Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker's Replacement for Gmail

dbpmail.net

Post reply on HN
Print view View original

201–210 of 218 posts

Re: A Hacker's Replacement for Gmail

#201

Post by Nux »

chj wrote: post #43
moxie wrote: post #29

Earlier quoted context omitted.

I've been hosting my own mail since 1996. It's actually one of the easier services to self-host: 1) SMTP was developed for unreliable environments. If you have problems with uptime, your incoming email will bounce around for 5 days before it gets dropped. So assuming you can get your SMTP server running one day out of five, you shouldn't be in danger of losing anything. 2) Contemporary daemons like postfix and doveco…

What do you use for spam filtering? Another problem is you will have to use a third party smtp server, otherwise your mail will be rejected by a lot of email providers.

That's bollocks. I have my own email server on some random Hetzner IP address and have never had email rejected; and do note my domain TLD is .ro which tends to get higher spam scores.

Re: A Hacker's Replacement for Gmail

#202

Post by etherael »

noinsight wrote: post #199
mike-cardwell wrote: post #169

Earlier quoted context omitted.

"ridiculously complex mechanism" ... Not really. Anyone with the ability to stick a USB stick in a USB port and hit a power reset button can pull off this attack: http://www.mcgrewsecurity.com/tools/msramdmp/

Hmm, that requires USB booting though, if you disable that from the BIOS and password protect it, they can't really use this method. If they pull the battery the machine needs to be turned off and so the RAM will clear.

You don't get BIOS access to low cost dedicated servers on OVH, even though they're dedicated, you can't KVM them.

mid to high range ones you can though so that might be a workable solution there.

Also, they can still rip the ram out and nitrogen it.

Re: A Hacker's Replacement for Gmail

#203

Post by gog »

homeomorphic wrote: post #200
moxie wrote: post #29

Earlier quoted context omitted.

I've been hosting my own mail since 1996. It's actually one of the easier services to self-host: 1) SMTP was developed for unreliable environments. If you have problems with uptime, your incoming email will bounce around for 5 days before it gets dropped. So assuming you can get your SMTP server running one day out of five, you shouldn't be in danger of losing anything. 2) Contemporary daemons like postfix and doveco…

I've been meaning to finally get around to doing this myself, so I'll shoot you a question: Do you have a fallback MX? I'm thinking of getting a super-cheap VPS running only Postfix as a mail fallback in case my primary host goes down for an extended period. How is accessing mail on the fallback host (when primary is down) usually handled? An IMAP daemon running there as well? Should the fallback just wait for the ma…

Usually, the backup MX just gathers email (so that the email does not bounce to the sender) and delivers it to the primary MX when it gets online and then the primary delivers emails to the server that is going to expose it via IMAP or POP3.

But this is just for receiving emails (from the outside world), if your IMAP/POP3 server is on the same server as your primary MX you will not have access to emails on the server while the primary is down. You have to find a way to sync your received mail (maildir/mailbox) to two or more servers.

If you decide to implement a backup MX, try to sync your allowed recipients list from the primary because spammers often try to send emails to an MX with a lower priority, and if it accepts all emails for the domain without checking if that mailbox actually exists you could became a source of back-scatter.

Re: A Hacker's Replacement for Gmail

#204

Post by homeomorphic »

gog wrote: post #203
homeomorphic wrote: post #200

Earlier quoted context omitted.

I've been meaning to finally get around to doing this myself, so I'll shoot you a question: Do you have a fallback MX? I'm thinking of getting a super-cheap VPS running only Postfix as a mail fallback in case my primary host goes down for an extended period. How is accessing mail on the fallback host (when primary is down) usually handled? An IMAP daemon running there as well? Should the fallback just wait for the ma…

Usually, the backup MX just gathers email (so that the email does not bounce to the sender) and delivers it to the primary MX when it gets online and then the primary delivers emails to the server that is going to expose it via IMAP or POP3. But this is just for receiving emails (from the outside world), if your IMAP/POP3 server is on the same server as your primary MX you will not have access to emails on the server…

Thanks.

Re: A Hacker's Replacement for Gmail

#205

Post by quicksilver03 »

stevefleming wrote: post #119
bigiain wrote: post #69

Earlier quoted context omitted.

Possibly some too-cynical questions… Do you think ovh is any less beholden to GCHQ than Google et al are to the NSA? Do you think your encrypted partitions and turned-off admin backdoors protect you much against people with physical access to the hardware?

As a former employee of OVH, I can guarantee that law enforcement compliance does happen, I don't know to what extent, but having been there for the better part of two years I have seen requests from local government be held up and data handed over to authorities. Though in those cases it was child pornography accusations.

Which could mean that the only thing an unscrupulous government official needs to do in order to access one's data is hinting at implications on child pornography.

Re: A Hacker's Replacement for Gmail

#206

Post by claudius »

MichaelGG wrote: post #161
claudius wrote: post #125

Earlier quoted context omitted.

You can disable storing passwords. If you don’t want to have to enter a ‘master password’ when Pidgin starts up, there is no way they can store the passwords more securely than plaintext. Get full disk encryption and be happy.

That's simply not true. For example, on Windows, they can use CryptProtectData. Mac OS has a keychain function too. Pidgin devs are being disingenuous by suggesting that accessible to current user is identical to storing plaintext on disk. Full disk encryption and per-user encryption are good steps. But an accidental backup of Pidgin will still reveal passwords that would be safe if they bothered to use platform spec…

Pidgin is predominantly developed for Linux, where they would have to support Gnome, KDE and probably at least one other mechanism. Sure, that could be done, but it is a lot of work to do that sensibly on all platforms, and, more importantly, of questionable sense: I would classify the logs of my conversation as much more relevant to a potential attacker than the mere password to my XMPP account.

Re: A Hacker's Replacement for Gmail

#207

Post by voidlogic »

h2ohno wrote: post #36
voidlogic wrote: post #19

Hmm... It sounds easier to just run an instance of Zimbra community edition in a VM. https://s3.amazonaws.com/uploads.blog.zimbra.com/wp-content/...

This is what I do, but it requires more than a $5/month VPS to run it. https://www.zimbra.com/docs/os/8.0.2/single_server_install/S...

True, but $10/mo should cover your needs fine. https://www.digitalocean.com/pricing

Re: A Hacker's Replacement for Gmail

#208

Post by furyg3 »

old-gregg wrote: post #157
cbr wrote: post #132

Earlier quoted context omitted.

It's easier now, in that we have good well-documented software, but the external environment has changed. While other servers used to just accept the email you sent, spam countermeasures have gotten complex enough that if you just follow the postfix installation guide you're going to have a lot of your outbound smtp filtered.

Grab a free account at mailgun.com and configure it as your outgoing SMTP relay. You'll get an IP address for your outbound traffic which is "clean", monitored and registered with a ton of ESPs. You can also use Mailgun as a proxy for your incoming mails as well, for spam filtering or custom routing purposes.

Is mailgun a US-based company that would comply with a national security letter if faced with one?

Re: A Hacker's Replacement for Gmail

#209

Post by MichaelGG »

claudius wrote: post #206
MichaelGG wrote: post #161

Earlier quoted context omitted.

That's simply not true. For example, on Windows, they can use CryptProtectData. Mac OS has a keychain function too. Pidgin devs are being disingenuous by suggesting that accessible to current user is identical to storing plaintext on disk. Full disk encryption and per-user encryption are good steps. But an accidental backup of Pidgin will still reveal passwords that would be safe if they bothered to use platform spec…

Pidgin is predominantly developed for Linux, where they would have to support Gnome, KDE and probably at least one other mechanism. Sure, that could be done, but it is a lot of work to do that sensibly on all platforms, and, more importantly, of questionable sense: I would classify the logs of my conversation as much more relevant to a potential attacker than the mere password to my XMPP account.

All of this is true. But when the Pidgin devs state things like "there's no way" and "it's just as secure" (as they do on the wiki), that's just incorrect. An intellectually honest description would note that many platforms offer protection, but it's not standardized across Linux (I'm assuming).

The logs of the conversation can be protected in the same way, so I'm not sure what that has to do with anything. (Although you might wish to keep logs as plaintext, to facilitate backups, if you're not backing up the user's keychain info.)

Re: A Hacker's Replacement for Gmail

#210

Post by cakeface »

furyg3 wrote: post #208
old-gregg wrote: post #157

Earlier quoted context omitted.

Grab a free account at mailgun.com and configure it as your outgoing SMTP relay. You'll get an IP address for your outbound traffic which is "clean", monitored and registered with a ton of ESPs. You can also use Mailgun as a proxy for your incoming mails as well, for spam filtering or custom routing purposes.

Is mailgun a US-based company that would comply with a national security letter if faced with one?

What about Digital Ocean or another VPS provider? What is to stop them from just handing the NSA a copy of my server image complete with all email history, address book, and authorized PGP keys? I'd have even tagged and indexed all the mail for them!
Post reply on HN