which is very good, which I provided in the section on VPNs as well, which you should look out, this will tell you what locations have mandatory data retention laws.

And obviously you may not want to go for one of those countries that has laws.

That mean they have to retain information that you don't really want them to retain in the EU.

And the following countries reject in some way, data retention, Bulgaria, Cyprus, Iceland, although that's not technically in Europe, Luxembourg, Netherlands, Romania, Serbia, Sweden, avoid using the email providers who are registered in or whose servers are in the jurisdiction of any nation state you wish to avoid or any adversary you wish to have.

I, if it's the United States server in Russia or China could work for you for reasons of spying and subpoenas companies and servers and jurisdictions of the five eyes should probably be avoided, including Australia, Canada, New Zealand, UK USA, and even the 14 eyes' countries.

I personally like Panama as a location.

Storing email encrypted would be preferable if the provider provides that that provides security against theft or seizure, ensure they use a secure cipher suite with perfect forward secrecy as we've discussed.

And you know how to test for.

If you access email via web mail, they should be able to pass the privacy test that we showed here.

Or otherwise you accept in the, every email you open is tracked back to the IP address.

You're presenting to the email provider.

If you use Thunderbird or other sorts of email client, this should be irrelevant as you should be disabling remote content.

They should accept Bitcoins cash or the anonymous forms of payment.

If you wish to be anonymous, also not really a security issue, but you need to consider cost and storage limits.

And perhaps whether or not you want to go for a free versus paid for service.

If you are paying when signing up, they should require only minimal information.

Things like username, password, or even less.

So no personal information should be required or recorded.

They shouldn't use external providers for support like Google apps or something like that. So information is then provided to a third party.

They should be accessible via non-matching service. You intend to use.

So Tor VPN. JonDonym, you have to make sure that they're accessible via one of those mechanisms.

Otherwise you're going to waste your money.

They should have physical control over their own servers and network dedicated servers in third-party data centers is fine, no shared virtual private servers or cloud servers.

The mail service should be high. No extra service should be running on the mail servers.

Like you don't want a web server running on the server.

If it should just have SMTP and iMac, no SSL, no [00:10:00] SSH to the public, etc, providing aliases is a great feature.

If they can provide. You can have, I, this is where you can have a number of different email addresses.

You can use this for isolation, use different emails for registering different accounts and for different registrations.

This helps prevent spam and hacking.

Now you can use one particular alias, what you register, where then you use another alias for say, for example, more private activity, check to see what their history is. Look at reviews.

Do they have a bad history?

Do they have a good history of providing a service?

Do they have any history of providing information to nation states is a service, a good service, a slow service.

Some providers allow you to use your own domain name.

You might want this service.

And also very important is do they offer access via an email client via imap, pop, SMTP, etc, or is it web mail or is it both?

Some do some don't here is a list of security focused email providers that I'm aware of, but please do do your own research, but this is a good list to start off.

A great site also for a breakdown of privacy conscious email services.

Is this one here? Which is probably a little bit small on your screen, but it has a breakdown of lots of different email providers here.

And then it provides a breakdown of all the various things that they offer, you know, links to their terms and conditions where they're located.

How much storage you get, do they take Bitcoins?

How much do they charge?

Do they have logs to the strip out IP addresses?

How good is their encryption?

You can see here, they've got the Qualys SSL test and you've got here a lot FPS, which is a perfect forward secrecy.

So, yeah, great site.

Another good site to check out.

Is this a Reddit thread, which was started about two years ago and it's sort of updated with information on secure email providers, but probably the best option for security and privacy for someone technical is to run your own mail server.

You can set up your own mail server at relatively little expense, given how much it is to get a virtual, private server or dedicated server or a Bulletproof dedicated server.

Obviously a dedicated server is better than any sort of virtualization.

The box would need to be fully hardened, security, hardened, and made resistant to snooping and hacking.

The problem is you need the technical expertise to set it up securely and correctly.

So it works. If you don't have the scale, you probably shouldn't attempt it.

You could pay for a provider to do this for you.

And another option is this here, which is mailing a box, which is an easier way of creating your own mail server.

You will need a server though, to put it on.

And if we read what this says, a box lets you become your own mail, service provider in a few easy steps.

It's sort of like making your own Gmail.

But when you control from top to bottom, technically mailing a box turns a fresh cloud computer into a working mail server, but you don't need to be a technical expert to set it up.

So this guy does really look like he knows what he's doing.

So this could be a good option for you.

So that's my tips on choosing an email provider.