Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker's Replacement for Gmail

dbpmail.net

Post reply on HN
Print view View original

81–90 of 218 posts

Re: A Hacker's Replacement for Gmail

#81

Post by _oxford »

I see a couple of problems here:

1. It's likely he's storing emails on the VPS. This puts us back at square one. A third party has a copy of your emails. And we know email does not garner the same privacy protections as postal mail.

2. You need a domain name. That system (DNS), as it is currently implemented (i.e., everyone setting their root zone to servers they do not control), is highly centralized -- few people maintain their own root zone, despite being easy to do. Domain names are susceptible to false allegations copyright and trademark infringement by private parties, not to mention easy censorship by the US gov't. When you lose your domain you lose email. (Though you shouldn't have to: email works fine with IP addresses in brackets.)

So what's the solution:

1. Get a reachable IP (e.g., through ISP) or get a VPS. But if you get a VPS only use it to pierce NAT (how is left as exercise for reader - hint: supernode), not run a mail server. Don't store sensitive data like email on a VPS, or route sensitive data through it.

2. Use IP addresses not domain names. Alternatively, set up your own DNS that is available as a peer-to-peer service, or have your email contacts use a DNS server and root zone you collectively maintain: free domain names that you control. No one can censor your DNS (phonebook), except you.

Re: A Hacker's Replacement for Gmail

#82

Post by werid »

hcarvalhoalves wrote: post #67

Normal people definitely don't want to manage a mail server though. Life is too short to waste figuring out why you're banned on Spamhaus for the 93th time. GMail sucks, but a home-made contraption is not the alternative.

Why must this be pointed out every time? There's enough of us weirdos out there.

Re: A Hacker's Replacement for Gmail

#83

Post by etherael »

dualboot wrote: post #65
etherael wrote: post #50

Earlier quoted context omitted.

I have a dedicated server with encrypted partitions and admin backdoors turned off at ovh. So theoretically they shouldn't be able to access the running system, and if they take it down to access the partitions directly, they're encrypted so that won't work either.

The right answer. With a design that focuses on simplicity ( reducing the entry points ) you can be pretty well assured that if someone attempts to gain access to your data you will likely know. For me that is an important factor. I rather dislike the fact that in scenarios like Gmail and other providers of their ilk -- access is provided transparently to a third party. Running your own server can give you a reasonab…

That said, even with a dedicated server, I still use gmail, because https://github.com/etherael/phoneme

Re: A Hacker's Replacement for Gmail

#84

Post by Svip »

spudlyo wrote: post #51
dbpatterson wrote: post #20

Earlier quoted context omitted.

Debian decided to use exim4 by default, so I figured that it would be better supported / documented. Which for the most part was true. There is no reason why postfix+dovecot couldn't work equally well - I was familiar with none, so I chose what seemed like the past of least resistance.

Exim has had five serious vulnerabilities since 2010; two root privilege escalations and three remote code execution bugs. No confidence.

Agreed. I used Exim4 for a while, but after too many issues, I eventually switched to Postfix, which have been run smooth ever since.

Re: A Hacker's Replacement for Gmail

#85

Post by bigiain »

etherael wrote: post #79
bigiain wrote: post #69

Earlier quoted context omitted.

Possibly some too-cynical questions… Do you think ovh is any less beholden to GCHQ than Google et al are to the NSA? Do you think your encrypted partitions and turned-off admin backdoors protect you much against people with physical access to the hardware?

> Do you think ovh is any less beholden to GCHQ than Google et al are to the NSA? OVH maybe a little more, because at least they're not under the direct auspice of the most megalomaniacal state in the world and will act according to their economic incentives in being a reliable and trustworthy service provider, which in a purely free market would align their interests with my own. However being as they are subject to…

Great response - thanks.

Another question - have you done the thinking or got some advice about whether marginally trusting a potentially subvert-able hosting company in a jurisdiction you don't particularly trust (US, UK, and unfortunately for me, Australia) is likely to be a better or worse bet than trying to source a server/vps in a more trusted jurisdiction? (perhaps Iceland? Or am I fooling myself assuming there's anywhere "trustworthy"?)

Re: A Hacker's Replacement for Gmail

#86

Post by eru »

thex86 wrote: post #58
magic_haze wrote: post #55

To play the devil's advocate, what exactly is the practical use of all this if most of your family and friends are on Gmail (and couldn't be arsed to figure out pgp)? From what I can see, your emails will now be sent in the clear over the internet, instead of staying within google's servers. Either way, the government's going to get your data, but at least you're protected against... /more/ unscrupulous people snoopi…

That's a great point. Reminds of the time I taught my friend to use PGP and sent him an encrypted email. Every single time, he would reply in plain-text, thus exposing my older conversation. When asked why, he told me it's too much of a pain to do it. So my being careful about my privacy doesn't help if other people don't play along.

The OTR plugin for Pidgin does a better job of userfriendliness and gives more useful privacy guarantees (like plausible deniability).

Re: A Hacker's Replacement for Gmail

#87

Post by josephb »

brongondwana wrote: post #2

I'm not sure why you can't do those things on FastMail. (disclaimer: I work for FastMail) Sure we have folders rather than tags, which means you can't add multiple of them to the same message. Probably the biggest lack is that you can't manage IMAP flags via the web interface. Otherwise, our search is now very powerful (since about March this year) and allows you to build filters that show messages from multiple fold…

Another happy Fastmail user!

I just wish it had an address book and calendar that I could sync.

Those are the things I miss the most from Gmail.

Re: A Hacker's Replacement for Gmail

#88

Post by etherael »

bigiain wrote: post #85
etherael wrote: post #79

Earlier quoted context omitted.

> Do you think ovh is any less beholden to GCHQ than Google et al are to the NSA? OVH maybe a little more, because at least they're not under the direct auspice of the most megalomaniacal state in the world and will act according to their economic incentives in being a reliable and trustworthy service provider, which in a purely free market would align their interests with my own. However being as they are subject to…

Great response - thanks. Another question - have you done the thinking or got some advice about whether marginally trusting a potentially subvert-able hosting company in a jurisdiction you don't particularly trust (US, UK, and unfortunately for me, Australia) is likely to be a better or worse bet than trying to source a server/vps in a more trusted jurisdiction? (perhaps Iceland? Or am I fooling myself assuming there…

I used to be Australian, too.

I think of it like trusting gangs in the thieves guild, there might be some gangs that are ethically more admirable than others, but at the end of the day if it comes down to it, the administrative board of the thieves guild is able to compel any of it's member organisations to act in accordance with its edicts.

So if you're going to take any action that might cause the administrative guild of that thieves board to attack you, it should be a foregone conclusion that the trust of intermediary parties beholden to that central authority is irrelevant.

Arrange your affairs accordingly. If you must deal with gangs of thieves, deal with the better ones, and if you can avoid it, don't. And if, heaven help you, you decide to take action that will paint crosshairs on your back from the central thieves guild committee, your opsec should take into account the full powers that committee is able to bring to bear upon you.

Re: A Hacker's Replacement for Gmail

#89

Post by sygma »

cliveholloway wrote: post #27

I would have thought a client side encryption plugin that will seamlessly encrypt/decrypt all your Gmail sent between yourself and any other user running said plugin would be a simpler option. Adding common mail suppliers as it goes forward.

You could use something like Mailvelope [0]. You still have to manually encrypt things, but the process is fairly straightforward.

[0]: http://www.mailvelope.com/

Re: A Hacker's Replacement for Gmail

#90

Post by ramblerman »

An interesting solution if you have something to hide I suppose.

As has been stated time and again, most people don't. The danger lies in politicians, ceo's and other figures of authority who do and can be blackmailed. Rather than a few hackers setting up their own SMTP servers I think a more powerful solution lies in keeping focus on the actual problem, the out of control NSA program.

Post reply on HN