Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mailbox.org gpg encrypted €1,- email solution now in english.

mailbox.org

Post reply on HN
Print view View original

11–20 of 31 posts

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#11

Post by ushi »

cavac wrote: post #10
aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

Data Privacy Statement from mailbox.org: "According to TKG Section 113 (German Telecommunications Law), the public prosecutor and the police can access the user data held by telecommunications providers such as ourselves relatively easily. A simple information request suffices; no court order is needed. According to TKG Section 113, a telecommunications provider has no legal recourse against such a request; it must c…

You should have included the next paragraph. They make a difference between user data and the users emails:

"Access to the log data of mail and web servers and to the e-mails contained in a mailbox, on the other hand, requires a search and seizure warrant signed by a judge, unless the investigative authorities can claim exigent circumstances. Telecommunications providers again have no legal recourse against search warrants; seizure of the log data cannot be denied."

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#13

Post by blumkvist »

cavac wrote: post #10
aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

Data Privacy Statement from mailbox.org: "According to TKG Section 113 (German Telecommunications Law), the public prosecutor and the police can access the user data held by telecommunications providers such as ourselves relatively easily. A simple information request suffices; no court order is needed. According to TKG Section 113, a telecommunications provider has no legal recourse against such a request; it must c…

Best privacy-protection laws?...

...yeah... the law does its job, perhaps, a bit too well.

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#14

Post by kome »

lawl wrote: post #12

So I clicked the page to check if I can a) use my own domain. b) upload my public key and decrypt the mailbox locally to serve IMAP from localhost. Then I read this > Our grasp on technology is flawless And they completely lost me.

> Our grasp on technology is flawless, and our staff is friendly and professional.

Comedy gold. Classic German smugness (?).

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#15

Post by sergiosgc »

aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

This is the German implementation of the European Data Retention Directive [1]. The legal landscape across the EU is bound to be similar. The gist of the directive, regarding email is: providers must retain sender, recipient, date and IP address information for a period (6 to 24 months, depending on the country). This data may be requested by a court order, and only by court order.

The directive says nothing about the secrecy of the request, so this is up to the specific implementation in member states. In Germany it is secret, in Portugal it is public except for complex cases in investigative phase (a specific, well defined situation meant to deal with large organized crime). I don't know about other countries, but since our laws are usually modeled on the French version, I'd wager France is similar to Portugal (actually, it's the other way around)

[1]http://en.m.wikipedia.org/wiki/Data_Retention_Directive

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#16

Post by riquito »

This is another lavabit. They receive e-mails in clear text and then they encrypt it. This is not secure at all.

It would be ok if it they were clear about it, but it's exactly the opposite "[...]This means that no one can read your e-mails except yourself – no password thieves, no governmental or law enforcement agencies, not even us here at mailbox.org."

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#17

Post by ronaldx »

aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

> I do not understand the Legal Certainty paragraph.

My interpretation is: Spam is deleted in order to give you plausible deniability that you haven't received and read it.

i.e. There is no spam folder.

But, this seems like it would normally be a bug rather than a feature.

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#18

Post by aw3c2 »

sergiosgc wrote: post #15
aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

This is the German implementation of the European Data Retention Directive [1]. The legal landscape across the EU is bound to be similar. The gist of the directive, regarding email is: providers must retain sender, recipient, date and IP address information for a period (6 to 24 months, depending on the country). This data may be requested by a court order, and only by court order. The directive says nothing about th…

No, it is a different thing but the DRD is another thing that they should mention indeed.

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#19

Post by snori74 »

ronaldx wrote: post #17
aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

> I do not understand the Legal Certainty paragraph. My interpretation is: Spam is deleted in order to give you plausible deniability that you haven't received and read it. i.e. There is no spam folder. But, this seems like it would normally be a bug rather than a feature.

They should be slightly more explicit, but "...before the e-mails are accepted and reject anything that looks suspicious..." almost certainly means that spam is rejected with a 5xx message - or goes to your InBox, but is never accepted then hidden from you in a spam folder.

It's a good approach, and from a legal perspective I'm surprised more systems don't take this approach, because legally (at least in my local jurisdiction), you're deemed to have received an email when it "enters that information system" - i.e. when your SMTP server says 250.

This stuff matters quite a lot in the formation of contracts.

Re: Mailbox.org gpg encrypted €1,- email solution now in english.

#20

Post by stfu »

aw3c2 wrote: post #3

FYI, in Germany if you provide more than 10000 mailboxes you have to add a SINA box to your network. https://de.wikipedia.org/wiki/Sichere_Inter-Netzwerk_Archite... This allows law enforcement to silently direct specific user's mails to them. This requires a ruling and the provider will be aware of it. Still, I think a company like this should mention this in a full disclosure spirit as it can render their promise "N…

Wouldn't be the logical consequence to open a new subsidiary firm every 8000-9999 accounts?
Post reply on HN