11–20 of 25 posts
Support asked me to authorize their access by replying "OK" to an email of them. I asked to know more about this and they said that only trained engineer will access my data, and that they would wait for me to reply OK to their email before to do so...
Their servers are also located in the US, so they're accessible to three-letter agencies as well.
I recently switched to a German service. Data can still be silently disclosed but only if there's imminent danger or a judge issues a warrant. Of course the service is covered by GDPR and European regulators as well.
For all their policies, they're still subject to Australia's "NSL" equivalent that requires they disclose data to law enforcement without notifying you, and in the case of certain agencies, without a warrant. Their servers are also located in the US, so they're accessible to three-letter agencies as well. I recently switched to a German service. Data can still be silently disclosed but only if there's imminent danger…
Fastmail has a fair Australian presence; my limited understanding is that Australian law forbids secure-by-design encryption pipelines - so someone in Fastmail can read your email. Whether or not that person works in support is an interesting but somewhat minor detail. It would be advisable not to use an Australian provider for your data if that is important to you.
> my limited understanding is that Australian law forbids secure-by-design encryption pipelines This understanding is wrong. Secure encryption is perfectly legal, tech media simply likes to overreact to laws without actually reading them. The underlying law that lead to this widespread misconception requires Australian companies to assist law enforcement in acquiring communications but only when it can be done in suc…
Secure by design includes ideas like the pipe forgetting what it transmitted after it finishes transmitting it.
Earlier quoted context omitted.
So, the team is being pretty transparent and explicitly wait for your approval. So, I guess it’s a good point, right?
I think the point is that the permission management is manual, not systematical.
Support asked me to authorize their access by replying "OK" to an email of them. I asked to know more about this and they said that only trained engineer will access my data, and that they would wait for me to reply OK to their email before to do so...
That's interesting. When I needed help with some emails in 2016, the support staff asked me to move the emails into a folder called "forwebmaster" so that they could look at it.
The forwebmaster method (legacy names 'r' us) is very useful for debugging issues like display problems with various types of message (often this is an issue with poorly encoded messages where the character set name is invalid or the encoding is broken, and we fix them by adding another hack to our server to detect and repair that particular type of error). We don't explicitly ask for consent to look at forwebmaster, because the process of creating that folder and putting messages in there is an active request for them to be examined.
For more complex issues which require more visibility into the contents of an account, support agents can request full access. For this they need to provide a reason, and that reason describes how they obtained consent or other reasonable grounds for examining this particular account - e.g. evidence of abuse where the determination needs to be made whether to temporarily lock the account as stolen or close it as entirely fraudulent.
For all their policies, they're still subject to Australia's "NSL" equivalent that requires they disclose data to law enforcement without notifying you, and in the case of certain agencies, without a warrant. Their servers are also located in the US, so they're accessible to three-letter agencies as well. I recently switched to a German service. Data can still be silently disclosed but only if there's imminent danger…
Who’s this German provider and how do they compare in terms of pricing/features/UX to Fastmail?
Support asked me to authorize their access by replying "OK" to an email of them. I asked to know more about this and they said that only trained engineer will access my data, and that they would wait for me to reply OK to their email before to do so...
I don't remember that happening to me back when I had an issue where the dates of all my emails got screwed up (that was kind of my fault, btw). Due to the nature of the problem (and probably most problems that require support), it was obvious they'd need access to help me, though.
Earlier quoted context omitted.
That's interesting. When I needed help with some emails in 2016, the support staff asked me to move the emails into a folder called "forwebmaster" so that they could look at it.
Any folder called precisely "forwebmaster" gets the content automatically deobfuscated when support view the account. There's probably an interesting blog post in how that's achieved in the JMAP middleware using a reverse index on each blob to allow you to download any attachment that's referenced by those messages as well... but I digress. The forwebmaster method (legacy names 'r' us) is very useful for debugging is…