Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Helm: Personal Email Server

thehelm.com

Post reply on HN
Print view View original

561–570 of 592 posts

Re: Helm: Personal Email Server

#561

Post by gsreenivas »

Taranli_Maren wrote: post #112
gsreenivas wrote: post #59

Earlier quoted context omitted.

Hi apo - Giri Sreenivas, co-founder and CEO of Helm here. The gateway funnels packets to and from the Helm servers in people's homes. These are packets of encrypted TLS sessions so we can't do anything with this traffic. Happy to answer any further questions or concerns.

That is not entirely true. Perhaps in the stated configuration it is, but since the domain points to the EC2 instance, you could always register a new LetsEncrypt certificate for it, and do a silent MITM. Perhaps the architecture you describe is the best, however I would hope for two things to be supported: 1) The ability to run your own gateway server instead of having to trust one managed by your company. 2) The ab…

It's possible but not something we would ever do. We are looking at STARTTLS Everywhere from EFF as means to help ensure that any cert changes would be tracked transparently.

#1 is something we will support via open source.

Re: Helm: Personal Email Server

#562

Post by gsreenivas »

stevehawk wrote: post #199
gsreenivas wrote: post #51

Earlier quoted context omitted.

hey stevehawk - thanks for your questions. I'm the co-founder and CEO of Helm. Let me take them one by one: 1 - how many domains can I use? Each Helm Personal Server currently supports 1 domain 2 - Can I have multiple users? Yes, we have no limits on the number of users. 3 - Please see my response above about how we navigate around ISPs blocking ports. We route traffic through an EC2 instance with an iptables configu…

I appreciate the response. Anecdotal situation - I have to admit the 1 domain thing is a drawback for me. In order for me to commit the financials to this I'd need to be able to use it for more domains (ie, spread the costs across my personal businesses as well). As a solution for 1 domain only it has the feel of Silicon Valley millionaires solving problems for Silicon Valley millionaires. There is no break-even poin…

Thanks for the feedback stevehawk. We'll look to support multiple domains - right now costs scale with the number of domains due to the simple fact of supporting reverse DNS.

Re: Helm: Personal Email Server

#563

Post by gsreenivas »

mrgalaxy wrote: post #501
gsreenivas wrote: post #51

Earlier quoted context omitted.

hey stevehawk - thanks for your questions. I'm the co-founder and CEO of Helm. Let me take them one by one: 1 - how many domains can I use? Each Helm Personal Server currently supports 1 domain 2 - Can I have multiple users? Yes, we have no limits on the number of users. 3 - Please see my response above about how we navigate around ISPs blocking ports. We route traffic through an EC2 instance with an iptables configu…

Hi gsreenivas, I hope you end up seeing this. I feel like am your target user for this product. I want to be able to isolate the majority of my data away from these large corporations (namely Google), email is probably the hardest one for me to do myself. I really want to use your product. BUT, and this is a HUGE but, I am a web developer and I have like 15 domain names. Some from old businesses, some for just random…

Hey mrgalaxy - thanks for your note. We will take a look at how we can support this more efficiently. Right now we don't because we support reverse DNS for all our customers.

Re: Helm: Personal Email Server

#564

Post by lvh »

gsreenivas wrote: post #558
lvh wrote: post #543

Earlier quoted context omitted.

> How many people have access to drives in us-east-2a? Do you know? Can you verify? AWS, like every non-clownshoes provider, is transparent about the security controls on its datacenters. It has those verified by independent third parties and auditors (for relevant compliance standards). They have published whitepapers and compliance/audit reports, and continue to. The odds that someone compromises a Helm update and…

I'm curious about how you arrived at the conclusion that we are capable of dragnet surveillance. Connections to/from the Helm server use TLS end to end.

That (organizations) was in reference to state level actors, which is what GP was talking about.

EDIT: removed bit about 993/587 because you're answering that elsewhere.

Re: Helm: Personal Email Server

#565

Post by lvh »

gsreenivas wrote: post #554
lvh wrote: post #316

Earlier quoted context omitted.

If that’s the case, why does it listen on IMAPS/993 and 587?

because it's forwarding packets to/from the Helm server in the home

But that's IMAPS and SMTP submission. Is that for random hosts on the Internet (like my phone on LTE) to read/send e-mail?

Re: Helm: Personal Email Server

#566

Post by gsreenivas »

lvh wrote: post #564
gsreenivas wrote: post #558

Earlier quoted context omitted.

I'm curious about how you arrived at the conclusion that we are capable of dragnet surveillance. Connections to/from the Helm server use TLS end to end.

That (organizations) was in reference to state level actors, which is what GP was talking about. EDIT: removed bit about 993/587 because you're answering that elsewhere.

gotcha - thanks for clarifying

Re: Helm: Personal Email Server

#567

Post by [deleted] »

blablabla123 wrote: post #186
andr wrote: post #65

I never understand why people think having your files physically in their homes is somehow more secure than a data center. - You run the risk of hardware failure, which would take days to recover. When your warranty expires, it'd cost you, too. - Disk failure may lose all your data. - Fire, theft, or hurricanes may destroy it. - You still give access to your data to a company, which controls software updates and the…

I think the only times I lost data in the last 10 years or so was because someone accidentally deleted stuff on a shared Dropbox (luckily I had a local backup, so only the most recent changes got lost). Oh and I lost some photos that I uploaded to a Facebook clone because they more or less shut down. Data loss is more or less a solved problem. You don't need Google for that. ;-) On the other hand, even without puttin…

[deleted]

Re: Helm: Personal Email Server

#568

Post by lolc »

blablabla123 wrote: post #541
lolc wrote: post #427

Earlier quoted context omitted.

I'm not sure you understood how helm works. Your answers don't seem to relate to the concerns of a self-hosted solution.

Can you be more specific?

The original post was about the perils of hosting your mails at home. I'm not clear what your answer is about.

For example, in a power outage, Helm won't work. You say it's not a problem with a charged battery and LTE. I think you're talking about a cell phone and I don't understand how that's related. Sure, one could run Helm on a UPS with LTE backup. But then that's extra infrastructure against the promised simplicity.

Also I don't see how encryption prevents the device from being physically destroyed.

Re: Helm: Personal Email Server

#569

Post by lolc »

lvh wrote: post #543
lolc wrote: post #536

Earlier quoted context omitted.

How many people have access to drives in us-east-2a? Do you know? Can you verify? Assuming the software works flawlessly (if it doesn't, it doesn't matter where it runs) you'll need RAM and storage access to recover the keys and the data. If you're in the cloud, you won't notice when insiders or state agencies take a peek. If the device is in your home, you can set it up so you notice. It all depends on the threat mo…

> How many people have access to drives in us-east-2a? Do you know? Can you verify? AWS, like every non-clownshoes provider, is transparent about the security controls on its datacenters. It has those verified by independent third parties and auditors (for relevant compliance standards). They have published whitepapers and compliance/audit reports, and continue to. The odds that someone compromises a Helm update and…

> The odds that someone compromises a Helm update and the odds that someone walks out of us-east2a with a drive are not in the same ballpark.

Sure, but why are you comparing a software compromise against physical access? There are attacks that work against cloud providers which don't work against Helm. If somebody can compromise a Helm update they essentially got root. And that is a step up from just read access to storage.

Here's how I see it: There is a provider that runs my mail infrastructure. They can either run it on AWS, or host it at my home. If the data is in my home I don't have to trust Amazon. I still have to trust my mail provider ultimately, but using AWS doesn't improve on that.

Re: Helm: Personal Email Server

#570

Post by lvh »

lolc wrote: post #569
lvh wrote: post #543

Earlier quoted context omitted.

> How many people have access to drives in us-east-2a? Do you know? Can you verify? AWS, like every non-clownshoes provider, is transparent about the security controls on its datacenters. It has those verified by independent third parties and auditors (for relevant compliance standards). They have published whitepapers and compliance/audit reports, and continue to. The odds that someone compromises a Helm update and…

> The odds that someone compromises a Helm update and the odds that someone walks out of us-east2a with a drive are not in the same ballpark. Sure, but why are you comparing a software compromise against physical access? There are attacks that work against cloud providers which don't work against Helm. If somebody can compromise a Helm update they essentially got root. And that is a step up from just read access to s…

Because we started talking about FDE specifically?
Post reply on HN