Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker's Replacement for Gmail

dbpmail.net

Post reply on HN
Print view View original

51–60 of 218 posts

Re: A Hacker's Replacement for Gmail

#51

Post by spudlyo »

dbpatterson wrote: post #20
anemitz wrote: post #14

Out of curiosity, what was the reason for not picking a more traditional Dovecot + Postfix setup?

Debian decided to use exim4 by default, so I figured that it would be better supported / documented. Which for the most part was true. There is no reason why postfix+dovecot couldn't work equally well - I was familiar with none, so I chose what seemed like the past of least resistance.

Exim has had five serious vulnerabilities since 2010; two root privilege escalations and three remote code execution bugs. No confidence.

Re: A Hacker's Replacement for Gmail

#52

Post by yfefyf »

brongondwana wrote: post #2

I'm not sure why you can't do those things on FastMail. (disclaimer: I work for FastMail) Sure we have folders rather than tags, which means you can't add multiple of them to the same message. Probably the biggest lack is that you can't manage IMAP flags via the web interface. Otherwise, our search is now very powerful (since about March this year) and allows you to build filters that show messages from multiple fold…

I've just registered FastMail for free trial. Its speed is amazing, much faster than Gmail. And its UI looks great, too. Thank you for your work.

It would be better if you have a more desirable .com domain name. I will probably buy an Enhanced account to use my own domains after free trial.

Re: A Hacker's Replacement for Gmail

#53

Post by richdougherty »

It would be incredibly useful if there was a mail service that received email over SMTP, encrypted it straight away with a public key, then just dumped the encrypted email into a general-purpose online storage solution (e.g. an S3 bucket).

That would IMO provide a good base for encrypted client-side apps to build on top of. Open source would better be able address the problem of writing a client once the money needed for hosting and storage is taken out of the equation.

Re: A Hacker's Replacement for Gmail

#54

Post by AnthonyMouse »

jervisfm wrote: post #33
mbell wrote: post #12

Earlier quoted context omitted.

> Setting up a server in any hosting environment at this point comes with the assumption that its contents can be read at any time by the operators and whoever they let in without you ever knowing about it. How exactly is that any different than it was 6 months ago?

The point about trusting hosting providers is an interesting one. Indeed, when renting a Virtual Private Server from a service provider, you have no choice but to trust them to keep your data safe. This made we wonder: would it be possible to actually secure the server in such a manner that the hosting party won't have access to your stuff without your say so ? I think you can (sort of) do this already with having so…

A good compromise is to just run the actual machine in your house and rent a VPS for the sole purpose of installing a VPN server to provide your machine at home with access to a static IP address that doesn't have outgoing SMTP blocked. That way all the VPS is doing is forwarding data to and from your machine at home and it doesn't have access to anything your ISP wouldn't, and TLS/PGP/etc. goes a long way to help with that as well.

That should keep anyone from reading your email (assuming you and other senders are using TLS), but the next problem is that an ISP-level observer can always tell who you're corresponding with unless you use something like mix nets or Tor. And allowing that requires some cryptographic authentication method to distinguish legitimate anonymized senders from spammers without leaking the sender's identity to an intermediary. Having the sender sign the message and then encrypt the message, the signature and anything else that identifies the sender with the recipient's public key ought to do it but I'm not sure if there is any existing software that will actually do that. It might be possible using a combination of PGP to authenticate the sender and SMTP TLS over Tor to actually transmit the message, but the missing piece is for the sender authentication to be integrated with the spam filter.

Re: A Hacker's Replacement for Gmail

#55

Post by magic_haze »

To play the devil's advocate, what exactly is the practical use of all this if most of your family and friends are on Gmail (and couldn't be arsed to figure out pgp)? From what I can see, your emails will now be sent in the clear over the internet, instead of staying within google's servers. Either way, the government's going to get your data, but at least you're protected against... /more/ unscrupulous people snooping on your stuff?

Re: A Hacker's Replacement for Gmail

#56

Post by ciniglio »

spudlyo wrote: post #48
chj wrote: post #43

Earlier quoted context omitted.

What do you use for spam filtering? Another problem is you will have to use a third party smtp server, otherwise your mail will be rejected by a lot of email providers.

SpamAssassin and friends still do a reasonable job for me, and have for years. I delete a handful every day, but like the parent I've had my email address since 1996, and I haven't been too careful about using it. If I had to do it over again today, I'd look at rspamd. Getting people to accept your mail can be a pain in the ass, yes, but it's not impossible. * Get a "clean" statically allocated IP address. * Control…

Do you have any tips on testing for deliverability? I have a hunch that if I try to send something, say to my gmail or one of my close friends' email, that the spam filter will allow it because it's a familiar name/domain, but I would expect that if I email a stranger's gmail, it might get flagged...

Re: A Hacker's Replacement for Gmail

#57

Post by cwp »

I ran a set up similar to this for many years. It's not that hard, for those with a little unix experience. As moxie mentions, email is very forgiving—you have to break it badly and leave it broken for a long time before you start to lose messages.

What eventually drove me to GMail was spam. I tried a bunch of different filters, and never found one with good-enough accuracy. Finally I decided that the independence and privacy wasn't worth the time I spent fiddling with filters and dealing with misclassified messages. As far as I can tell, Gmail is 100% accurate. Problem solved.

Re: A Hacker's Replacement for Gmail

#58

Post by thex86 »

magic_haze wrote: post #55

To play the devil's advocate, what exactly is the practical use of all this if most of your family and friends are on Gmail (and couldn't be arsed to figure out pgp)? From what I can see, your emails will now be sent in the clear over the internet, instead of staying within google's servers. Either way, the government's going to get your data, but at least you're protected against... /more/ unscrupulous people snoopi…

That's a great point. Reminds of the time I taught my friend to use PGP and sent him an encrypted email. Every single time, he would reply in plain-text, thus exposing my older conversation. When asked why, he told me it's too much of a pain to do it. So my being careful about my privacy doesn't help if other people don't play along.

Re: A Hacker's Replacement for Gmail

#59

Post by joe_bleau »

magic_haze wrote: post #55

To play the devil's advocate, what exactly is the practical use of all this if most of your family and friends are on Gmail (and couldn't be arsed to figure out pgp)? From what I can see, your emails will now be sent in the clear over the internet, instead of staying within google's servers. Either way, the government's going to get your data, but at least you're protected against... /more/ unscrupulous people snoopi…

I see encrypted connections to/from gmail all the time. Here's an example from a test I just ran:

Trusted TLS connection established to gmail-smtp-in.l.google.com[173.194.79.27]:25: TLSv1 with cipher RC4-SHA

Anonymous TLS connection established from mail-yh0-f48.google.com[209.85.213.48]: TLSv1 with cipher RC4-SHA

Re: A Hacker's Replacement for Gmail

#60

Post by bigiain »

mbell wrote: post #34
bigiain wrote: post #23

Earlier quoted context omitted.

The difference today is that not only should I assume that Google sysadmins could read my mail, but there's now pretty convincing arguments that Google are sending all my (as a non-US person) email to the NSA - who're storing it forever "just in case it turns out useful". I'm somewhat less concerned about rogue individual sysadmins curiously snooping on my mail, than I am about the NSA's comprehensive perpetual archi…

What? Have you been following this topic at all? Exactly where are these convincing arguments that google is sending all e-mail to the NSA? Links? Data? Do you have anything that supports this at all? There is the telephone stuff that was leaked, which has been well known since 2006 [0]. But, where is this miraculous evidence that google is handing everything over to the NSA? [0] http://yahoo.usatoday.com/news/washin…

Yeah, I've been following, with the point of view of someone explicitly not protected by your 4th amendment rights. (I'm assuming, possibly incorrectly, that you're a US citizen?)

As a "non-US person", I read all the "We disclose user data to government in accordance with the law" explanations from Google/Apple/Yahoo/Facebook et al - as saying "Oh, you want our data from that guy in Australia? Sure, that's 'in accordance with the law' - here's all his email… Anything else you'd like? His social graph? His contact list/address book? His Adwords clickthroughs? His Google Analytics enabled website visits? Oh look, it seems he accidentally put his GPG private key into his GoogleDrive folder - have that too!"

Do you really find it surprising that people outside the US see Snowdon's revelations and the US government's reactions to strongly suggest this is the only sensible interpretation? _All_ the denials/re-assurances we're seeing are of the form "in accordance with the law", then going on to talk about presumed protection against _domestic_ spying, and the 4th amendment rights of US citizens. None of which is reassuring from where I sit.

Post reply on HN