Forgot your password?
typodupeerror
Communications Encryption Privacy

Ask Slashdot: Recommendations For Non-US Based Email Providers? 410

Posted by timothy
from the lesser-of-evils dept.
First time accepted submitter jlnance writes "I don't particularly like the NSA looking over my shoulder. As the scope of its various data gathering programs comes to light, it is apparent to me that the only way to avoid being watched is to use servers based in countries which are unlikely to respond to US requests for information. I realize I am trading surveillance by the NSA for surveillance by the KGB or equivalent, but I'm less troubled by that. I searched briefly for services similar to ymail or gmail which are not hosted in the US. I didn't come up with much. Surely they exist? What are your experiences with this?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Recommendations For Non-US Based Email Providers?

Comments Filter:
  • by Anonymous Coward on Saturday August 10, 2013 @12:22PM (#44531021)

    Actual communication security implies point-to-point security. In such a setting, a third-party service doesn't make any sense. Hence either what you're look for can't exist, or you won't know if it's secure.

    • +++ THIS.

      Do it yourself.

      • by Anonymous Coward on Saturday August 10, 2013 @01:15PM (#44531427)

        You would have to lease space in a datacenter, buy a domain, setup VPN, use securelinux (though probably not since it was written by the NSA) or solaris, run a VM inside that, always do a restore before accessing email and read through the tens of thousands of lines of code to delete out anything that MAY compromise your security (best use open source in this case). Also you will have to ensure that everyone you email is doing the same thing. So you may want to start mandating that everyone you email use your domain, but since it will b so expensie you should probably charge for it to at a minimum off set costs. Though you should probably charge enough to ensure that you can afford to quit your current job to do full time maintenance.

        After all that, probably be best you find a neutral country that has no agreements with the US and will refuse to work with it.

        But good luck!

        • by the_B0fh (208483) on Saturday August 10, 2013 @01:24PM (#44531487) Homepage

          If you restore your VM (that hosts your email) before accessing your email, didn't that just wipe out your emails?

          You need more paranoia please.

          • by sumdumass (711423)

            Only if you restore it on the server side. I suspect what he meant was using a VM on the client accessing the server to ensure there are no bugs or trojans set to intercept or log the communications.

        • by tqk (413719) <s.keeling@mail.com> on Saturday August 10, 2013 @02:08PM (#44531765)

          You would have to lease space in a datacenter ...

          Uh, no. Use Linux (or *BSD) and point your local SMTP at your ISP's Smarthost. Encrypt files locally with GnuPG and send them as attachments. The only difficult part is expecting the recipients to do the same in reverse and to treat your privacy as seriously as you do. There, you'll need to exercise judgment as to who to trust and with what (just like in every other area of life).

          I really couldn't give a rat's ass how many cycles the NSA wastes on trying to crack my encrypted attachments. I consider myself fortunate in not having to support them financially (I'm non-US). I've toyed with the idea of making a cronjob blast out emails to random addresses simply to supply them with stuff to waste time and effort on, but I don't really care that much to bother.

          If I ever manage to contact the Medellin or Cali or Zeta cartels' IT guys, I'll have a proposal for them, but so far no joy there. That would be great fun.

          • by Znork (31774) on Saturday August 10, 2013 @04:07PM (#44532427)

            Of course, the part that the NSA et al seems most interested in is the source and destinations of your mails to map your associations. By sending via your ISP smarthost you're still handing them that info, so if you want to cut them out of the loop you need to vpn the mail relaying outside their grasp and ensure encrypted smtp/tls direct between endpoints.

            Your random mail idea does screw with them in a nice way tho as it'd mess up their social graph and probably get yourself classified as an uninteresting spammer after which you can freely inform islamic insurgents how they can enlarge their manhood and obtain large fortunes from Africa by sending a small upfront payment.

            But for actual secure comms it's probably better to use i2p or some other darknet. And traffic on that screws with the snoops as well.

    • by ImdatS (958642) on Saturday August 10, 2013 @01:08PM (#44531375) Homepage

      Yes, correct.

      In my experience, having a mail server provider in Europe (e.g.) and using PGP/GPG could help. The problem is of course that your recipient also needs PGP/GPG.

      1&1 and Deutsche Telekom in Germany just announced that (paraphrasing it) they will take email security more seriously now. You might want t get an email account at GMX in Germany (product of 1&1) and then use PGP/GPG for fully confidential communication. I wouldn't use their webmail interface, rather suggest to use their IMAP/POP Interface using SSL/TLS.

      Using PGP/GPG *and* a foreign email service provider helps in (a) encrypting your email (PGP/GPG), and (b) (if used with SSL/TLS) communication, also hiding the sender/recipient identification, including your email's subject.

      On the other hand, I don't know if that would be really secure (for [b] at least), as the German secret service (BND) seems to forward communication information to the NSA (at least the meta-information)...

      If you really want to communicate securely, I recommend a "dead mailbox"-principle electronically, but by using PGP/GPG to encrypt the file in question, maybe even hiding the content as a picture or video...

      • by Z00L00K (682162)

        Make sure that you use encrypted mails using self signed certificates or by someone you trust.

      • by Anonymous Coward on Saturday August 10, 2013 @02:50PM (#44532039)
        1and1.com [1and1.com] is a US-based company, or has management staff in the United States, so that won't work.

        This is what I understand:
        1) The U.S. government can force any company to do anything it wants.
        2) The U.S. government can demand that the company keep that secret.
        3) The U.S. government can put a U.S. employee in prison if 1 and 2 are not followed.

        Seems to me to be a vicious, anti-democratic government.
      • I recommend a "dead mailbox"-principle electronically...

        There are usenet newsgroups that seem to be entirely dedicated to encrypted dead drop communications. I wonder what's going on there?

    • by methano (519830) on Saturday August 10, 2013 @01:41PM (#44531599)
      What if you used a pigeon? A third-party pigeon, that is.

      But like he said, you still can't be sure it's secure.

      And, of course, you'd need to use a US-based pigeon.
  • Runbox.com (Score:5, Informative)

    by Gaygirlie (1657131) <gaygirlie@hotma i l . c om> on Saturday August 10, 2013 @12:24PM (#44531025) Homepage

    I am using www.runbox.com myself: it's a service based in Norway, it's pretty cheap considering, they do not have any NSA-ties or the likes. I dunno what else to say about it, really, so I'll just copypaste this from their site:

    Email Privacy in Norway

    Some countries, especially in Europe, have a constitutional guarantee of secrecy of correspondence, wherein email is equated with letters and therefore protected from all types of screening and surveillance. In electronic communication, this principle protects not only the message contents but also the logs of when and from/to whom messages have been sent.

    In Norway, freedom of expression and privacy of correspondence is governed by Article 100 and 102 of the Constitution and the implementation of the European Convention on Human Rights in the Norwegian Human Rights Act, especially Article 8: Right to respect for private and family life.

    Additionally, the Personal Data Act as set forth by the Norwegian Data Inspectorate regulates collection, storage, and processing of personal data.

    The Data Inspectorate was established January 1, 1980 and was among the first agencies in the world to facilitate the protection of individuals from violation of their right to privacy through processing of their personal data.

    Central principles of the Norwegian data privacy regulations are:

            Personal data must only be collected by private entities when consent from the user has been obtained.
            Personal data must not be used for purposes inconsistent with the initial purpose of collection except with consent from the user.
            Personal data must not be stored longer than required by the purpose of collection.
            Personal data must be kept confidential unless required by law or court order.

    Finally, the coming Data Retention Directive will soon be implemented in Norway but will only regulate electronic infrastructure providers, which Runbox is not.

    • Re:Runbox.com (Score:4, Insightful)

      by Anonymous Coward on Saturday August 10, 2013 @12:35PM (#44531123)

      Personal data must be kept confidential unless required by law or court order.

      That's a hole you can drive a truck though. The NSA justifies everything on those grounds.

      • Re:Runbox.com (Score:4, Interesting)

        by MightyMartian (840721) on Saturday August 10, 2013 @12:40PM (#44531163) Journal

        Besides, the way I understand it, whatever privacy protections remain apply to US citizens on US soil. Use a foreign email serviced, and it sounds like all bets are off.

        • The 4th amendment doesn't end at the border for a U.S. citizen.
          • Re:Runbox.com (Score:5, Informative)

            by Anonymous Coward on Saturday August 10, 2013 @01:06PM (#44531363)

            Yeah, it ends 100 miles inside [slashdot.org] the border.

      • by ImdatS (958642)

        The problem is "... unless required by law", not the second part ("... or court order"). The NSA cannot request a court order in Norway.

        But if Norway has a law that requires the email provider to provide information to the Norwegian secret service, which then forwards the information to the NSA, then yes, you can "can drive a truck through [that hole]".

    • Re:Runbox.com (Score:5, Interesting)

      by msobkow (48369) on Saturday August 10, 2013 @12:51PM (#44531255) Homepage Journal

      The Norway data pipes probably run through the UK, as do most of the pipes in the EU. So rather than installing back doors on Norway's servers, the UK just sniffs the big data pipe traffic and captures that directly. And they give not one whit about your constitutional protections, any more than the US respects the Canadian constitution and Charter of Rights when they sniff our traffic while it passes through the big data pipes south of the border.

      I don't think people are getting it yet.

      Between Australia, the UK, and the US, something on the order of 90% of the global data traffic runs through the leeching backbone nodes that have sniffers attached to them. They don't need the cooperation of your local governments and ISPs to do their dirty work.

      • by nebulus4 (799015)
        The data pipes through Sweden and they do sniff the traffic. I wouldn't be surprised if they share the data with US and UK.
      • Re:Runbox.com (Score:5, Insightful)

        by BUL2294 (1081735) on Saturday August 10, 2013 @01:41PM (#44531593)
        But the on-site / server backdoors are necessary unless there's some unknown backdoor built into SSL that the NSA, MI6, IDF, etc. can utilize. By default, my GMail uses HTTPS, but the NSA's backdoor to Google servers negates that advantage.

        So, unless there's an unknown backdoor built into SSL, as long as Runbox.com uses HTTPS, how should "Australia, the UK, the US", etc. know what was transmitted unless they use a brute-force attack?

        Just yesterday, NPR indicated that US-based cloud platforms stand to lose between $21 billion and $35 billion over the next few years over the NSA scandal... http://www.npr.org/templates/story/story.php?storyId=210570888 [npr.org] . Lavamail and Silent Circle shut down unexpectedly & destroyed all data they had to not get caught up in the scandal...
        • by msobkow (48369)

          HTTPS only encrypts the traffic between the server and your client.

          Most email traffic is transmitted in plain text between the servers connected to the pipes, not over SSL.

          The way it works is this:

          • Set up the monitor/sniffer to watch the IPs that are running mail traffic. All you need is the IP address and the port number.
          • When a request comes in to connect to the mail server, enable a responder watch to capture the port that is assigned by the server for the TCP stream. You don't even need to know
          • by msobkow (48369)

            The "back door" boxes that the NSA has installed on US services like GMail make it easier for them to collect the data, but they can do it regardless of whether a given ISP cooperates, as long as they know the IP and port of the email server the ISP is running.

            What? You thought the NSA had their little black boxes installed here in Canada? Hell, no!

            • by msobkow (48369)

              The other reason for the black boxes is to capture email between GMail users, for example. But as soon as you email someone with an address on a different email provider, your email contents are fired out plain text over the backbones between those servers, so they can capture it using the traffic sniffing approach.

              The only way your email would be safe from the sniffers is if you only emailed people on the same out-of-country ISP you're proposing, and used SSL for all your email client's connections to/

              • by msobkow (48369)

                By the way, the email headers are never encrypted. Only the body of the email is, so they can always get the "meta data" for your email message indicating who it's to/from and such, regardless of whether you encrypt your email or not.

                • by mysidia (191772)

                  By the way, the email headers are never encrypted. Only the body of the email is

                  False. IPSec, SSL, TLS, or SMTP tunnneled over SSH, or other ad-hoc encapsulation protocols with encryption features can be used to secure the transport between cooperating mail servers.

      • Agreed. I don't think hosting your email in another country will do much to secure your email. If anything, it will make you a bigger target, since they've claimed their attention is pointed most directly in communications going in and out of the US.

    • by westlake (615356)

      it's pretty cheap considering, they do not have any NSA-ties or the likes.

      You can't know that for certain. Redbox's internal and external auditors can't know that for certain.

    • by amiga3D (567632)

      Those prices look damn good. You like the service.

    • by stenvar (2789879)

      Some countries, especially in Europe, have a constitutional guarantee of secrecy of correspondence, wherein email is equated with letters and therefore protected from all types of screening and surveillance.

      They also have numerous exceptions for national security, and fairly low thresholds for police and courts to actually get at the data.

      Central principles of the Norwegian data privacy regulations are:

      Notice how those principles only protect you from private entities (and are pretty vague too).

  • by tonytally (2856861) on Saturday August 10, 2013 @12:25PM (#44531037)
    You'd really rather have the KGB looking over your shoulder rather than NSA? Surely you are joking.
    • by Opportunist (166417) on Saturday August 10, 2013 @12:30PM (#44531089)

      As a US citizen, I sure as hell would prefer the KGB looking over my shoulder. the chance that it has any kind of impact on my life is far lower.

      • Re: (Score:3, Insightful)

        by Princeofcups (150855)

        As a US citizen, I sure as hell would prefer the KGB looking over my shoulder. the chance that it has any kind of impact on my life is far lower.

        Considering it was disbanded in 1991, I wouldn't worry about them either. Americans really don't care about world history do they (we)?

        • by 0111 1110 (518466)

          It is the NKVD or GPU that we should really be worried about.

        • by utkonos (2104836)
          Disbanded? Hardly. It's alive and well, it just changed its name to Federalnaya Sluzhba Bezopasnosti (FSB) from Komitet Gosudartvennoi Bezopastnosti (KGB). HQ is the exact same building (Lubyanka), which by the way is the tallest building in Moscow (because you can see Siberia from the basement). It has all the same people working for it that worked for the KGB.

          However, they are probably not the group in the government that would be reading your email. That group is the Russian Federal Service for Mass
    • by Xenx (2211586)
      I would assume they meant they'd rather a foreign government that isn't likely to care about them as an individual, instead of the local government which may.
    • by Bruce66423 (1678196) on Saturday August 10, 2013 @12:33PM (#44531109)
      Ultimately there are two reasons why - apart from the yuck factor, which is legitimate - why you don't want the NSA reading your email 1) If you say or do something which generates a shadow of suspicion, the probability that the Russians will act on it, to the extent of a SWAT team beating your door down and shooting your dog, is lower 2) If you are politically active, it's going to be less likely that the Russians will provide data to the FBI about your dubious activities Sure - avoiding either is a better ideal - but perversely I would prefer the KGB, unless I am resident in Russia, in which case they would be a very bad idea.
    • by gmuslera (3436) on Saturday August 10, 2013 @12:50PM (#44531251) Homepage Journal
      The KGB still don't send drones to kill innocents to other countries, things that happen with the NSA if you are not in US, and maybe in a short time, even if you are.
      • by lxs (131946)

        That's right. Although the KGB has long since passed the torch to the FSB, and the FSB still sends humans to do their dirty work. [wikipedia.org]

    • by PolygamousRanchKid (1290638) on Saturday August 10, 2013 @01:01PM (#44531329)

      The FSB and SVR, the artists formally known as KGB, have limited resources. They are used to going after those that they evalutate as threats.

      The NSA has unlimited resources. The NSA just goes after everybody. They can afford to skip the evaluation phase.

    • by sshir (623215)
      Actually, it's a rather common practice. Assumption is that with the exception of rare cases (i.e. Chechens), KGB (a.k.a. FSB) does not talk to FBI. So they are played against each other: Don't want NSA reading your stuff - tunnel to mail.ru (or such), don't want FSB - tunnel to gmail. Don't like both reading the same message - try Asians (and btw, you have some serious problems my friend.) I would not go with Europeans though - there were some nasty scandals in the past (even with Swiss of all nations)
  • Wrong question (Score:3, Insightful)

    by Anonymous Coward on Saturday August 10, 2013 @12:25PM (#44531039)
    Since the NSA programs are designed primarily to intercept communications between US and non-US folks, if you are in the US and store your mail somewhere else you are asking the NSA to collect all of it. Today, if you are in the US and have your hosting in the US the NSA only gets the parts that go between you and someone in another country (or where you said some "interesting" thing like "that new pressure cooker that fits in my backpack for camping is the bomb". If you move your mail to another country, the NSA will be collecting it all (assuming your communications end point is still in the US). Yes, encryption, VPN, yada, yada. You really don't gain much by moving it.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      Since the NSA programs are designed primarily to intercept communications between US and non-US folks,

      You haven't been listening. They are designed to intercept everything. The queries are supposed to relate to outside communication and/or anything else of interest (by definition, if someone looks at it for some reason, that means it is of interest). But everything is intercepted.

      Yes, encryption, VPN, yada, yada. You really don't gain much by moving it.

      Except that decrypting stuff is expensive, so the average NSA snooper will incur traceable costs he might need to justify better than "oh, I just had a hunch I might be interested in my neighbors mail".

    • by gl4ss (559668)

      eheh.
      the whole debacle is about NSA applying such rules in quite loose form, they dont' care for shit.
      Today if you're in the USA, NSA can get it all "by the book"(their book, not the lawbook) because you talked to some dude on a foreign forum - you did that by posting on slashdot. so you're screwed.
      but true, it doesn't help much, only thing that would help would be to get people sending you mail to encrypt it before they send it to you.


      however - hosting it outside of USA definitely does help against men in

      • by Z00L00K (682162)

        Just figure out which countries that are a pain in the butt for the US when it comes to politics and host your mail there.

        I just wonder if this is going to be a new market for states like Switzerland, Lichtenstein, Luxemburg and Jersey now that they have started to share some of the bank information.

        But Germany is actually a good alternative these days.

  • Roll your own... (Score:5, Insightful)

    by flogger (524072) <non@nonegiven> on Saturday August 10, 2013 @12:27PM (#44531049) Journal
    My email server is sitting in my laundry room. I also host some message forums and picture galleries for just my family and friends. It is how I communicate with them.

    Only about 1/3 of my family and friends use my server for email.... So any over seas email service is going to have the same limitation as mine. If I email my sister from my server, that email goes to gmail. So now the NSA knows what I sent to my sister.

    So unless everyone you communicate with is outside of the US or on a server outside of NSA's reach, it won;t do any good.

    Sorry to break it to you, but in the war against terror, the American people have lost.
    • I agree completely, roll your own is the best method. The only issues with it is technical know-how, and ISP limitations (and cost). But if those are a non issue, there is no better solution.

    • by wezelboy (521844) on Saturday August 10, 2013 @12:55PM (#44531283)
      Let's get hypothetical...

      One of your nephews or cousins that uses your e-mail server decides to purchase a pressure cooker online. He also has some friends in Europe that he e-mails once in a while. What do you do when the NSA asks you for all the e-mails stored on your server?
      • Demand a search warrant issued by the local county or state judge, and have the county sheriff deliver it in person. No search warrant, no search.

        • by wezelboy (521844)
          That might by you some time at best. You can wipe the server drives, but then you will be charged with contempt or worse obstruction of justice. The first you may hear of it is your front door smashed in and cops with guns (and a warrant) in your house.
      • Re:Roll your own... (Score:5, Interesting)

        by ImdatS (958642) on Saturday August 10, 2013 @01:18PM (#44531443) Homepage

        A while ago I had a similar thought. My solution was quite easy:

        Install an email system that does the the following: Normally, when "standard" email arrives, it is processed as usual.

        When an email arrives from an authorized sender (such as you), in a very specially formatted way and with special content, the mail server immediately starts destroying all emails, all communication logs, and all attached backups. It literally not only unlinks the files, but also replaces all impacted file-contents with "0". You can even do it on block-level completely reformat (overwrite) the hard disc in a way that it looks crashed. It then initiates a clean re-install of a clean, unused, fresh out-of-the-box system.

        The only that you have to do is to make sure none of the backups are available... Then again, I would probably NOT have historical backups of emails outside somewhere, but rather backups on devices that *are* connected to the server and erase those too...

        End result: "Ooops, sorry, but it seems, my server has crashed..."

      • by ImdatS (958642)

        Alternatively, you could have everything on an encrypted hard disc and instead of deleting the files, you delete the key (overwrite it on a block-level). So could hand-over the hard disc but since the key is not retrievable anymore (and you could make it so that it looks like a hard disc failure), that's it...

    • I run my own email server as well. Not hard to set up and maintain dovecot+postfix + roundcube (optional) at all but unfortunately a lot of people are a bit *too* addicted to convienience and have outsourced everything to the Big Bad GOOG
    • by FridayBob (619244)

      Completely agree; I've been doing it like this for longer than services like Gmail and Hotmail have been around. However, with XS4ALL as my ISP here in the Netherlands, things have certainly been made easy for me. For example, my DSL connection has a fixed public IPv4 address and PPP makes it relatively easy for me to arrange for my public IPv4 address to be on my personal server. In turn, this not only allows me to run my own firewall and NAT, thus affording me far better security than I can expect from t

    • by Manfre (631065)

      Rolling your own server is great, but email's fundamental purpose to to send and receive. Unless you are certain both end points and all hops in between are secure, it's pointless.

  • by MarioMax (907837) on Saturday August 10, 2013 @12:29PM (#44531071)

    Domain names are relatively cheap, and hosting is relatively cheap. I go that route myself. The only people that have access to my server is the hosting company (which is no worse than Google to be honest)

    if you have the means, the very best solution is to run an email server out of your home or place of business.

    • by GrBear (63712)

      As one who's tried to setup a mail server under Ubuntu several times, there's alot of black magic and voodoo involved to get it to work right, including vacation messages.

      We're still using antiquated software like sendmail and dovecot that requires a degree to understand the cryptic config files.

      This is not for the faint of heart, and certainly not plausible for the average user. Until something more user friendly comes along, don't expect this to happen all that often.

      Zimbra by VMWare seems to be making g

  • Wrong Question (Score:5, Insightful)

    by ocularsinister (774024) on Saturday August 10, 2013 @12:33PM (#44531107)
    What you should be asking is "How do I get everyone to sign and encrypt their emails as a matter of course?"
  • by dgatwood (11270) on Saturday August 10, 2013 @12:38PM (#44531141) Journal

    From all reports, most or all of the countries where spying occurs, despite their very vocal public outcry against what the U.S. is doing, are in fact sharing information with the U.S. government. And even if they don't, the U.S. can simply grab the data on its way out of the country to that server.

    The only way to make email secure is to abandon email in favor of a protocol that supports end-to-end encryption, such as iMessage, XMPP, etc. and to tweak your centralized server and/or clients to require that end-to-end encryption be used. And even then, the metadata (who sent mail to whom) is at risk. The only way to prevent metadata from being trackable is to either develop a new system in which locating a user does not require credentials and use Tor to connect to the centralized server (e.g. use wide-area Bonjour to advertise your current IP address) or design a whole new messaging system built in a darknet.

    Either way, email is and has always been just as secure as sending a postcard (which is to say, completely insecure), and cannot readily be improved upon significantly in this regard without starting over from scratch.

  • use encryption (Score:5, Insightful)

    by stenvar (2789879) on Saturday August 10, 2013 @12:38PM (#44531147)

    Many E-mail providers overseas require you to give personal information to sign up, often due to legal requirements in those countries; sometimes they verify that with a credit card number or simply by comparing your address data with government databases. Many countries (including much of Europe) also have data retention requirements and give their own police and intelligence service nearly free reign, and they may well exchange data with the US anyway, so it's not clear you're better off. And some providers of anonymous services may simply be fronts for intelligence agencies. And, of course, if the other parties to your E-mail use a US provider, your data is already available to US intelligence agencies, and your foreign E-mail account will stick out.

    As an American, if you want to communicate privately, you have to use encryption, and preferably steganography. Getting an E-mail account in another country really doesn't help very much.

  • by msobkow (48369) on Saturday August 10, 2013 @12:43PM (#44531193) Homepage Journal

    If you are emailing people who use GMail, Live, Yahoo, or a US ISP for their email provisioning, your emails to/from them are still tracked. So unless you're planning to drop all your US contacts as well, you're not helping yourself much.

    Here in Canada we have a bigger issue -- all of our network pipes connect to the bigger pipes in the US. So even though we might be emailing a fellow Canadian from one Canadian ISP to another, the traffic still gets routed and sniffed through US servers.

    The same is a problem for people in the EU -- the emails get routed through the pipes that are monitored by the UK's spy agency.

    The NSA doesn't have to install backdoors on email servers to monitor you at all. And they *don't* typically make requests when they're spying on someone in particular -- they just sniff the traffic on the big data pipes directly.

    And seeing as all those pipes run through the major partner countries like the UK, Australia, and the US itself, we're *all* fucked.

  • Try https://prism-break.org/ [prism-break.org] for some recommendations of OS, email, IM and more.
  • NSA and GCHQ are also siphoning off data from the telcos (BT and others) at the telecoms servers, at which point who your email provider is becomes irrelevant. [You can assume that anything GCHQ knows, the NSA also knows]. It has also come out that BT has allowed GCHQ to tap the Transatlantic cables at the shore station in Bude, Cornwall without the knowledge or consent of several telcos that are not otherwise co-operating. So AFAIK you need either (1) a non-US non-UK telco and ISP with a routing that does
  • You should probably take into account that the few, and obviously mainly ignored, privacy protections you do have evaporate the nanosecond your communication leaves U.S. borders. Supposedly within the U.S. the NSA is limited to email metadata collection (look up the older term 'pen register' for the legal history of law enforcement access to this kind of information), but when you interact with a 'foreign agent' the sky's the limit. Ellison may have known more than we thought when he said, "You have no priv

    • by Clsid (564627) on Saturday August 10, 2013 @01:06PM (#44531369)

      I think there are ways around it, not a 100% perfect but at least make their job a lot harder. Services like lavabit were good and it goes to show that they needed to use some nasty legal tactics to make them open up. Those tactics are not available when you use providers in countries like Russia or China. Sure, they can tap the underwater fiber all they want, but I think it still is better than nothing.

  • Startmail (Score:2, Informative)

    by Anonymous Coward

    www.startmail.com -- currently in closed Beta -- and based in the Netherlands.

  • by FuzzNugget (2840687) on Saturday August 10, 2013 @12:54PM (#44531269)
    Securing your local data is easy, because you have end-to-end control. Securing email is complicated because you'll never be able to maintain complete control. It requires coordination and mutual understanding between you and everyone you email, and that's just not going to happen unless you're in a tightly-controlled organization and all of your communication is internal. I'm assuming you're an end-user at home, not an IT manager in a large corporate environment.

    If your ISP allows it (and that's a big if in today's spam wars), you could run your own email server to host email service for yourself, your family and your friends and require SSL/TLS connections for all communication. Don't forget TrueCrypt or luks/dm-crypt for disk encryption on the server itself. But this only protects against eavesdropping and snooping for email users on your hosted service. There's basically nothing you can do about emails sent or received from outside of your own service. And then there's the assumption that email recipients inside of your hosted service will adequately secure their own devices (good luck getting grandma to use TrueCrypt).

    If you can actually accomplish this, well, you have better powers of persuasion than I (my boss is a smart and tech savvy guy and I can't even convince him). Your best bet is: don't use email for anything you wouldn't want publicized.
  • The best I have found so far are Yandex from Russia and Netease 163.com from China. 163 is extremely fast if you are in China, but it has some advertising and the interface is all Chinese, so I would suggest the English version of Yandex mail instead at mail.yandex.com.

    I'm planning to get a dedicated server with the state telco in Venezuela for precisely this reason. That and also run a Tinyproxy/OpenVPN and figure out WebDAV to have my own Google Drive/SkyDrive, etc. If anybody is interested just write to

  • by phantomfive (622387) on Saturday August 10, 2013 @01:08PM (#44531379) Journal
    Hushmail is one of the oldest 'secure' mail systems, and they moved out of the US specifically to avoid problems like the NSA. They're worth looking at, I guess.
    • by (3015109)
      Except HushMail won't hesitate to deliver a unique java client-side applet embedded with a keylogger to intercept the target recipient's passphrase. They are a Canadian company and we have a tighter working relationship with Canada than any other Country to the point that we used to send all Macs up to Canada and have the RCMP perform forensic analysis on them. We stopped doing that when we built-out our own facilities. Google the National Computer Forensics Institute in Hoover, AL. Now Canada sends their
    • by longk (2637033)

      They've given up content of e-mails to authorities a number of times.

      Any solution which allows the provider to hold the keys if doomed to fail in protecting your privacy. We need zero-knowledge e-mail providers. Kind of what Wuala and SpiderOak do, but for e-mail instead of cloud storage.

  • I haven't tried it myself, but the people who sell this are well-known old school Portuguese geeks: http://www.fullmailserver.com/ [fullmailserver.com]

  • Actually, NSA by law is allowed to intercept communications outside the United States. In fact, that's its mandate. So they don't have to be sneaky and underhanded to try and sneak around the law like the bull shit currently going on with US providers. Now using a non-US provider does mean that the intercepts have to be "on the fly", but that isn't a major problem for the NSA given the number of intercept facilities they have. To be perfectly honest, given the current state of technology, the only real prot

You can do this in a number of ways. IBM chose to do all of them. Why do you find that funny? -- D. Taylor, Computer Science 350

Working...