Earlier quoted context omitted.
Those domain names are something else... Why do you trust him?
you shouldn't trust him, he gets google alerts and finds threads on hacker news and posts wacky comments like this one
I see what you did there.
Ask HN: Low-maintenance alternatives to Gmail?
151–153 of 153 posts
Re: Ask HN: Low-maintenance alternatives to Gmail?
#152Use protonmail.com. They're the best, and have much better security than other "secure" emails, like Fastmail.
> and have much better security than other "secure" emails, like Fastmail Can you elaborate?
tldr- they both seem to be very secure email providers, with some differences. To fully grasp differences, read the links referenced below.
I've done some research, but not much. I should have researched more before speaking, so if I'm wrong, please let me know! I just want to have the most secure email. Anyway... here are a few things I've found. I'm no security engineer, so others may have more insight.
First thing is the location of the datacenters. Protonmail's servers are apparently under 1000 meters of solid rock in a bunker, and they claim it could even survive a nuclear attack. (And, they aren't in the US) (https://protonmail.com/security-details) Even if that's there for marketing purposes, it's kind of cool.
To compare, FastMail also has good security, but it's based in New Jersey, and I don't think it could survive a nuclear attack ':) (https://www.fastmail.com/help/ourservice/security.html)
That stuff is important, but unless something crazy happens, I doubt there is going to be any serious physical attacks on the servers. But, you never know.
ProtonMail is open source, and I know some of FastMail is too. Not sure if it all is or not.
ProtonMail has end-to-end encryption, and while FastMail has encryption, it's not 100%, and on the above /security.html link, it seems employees have access to some data, and full encryption is still a work in progress.
From the link: 'At this stage, some system log data (which could contain personal information) is temporarily stored on un-encrypted disks on individual servers, however we have an ongoing project to bring encryption to all system logging as well.'
Probably the biggest thing is when a company is forced to hand over data. ProtonMail keeps a Transparency Report, so the world knows about everything dealing with this. (https://protonmail.com/blog/transparency-report/)
ProtonMail is under Swiss law, and FastMail is under AU law. They both claim to not answer to US claims, but FastMail does have servers in the US, so I'm not sure how that all works.
Anyway, you can read more on their sites from the links provided. Hopefully some of this was helpful.
Re: Ask HN: Low-maintenance alternatives to Gmail?
#153Virtualmin is a little old-school, and hosting-oriented, but you can easily set up a mail server with SPF, DKIM, SSL w/ LetsEncrypt, etc. out of the box. I've never had any problems in over 5 years with sending or receiving and I just turn on automatic updates for Debian. Only issue is if the IP you get from the hosting provider is blacklisted, so remember to check that before you start setting it up. I use DigitalOc…
Watch out for vulnerabilities though. I always recommend staying away from such "panels" like Plesk, cPanel, etc. Virtualmin is no exception.
Our security history is pretty good, and we provide a wide variety of security features like 2FA, TLS with Let's Encrypt certificates, various password and login policy options, etc.
I would argue that non-technical users are safer using Virtualmin (I can't speak to the security history or features of any other panels) than doing it themselves, because it's easy to make security mistakes when doing it yourself if you don't have a lot of time to research all the options. If someone can invest the time to learn how to manage all of their own services, and can invest the time to build out all of the security features included in a default Virtualmin installation, then absolutely removing the GUI is removing one vector of potential attack; you should always turn off services you don't need. But, based on history, I can say with reasonable confidence that Virtualmin is probably not going to be the way an attacker gets in (it's probably going to be weak passwords, old software, poorly designed custom web apps, etc.).
Disclaimer: I work on Virtualmin.