Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Helm: Personal Email Server

thehelm.com

Post reply on HN
Print view View original

231–240 of 592 posts

Re: Helm: Personal Email Server

#231

Post by hawski »

sjs382 wrote: post #218
hawski wrote: post #197

Earlier quoted context omitted.

Then the keys are on the premises of the cloud company. Also data has to be at one time unencrypted in computer's memory. When there is a physical access to the computer you can't do much to ensure your data's safety.

With public key encryption, a cloud provider doesn't need your private keys to encrypt data that can be only viewed by you—they need your public key. In the parent, the private keys are not on the premises of the cloud company.

I may not understand how things work, but how can a SMTP server function without private keys? How can it pass the hand shake? Does parent describes different scenario?

Re: Helm: Personal Email Server

#232

Post by joezydeco »

gsreenivas wrote: post #195
ThePhysicist wrote: post #184

Earlier quoted context omitted.

Hey, since you're here already, I have some questions (in case you're able/allowed to answer them): What's the base operating system and hardware architecture the box is based on? It says "Linux" on the page but doesn't go into specifics. Why not just use regular hardware, e.g. Intel NUCs, or even allow people to run your software on their own hardware (like OwnCloud does)? In Germany there was/is a startup, Protonet…

We spin our own build of Linux using Yocto. We are using an ARM-based SoC from NXP. We chose this to ensure that the device can only run signed, trusted code by implementing secure boot and signature verification of software updates. We will make a developer program available in the future. I didn't use Protonet so I shouldn't speculate about what's similar or different about the products. I think we are in a time ri…

We spin our own build of Linux...We are using an ARM-based SoC from NXP.

Okay, so that narrows it down to the i.MX family.

We chose this to ensure that the device can only run signed, trusted code by implementing secure boot and signature verification of software updates.

Maybe read this?

https://blog.quarkslab.com/vulnerabilities-in-high-assurance...

Re: Helm: Personal Email Server

#233

Post by ryan-c »

zrail wrote: post #155
djsumdog wrote: post #119

Earlier quoted context omitted.

So if they route everything through the same set of EC2 instances, that might actually take care of the SPAM issue. I run my own e-mail server and have run into that same issue of not being able to send to gmail/microsoft addresses (unless I contact the person via Facebook/Twitter/Reddit/etc. and tell them to check their spam folder): https://penguindreams.org/blog/how-google-and-microsoft-made... The way most of the…

"You know what would be a better product? A relay SMTP server that works with Google/Microsoft/Amazon/Fastmail et. al. to pump e-mail from personal servers and ensures it won't get caught in spam filters." That's basically Sendgrid or Mailgun or even Fastmail itself. They can all relay SMTP for arbitrary domains.

It's actually a totally different product vs Sendgrid/Mailgun/etc.

Such a product would need to have a ToS that states it can only be used for low volume personal and business correspondence, and have per-account rate limiting to enforce that. Doing it this way is necessary to avoid having mail treated as bulk.

I've tried relaying through mailgun to get mail to outlook.com, it does not work.

Re: Helm: Personal Email Server

#234

Post by openbasic »

TrueDuality wrote: post #225

You mention that you use a hardened Linux OS, but you don't discuss any of the other opensource software that you use. While you technically only have to distribute the sources to the people that receive your hardware, it would be nice to know these kinds of things before purchasing. This is a niche market you're marketing to that has a history of researching these kinds of things. Are you using a custom distro or on…

https://s3-us-west-2.amazonaws.com/files.thehelm.com/legal/H...

Re: Helm: Personal Email Server

#236

Post by runarb »

dagi3d wrote: post #60
gsreenivas wrote: post #43

Earlier quoted context omitted.

hey jawns, great question. I'm Giri Sreenivas, co-founder and CEO of Helm. To answer your question, ISPs block port 25 and email service providers typically reject emails coming from residential IP blocks. To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and fr…

I thought that sending email from EC2 instance was not allowed and only option was using their SES service.

> I thought that sending email from EC2 instance was not allowed and only option was using their SES service.

Amazon EC2 throttles traffic on port 25 of all EC2 instances by default, but you can request that this throttle be removed: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-p...

Doubt that AWS would allow anyone to send on behalf of 3 parties like Helm appears to do though.

Re: Helm: Personal Email Server

#237

Post by garry »

rntz wrote: post #216
garry wrote: post #105

Earlier quoted context omitted.

I'm the first and biggest investor in Helm and I'm on the board. I created email-based Posterous previously (YC funded) and was a YC partner for 5 years. I funded this team because they're high integrity software engineers first, and we built this out of need— a company like this needs to exist because for this to work, you need both great user experience as well as great software. Helm actually solves this exactly -…

You say Helm solves or will solve all these problems. But if I don't actually need to be able to reach the box in order to use my email - if it will work even when the box is offline, powered-down, stolen, or destroyed - then what, exactly, is the point of the $500 box itself? It's not privacy, it seems. If it were private, how could it work when the box is offline? I'm not opposed to a "pay for your email instead of…

Stolen? The data is secure - keys are stored in secure enclave, and storage is encrypted.

Down? There's continuity of service if you have a 2nd box online, and it's as easy to restore from a live backup as an iPhone from iCloud.

Email is the first app, and there will be more.

Re: Helm: Personal Email Server

#238

Post by ryan-c »

forapurpose wrote: post #208
gsreenivas wrote: post #125

Earlier quoted context omitted.

Hi keehun - thanks for posting this on HN! I'm the co-founder and CEO of Helm. 1 - First, we cross reference IP addresses we assign to gateway against known blacklists. This helps ensure emails will be delivered. We also fully support email authentication (DMARC, DKIM, SPF) and configure reverse DNS as well. Lastly, the IP address for a gateway stays fixed so the domain and IP will build reputation over time. Helm se…

> Your Helm server will then initiate a TLS session with the server hosting your recipient's email I'm not sure how Helm doesn't see the metadata: * For outbound (as described) and inbound mail, do all mail servers support TLS connections? I was under them impression that many still communicate unencrypted. * How does Helm avoid seeing the metadata, who is communicating with whom and when?

WRT to TLS, see here: https://transparencyreport.google.com/safer-email/overview?h...

It seems that Helm has no obligation or business need to log any metadata if they are providing each customer with a dedicated relay. Any abuse will come from that relay IP and can trivially be attributed to the correct customer.

Re: Helm: Personal Email Server

#239

Post by garry »

sjs382 wrote: post #203
garry wrote: post #166

Earlier quoted context omitted.

This is a valuable and useful criticism and we're going to talk about this at our next board meeting. How do you know who to trust? You surely have to trust someone. It feels generally true that we can trust Apple since we pay them for hardware and their ongoing business interest is in protecting their revenue streams through their hardware and iOS app store, which means you are aligned. Generally for Helm that's a g…

So, we're in agreement that this sort of thing should 1) be paid for, 2) not readable by the provider, and 3) maintenance-free for the user. I still don't understand why this is a hardware play. There are advantages to owning the hardware but none of those advantages seem to apply here. The hardware feels like a bit of an albatross.

If you want to truly control your data, you've got to control your hardware too. See: Lavabit.

Re: Helm: Personal Email Server

#240

Post by A2017U1 »

ryan-c wrote: post #221
pmoriarty wrote: post #153

Earlier quoted context omitted.

Since most email's not encrypted, how is having each Helm user's email hop through your server any better for them in terms of privacy than just hosting their email on a remote mail provider in the first place? You could still record every incoming and outgoing email as it goes through your server, couldn't you? I really don't see the advantage of Helm.

Most (gmail claims ~90%) email is encrypted with opportunistic TLS in transit and can't be passively monitored. https://transparencyreport.google.com/safer-email/overview?h... Further, "the provider could intercept email" and "the provider stores all email" are very very different.

What's going on there with the "Support for encryption in transit" section?

Overwhelmingly at 0% in most regions which they say are:

> domains in terms of volume of email to and from Gmail, in alphabetical order

Something doesn't add up there.

Post reply on HN