Ask HN: How can you trust non open source, third party email clients?

#1

Post by xeo84 » Thu, Aug 24, 2017, 9:23 PM UTC

I might be over paranoid and correct me if wrong but as far as I understand, almost all the email clients out there either store your credentials or the access token to be able to send you push notifications for new emails.

Once they have the credentials/token, they have full control over your emails, what happen if they get compromised or they leak your data? Even 2FA will not protect you in this case since you already give them the auth token after a successful 2FA auth, or a specific app password.

Considering the email is used to reset almost all other accounts passwords, how can you trust a third party email clients? Am I missing something? Thanks.

Re: Ask HN: How can you trust non open source, third party email clients?

#2

Post by davelnewton » Thu, Aug 24, 2017, 9:47 PM UTC

Is this rhetorical?

How can you trust any app that has access to your data?

Re: Ask HN: How can you trust non open source, third party email clients?

#3

Post by nvr219 » Fri, Aug 25, 2017, 12:11 AM UTC

I don't use non-open-source, third party email clients.

For G Suite (personal) - I use gmail web client.

For Office 365 (work) - I use Outlook.

For my own mail server - I use Thunderbird or forward to gmail.

Re: Ask HN: How can you trust non open source, third party email clients?

#4

Post by bhhaskin » Fri, Aug 25, 2017, 12:15 AM UTC

nvr219 wrote: post #3

I don't use non-open-source, third party email clients. For G Suite (personal) - I use gmail web client. For Office 365 (work) - I use Outlook. For my own mail server - I use Thunderbird or forward to gmail.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

Re: Ask HN: How can you trust non open source, third party email clients?

#5

Post by FLCL » Fri, Aug 25, 2017, 12:23 AM UTC

bhhaskin wrote: post #4

nvr219 wrote: post #3

I don't use non-open-source, third party email clients. For G Suite (personal) - I use gmail web client. For Office 365 (work) - I use Outlook. For my own mail server - I use Thunderbird or forward to gmail.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

Gmail is closed source, but it isn't a third party from the you->google relationship.

Re: Ask HN: How can you trust non open source, third party email clients?

#6

Post by bhhaskin » Fri, Aug 25, 2017, 12:28 AM UTC

FLCL wrote: post #5

bhhaskin wrote: post #4

Earlier quoted context omitted.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

Gmail is closed source, but it isn't a third party from the you->google relationship.

Hmm you are right on that one.

Re: Ask HN: How can you trust non open source, third party email clients?

#7

Post by gumby » Fri, Aug 25, 2017, 12:29 AM UTC

How do you trust someone else to manage your mail service?

How do you trust every line of an open source package without auditing it yourself?

In your hierarchy of risk/trust, this one is pretty small.

Re: Ask HN: How can you trust non open source, third party email clients?

#8

Post by gumby » Fri, Aug 25, 2017, 12:29 AM UTC

FLCL wrote: post #5

bhhaskin wrote: post #4

Earlier quoted context omitted.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

Gmail is closed source, but it isn't a third party from the you->google relationship.

Umm, what? You are trusting them with the contents of the mail -- they don't even need your credentials. They are a third party between you and your correspondent.

Re: Ask HN: How can you trust non open source, third party email clients?

#9

Post by nvr219 » Fri, Aug 25, 2017, 12:39 AM UTC

bhhaskin wrote: post #4

nvr219 wrote: post #3

I don't use non-open-source, third party email clients. For G Suite (personal) - I use gmail web client. For Office 365 (work) - I use Outlook. For my own mail server - I use Thunderbird or forward to gmail.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

How is Outlook third party?

First party = me

Second party = Microsoft

Same with gmail client.

Re: Ask HN: How can you trust non open source, third party email clients?

#10

Post by bogdweller » Fri, Aug 25, 2017, 2:35 AM UTC

bhhaskin wrote: post #4

nvr219 wrote: post #3

I don't use non-open-source, third party email clients. For G Suite (personal) - I use gmail web client. For Office 365 (work) - I use Outlook. For my own mail server - I use Thunderbird or forward to gmail.

Both Outlook and Gmail are closed source, third party email clients. You might be able to peak at the front end, but you have no idea what's going on behind the scenes. Sure, from a security stand point you are most likely fine for most use cases, but Gmail dose scan your emails for advertising targeting reason.

Thought I read they stopped that recently. I still wouldn't trust them though.