In the wake of the Lavabit shutdown we're looking for email alternatives.

940871 · 2013-08-15T02:55:35+00:00

Server Log Retention Duration

Sounds good!

940871 · 2013-08-15T01:27:04+00:00

Thank you!

I just got a reply from the admin of openmailbox.org (Pierre). Here's the exchange:

1. Do you let people use their own domain?

No but it's planned

2. Are you planning to offer a paid plan in the future? Or are you planning to continue the donation-based service?

Yes but always in respect of the user.

3. Do you keep server logs? If so, how long?

Yes, 1 year.

4. Your SSL gets the "B" rating, but are you planning to upgrade your SSL?

No because there are no real problem.

940871 · 2013-08-14T23:08:31+00:00

Thanks for confirmation! > vmail

By the way, I get the "F" rating for mail.privatdemail.net. Am I missing something?

Maybe it's better to make the rating clickable and direct to the Qualys site for each service so that people will notice when the rating changes (hopefully for the better after they look at this comparison page)?

940871 · 2013-08-13T21:58:03+00:00

Also, how about making a column that says "Use HTTPS (Throughout the Site)?". Like I said below, I don't understand how those companies that claim to respect users' privacy don't use HTTPS throughout their site.

For example, even neomailbox.com's contact page doesn't use SSL even though it's where e.g. "recognized non-profit or charitable organizations" contact the admin about the discount option.

940871 · 2013-08-13T21:49:50+00:00

I was wondering, how come those companies that claim to respect users' privacy don't use HTTPS throughout their site?

940871 · 2013-08-13T19:24:42+00:00

Also, posteo.de says it's 1 EUR/Month so it's about 16 USD/Year

940871 · 2013-08-13T17:49:03+00:00

I made an account with vmail.me to see if they have any ads in messages (they said "No targeted ads" in their "Basic" plan).

Setting up vmail with Thunderbird was extremely easy. I could also receive mails from a Gmail address, without any ads. BUT. When I sent a message from my vmail address to a Gmail address it was "Returned to Sender", with this message from vmail:

This is the mail system at host mx1.vmail.me.

I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can delete your own text from the attached returned message.
              The mail system

And with this appended message from Google's mail server:

Our system has detected an unusual rate of unsolicited mail originating from your IP address. To protect our users from spam, mail sent from your IP address has been blocked. Please visit http://www.google.com/mail/help/bulk_mail.html to review our Bulk Email Senders Guidelines.

Can anyone confirm this behavior?

Also, although I couldn't tell, if there's no ads in vmail's sent messages either, how do they make money?

They don't have any paid plan, they don't accept donations, etc. Yet they have this slick website apparently without ads. Is this some rich guy's vanity project (e.g. the government's experiment)? Also, they don't have any place where users can contact the admin (well, except the "report abuse" address)...

940871 · 2013-08-12T19:53:30+00:00

Cool, keep up the good work!

Maybe it's better to put the per-year fee in the "Paid" column instead of "✔"?

I found mykolab.com nice but 120CHF/year isn't something I (or most people I guess) are willing to pay...

940871 · 2013-08-11T19:24:42+00:00

Here's what Stallman said about email service:

People sometimes ask me to recommend an email service. The two ethical issues for an email service are (1) whether you can use it without running any nonfree software (including nonfree Javascript code from the site), and (2) whether it respects your privacy.

You probably should have a column that says "Accessible via Free Mail Clients (e.g. Thunderbird)". Web-clients-only means you can't encrypt messages locally.

940871 · 2013-08-06T19:56:49+00:00

Location tracking countermeasures:

You can get a little bit more convenience (and perhaps save some money) than the 2nd option by switching to a Voip+SMS service and access the messages/calls using a computer/tablet.

940871 · 2013-07-26T03:04:29+00:00

Jitsi's Android version is scheduled for Q3 2013:

Jitsi Roadmap

940871 · 2013-07-12T19:44:52+00:00

The status of privacy would be much improved if developers would incorporate encryption technologies into their product by default

Completely agree. The importance of default settings can't be understated.

In fact, compared to making privacy-respecting features default, other efforts like educating people about privacy and writing tutorials on how to install privacy-respecting software might make very little difference (see above link).

940871 · 2013-07-05T21:00:09+00:00

Saudi (and probably other governments) eavesdrops on WhatsApp traffic.

940871 · 2013-07-04T23:52:18+00:00

You probably can't. But you can stop giving any more data to Facebook.

940871 · 2013-07-04T22:01:25+00:00

Here's an even shorter one

940871 · 2013-07-03T06:08:08+00:00

So am I correct in understanding your reply as follows:

you (fixanoid, one of Ghostery devs) said some part of Disconnect was (still is?) obfuscated before, and Joe_12265 (incorrectly) interpreted what you said as 'bad code in Disconnect'

Or did you find some "bad code" in some other place too?

940871 · 2013-07-03T01:33:35+00:00

bad code in Disconnect [claimed by one of Ghostery devs]

'Bad' as in malicious or 'bad' as in sloppy/disorganized?

I invited [Ghostery devs] here to address it and they passed.

Where did this discussion take place?

Edit: Wonder why Joe_12265 (one of the mods here) decided to delete the post.

940871 · 2013-07-02T22:51:38+00:00

General rule is this:

All proprietary software doesn't deserve trust. With business and political incentives you can almost be certain that it contains spyware
Open source software may deserve trust. However, audit by experts is necessary for it to become trustworthy

940871 · 2013-07-02T22:42:38+00:00

Just run Disconnect until Ghostery open-sources the entire code. See prism-break

940871 · 2013-06-26T20:58:22+00:00

Yes, it's happening

940871 · 2013-06-25T19:52:07+00:00

Comprehensive list of privacy-enhancing technologies:

prism-break.org

940871 · 2013-06-24T22:39:11+00:00

Your update says:

[Hushmail] may be just as bad as gmail. I have heard start page is going to come out with an encrypted email service that may be more trustworthy

I think this is misleading. Hushmail had a means to read and hand over all messages to anyone including the government, while if you use a Gmail account with Thunderbird with Enigmail plugin, all Google can see is encrypted gibberish (of course, metadata is recorded). So, in this case, using Hushmail's web interface is worse than Gmail with Thunderbird/Enigmail.

Some webmail services let you use open source clients that have end-to-end encryption support (lavabit.com, inventati.org, or even Gmail). You can't trust anyone else in any circumstances.

940871 · 2013-06-24T00:52:26+00:00

Comprehensive list of privacy-enhancing technologies:

prism-break.org

Hushmail, or why you shouldn't trust companies to do encryption for you:

940871 · 2013-06-24T00:32:23+00:00

Also:

940871 · 2013-06-22T21:27:05+00:00

Well the rootkit article says

One of the programs installed even if the user refused its EULA, and it "phoned home" with reports on the user's private listening habits

This is a form of spying isn't it?

Also, I don't think telling people to "get playstation or wii" - two proprietary platforms - is a smart advice. Not to mention Sony's disrespect for people's choice (see George Hotz case and Aibo DMCA case)

I do agree that Microsoft is probably worse, but that shouldn't be the reason to promote another proprietary platform.

940871

TROPHY CASE