OpenMailBox: An alternative to Gmail based on free software

Very good initiative. How do you earn money to keep up its costs?

The software used in the mail stack is purely open source software. Looks like they are running a fairly standard Postfix stack and are using roundcube for webmail [1].

I'll stick with my current solution of lavabit (which encrypts all mails stored on their server) [2] and running my own roundcube instance for when I need webmail.

[1] https://openmailbox.org/licences.php

[2] http://lavabit.com

The obvious question that arises with companies like this is if I don't trust Google, why should I trust you? Using open source software isn't a signal that you are trustworthy. Especially considering none of your customers can verify the actual code you are using. What would prevent a similar company from starting with open source software and inserting all sorts of evil code before deploying it on their servers?

I used to use Lavabit, but made the switch because of their policies and logging:

https://github.com/nylira/prism-break/issues/284

There are several security concerns here.

First of all, I didn't see any mention of encryption. Is data encrypted at all, or are you able to read everything going on in the server? If encrypted, in what way? Why should I trust you with my data if it's not encrypted? How will I hold you accountable if I'm not paying you?

Second, HTTPS is a nice start, but it's just public/private key encrypted connection. It's still susceptible to a MITM using a proxy. Most users will click through a security certificate warning generated by their browsers for the sake of convenience. Bam, there goes the HTTPS protection. Especially since all that's stated is you hold the data in a directory. So, if it's in a directory unencrypted, what's stopping someone from path traversing into that directory and either stealing my data, doing things with my credentials or taking down your entire application by shifting through file directories to root acccess? Are there auth checkpoints so you can't climb up to root privileges?

Third, you state there is "powerful antivirus protection." How powerful? Tailor-made for the application or stock bought/outsourced? Do you have an in-house team experienced in crypto working on the development? Are they carefully writing source code with security in mind or checking for it afterwards?

Attempts like this are somewhat misguided in that they're misinformed by anti-government and anti-BigCo trends. Your data is safer with Google. They pour more resources into security than this project could reasonably hope to bring in revenue in a decade. I'm not saying this because I always believe open source is always, universally less secure than proprietary, but because it's Google's GMail we're talking about. A dedicated security engineering team larger than the entire team building this OSS project.

Security is very much a game of resources. You should assume you will be hacked, at some point, inevitably, and work from there. I trust Google more with my data because I know several facts:

1. Google will only cooperate with law enforcement if there is a reasonable need requested of them - contrary to popular belief, the government has more efficient ways of stealing and doesn't have "direct access" to Google's servers;

2. It encrypts data, which is something I'd hope to see at the very least (and which I didn't see here); and

3. Considering the government can probably catch you with or without Google, I'm more impressed with its engineering team than yours. No offense.