Tutanota likes to tell everyone that they are literally Signal in the email world in terms of security. But there is a known vulnerability in their "E2EE":
https://github.com/tutao/tutanota/issues/768
There is no way to verify key fingerprint of your recipient right now. So server can just man-in-the-middle you providing third-party key and read all messages silently. It is not e2e encryption if you have to trust the server. Period.
It all comes down to truth in advertising. Such misrepresentations are very common these days. Even Signal is not entirely innocent here. Signal only has the potential to have end to end authentication/encryption. By default you trust Signal, Twilio and the phone company. The app/documentation does not make it entirely clear to the user that verifying the "Safety Number" is critical to establishing an end to end connection with someone. From the Signal documentation:
>Verification of safety numbers is a good security practice for sensitive communication.
It is perfectly OK for a user to trust, say, Tutanota to not take an affirmative action to get access to their messages. We need a way to express this sort of tradeoff and providers should be required to put this expression where the user can see it and understand it.
Tutanota published a ranty blog post accusing Microsoft of suppressing competition in the email space. Because they didn't understand how fucking Azure works or even how corporate security works.
They literally let users register email addresses for @tutanota.com
At the same time, they are using @tutanota.com for internal corporate and such they had an Azure AD Tenant already registered for that domain.
They complained that their tutanota.com email users couldn't register Microsoft accounts and this was all part of Microsoft's ploy to eliminate them.
No, they compromised themselves and unless they grew a brain, are still compromised for corporate communications.
Key verification is an important part and we are working towards the goal to enable easy authentication. However, we are not happy how manual key verification works with Signal nor how it is implemented with GPG (Web of Trust). Most (at least 95%) don't verify keys with Signal because it is too cumbersome.
As a first step, we are currently addressing cyptographic authentication of incoming messages. Our development team is implementing this feature as part of the work on tuta crypt, our pq messaging protocol. It will be released within the next months. However, we have to admit that easy and automatic key verification will take some more time as we are still researching best options to implement this.
Can you? It's arguably much more annoying than other providers because you can't use a normal email interface. I've been trying to switch off it for a while and just use a normal provider with simplelogin slapped in front. Also, the spam filter isn't very good.
You can do this with any email. What's your point? The reason for the rise of email providers advertising encrypted email is because PGP is a pain for most people to use and never saw widespread adaption among regular users.
you cant because tutanota has no POP/SMTP/IMAP so its basically just a web form. you could of course add PGP to any such communication medium but it wont be very standard
We don't list StartMail because it's not really zero knowledge (if you look at their "vault" system it's basically a LUKS container which is "opened" when you login server side). The author of PTIO puts no effort into reviewing/reading or understanding how any of the recommendations work.
Interesting, thanks for the heads up, this has somehow passed me by. I loved privacytools.io in its prime, I think reputable sources for this kind of information must exist. I'll look into privacyguides.org as a replacement for it.
Thanks for your feedback. We're planning to re-do the search implementation completely as it needs a major overhaul to quickly search larger mailboxes.
We're constantly improving the service, for instance we've just added unlimited email addresses with your own domain (https://tuta.com/blog/summer-releases-2023) so always happy to hear feedback and how we can meet your needs!
There's no exact ETA as we haven't decided whether to do import or improvement of search first. Regardless, it is one of the next to-dos on our list. You can track our roadmap here (we're going to update it soon): https://tuta.com/roadmap
> Tuta became understandably a walled garden that my other tools couldn't easily work with.
This is the part that resonates with me very strongly right now. I have always been concerned about privacy, security... re: the applications I use. Recently, I started to question this in regard to some applications.
I needed a WiFi-friendly way to SMS & call for about a year and opted for Signal. The year's over, no longer need Signal. Now I find that I can't delete Signal without losing the (very boring) chat files forever.
Signal does not support exporting, saving chat logs. I looked into 3rd-parties:
1. Great solution by YourFavouriteElite (2 years old) - sadly it failed
3. Also... I'm finding that I'm having problems communicating with Apple users over regular SMS. I will often not receive their SMS messages unless I turn on WiFi (I'm on Android). This could be several hours after they sent it. I have not bothered to investigate further but it feels like more walled garden stuff, competing protocols, etc..
There just doesn't seem to be a nice 'in-between' between security/privacy and closing yourself off from your data.
'nuf said. I think I'm ranting now mostly because I didn't make the right choice early on for my needs. I just didn't think it through.
For me, the "Inbox rules" hasn't been working as I expected—some emails doen't end up in the folder that I want. The experience of editing rules feels awkward.
And I cannot "bridge" Thunderbird to Tutanota to apply my filters.
Recent price change was the last straw to make me another end-to-end encrypted alternative.
Recently I switched to Proton Mail with advanced Sieve filter [1] and feel much happier.
What is $normalemailprovider? I have been looking for an alternative that is more standard, but it seems like only Fastmail is big in this space. The rest are small shops that don't convey a lot of confidence.
Not sure what qualifies as "normal", but I've been happy with mailfence.com for a few years now. I rarely see them mentioned in privacy lists, which I appreciate, as I don't want them to get too much attention. :)
They're based in Belgium, and have a solid stance on privacy and security. They provide IMAP/SMTP access, calendar/CalDAV, contacts/CardDAV, custom domain names, filters, spam blocking, etc. It's a pretty well-rounded and maintained service. The web UI is not the most modern, but it's usable.
The police were able to get a lot of info from mailfence to catch a stupid student who thought using a vpn and mailfence would enable him to send threats easily to the richest man in india. The police got info on how many accounts were from this country, how many of them were active, monitor the mail account for new mails etc..
No reputable email service will allow you to use it to commit crimes. If the activity is against their ToS, and they get a legal warrant to provide information to the authorities, then this goes beyond any reasonable expectation of privacy.
Mailfence is pretty open about this[1]. Their privacy policy[2] also seems reasonable. Their only obligation is complying with Belgian law, and I'll take that any day over a service within the Five Eyes jurisdiction.
Ah, good to know. Although, Crime means nothing when police can easily just register a fake case and ask to monitor your email id. India has fallen a lot in human rights ranking in this decade.
Fastmail is supposed to be good. But you can just buy your own domain with Email hosting. It is free with gandi.net. Or use https://www.infomaniak.com/
Infomaniak also sells email hosting for around 20 Euro per year, they are based in Switzerland. If you have your own domain, just type the domain name as you would buy the domain and if the interface says domain taken, select email hosting (the three dots).
You can also get your own domain, and have FastMail host your e-mail with that. It has the benefit of not tying your e-mail address to any single e-mail hoster: you own the domain for it.
FastMail has excellent documentation to get this set up. Migrating there from GMail (were I already used my own domain) was a breeze.
"So, further to recent changes at Gandi, I've just got some more info from support which I've included below. I've purchased domains from Gandi, pre-paying for multiple years of service such that some domains I have don't need renewing until 2027. When I purchased that service the offer was inclusive of 2 mailboxes for the duration of the contract, and now they're planning to remove those inclusive mailboxes and start charging me extra for them from next month.
To me, this sounds like a planned and fully intentional breach of contract."
Sorry, I was not aware that they changed. Currently I don't hold a domain with them. They were always a decent provider. This behavior seems very unfortunate.
I recently started using fastmail and am generally please with it. The only downside is that it's based in Australia, a country who's hatred of privacy would make even the NSA blush.
Just note that fastmail‘s search is basically useless if you expect Gmail-like search (unless I am missing some sort of trick to get it working). The rest of Fastmail is excellent though.
I use thunderbird IMAP and honestly, the search is not great either.
If I have trouble finding something, recoll normally does the job. It indexes thunderbird too. And should you have a ZIP attachement in thunderbird, it will index the content too. :-). I think you could even set up up with cuneiform that a PDF inside the ZIP attachment goes through OCR should it not be plain text.
(I work for Fastmail). Our search is comparable and in some ways more powerful than Gmail's search. If you're having problems, please create a support ticket (or just email support@fastmail.com) and we'd love to look into that for you. Thanks!
Can’t say I’ve had many issues with Fastmail search at all. Google is known for search so they would naturally prevail for some searches, but Fastmail does just fine.
I usually suggest people to take a look at these: mailbox.org, runbox.com, mailfence.com, posteo.de (this last one doesn’t support custom domains). They’re all cheap enough, provide IMAP and POP, and are located in different countries in Europe.
This is a good move, but I think the domain name for Tutanota needs to be simpler still, or at least more English-friendly if they want marketshare in the anglosphere.
I used Tutanota for a bit. Great product,all around better than protonmail from technical and usability standpoint, but I stopped using it.
Why? You don't realize how often you give out your email over the phone or to someone verbally. "Tutanota" is simply way too easy to screw up. Tootanota? Tutanoda? two-ta-what??? Even when there wasn't a struggle passing this along to someone, I'd always be worried that they wrote it down incorrectly.
I know I could get my own domain, but still, the default email should offer a domain that's easy to spell (e.g. proton.me).
> Those who have stored account login credentials in their favorite web browser will need to transfer these credentials to the new domain to continue accessing the account. We have integrated an automatic transfer of the stored credentials, which you simply need to click through: Please visit the old login page "mail.tutanota.com" and you will be prompted to migrate your credentials with a few simple clicks.
I didn't know that this was possible. It is a feature on browser's password managers? How it works?
- (To my knowledge) Tuta doesn't have secondary services like VPN, etc.
- Tuta intentionally does not provide a bridge for email. So everything with their service has to be done through their apps. If you want to use your own email client or command line tools (such as for submitting patchsets to mailing lists), that's not an option.
"So everything with their service has to be done through their apps."
What sane person would do this? Use infomaniak instead (Switzerland). Tuta seems to be a German company. There is another one, I forgot the name but a few friends of mine were using it. I used google, could not find it but I am actually surprised that there are many providers. E.g.
I use Gmail, and have exclusively used the web app and Android app to access it, for, what, 15 years? I don't think it's insane, if those apps work well.
Your example is wrong. Gmail offers standard email services that you CAN access via a proprietary Google app OR to a regular app. I use my gmail account with IMAP via Thunderbird. As long as IMAP access is offered, everything is fine.
As a word of caution: Should you ever lose access to your gmail account, you run into deep trouble. I currently can't access my gmail. I know the password, I have access to my backup email but it won't let me log-in except if I am able to confirm it on my android phone. And my US android phone is out of service. I have to fly to the US to get this working again (Google project fi).
But even with gmail, they give you the option to use your own apps because they support standard protocols that you can use to sync your emails.
For E2EE email it's a bit different because most of the standard protocols don't work out of the box but it's very clear that whatever system Tuta uses works locally or they wouldn't have anything but a web app.
I'm not saying don't prioritise your apps, I just want to be able to mutt and send in patches easily. And my grandparents want to use their outlook because it's what they know how to use.
"But hey, "open source all things" have decided I must use 4 products from 4 different providers to send an receive emails so that I am "safe"."
Depends. For my mother? She is fine with gmail. But an IT savvy person should consider having their own email domain. And why not host your own rss reader and a few other things. It is rarely a good idea to buy this out of one hand. So domain registrar (e.g. internet.bs ), email hosting (e.g. infomaniak.com ) and hosting (e.g. nearlyfreespeech.net ). So we are close to your 4 different providers.
"Products should just work the way they are intended to be."
Until they don't. Until you get blocked (try calling google email customer service). Or until they go bankrupt. Your license? Sorry, the server for license validation does not exist anymore. Or until somebody decides what you can do with the product and what not. Doing your own thing and using open source gives your freedom.
if you don't pay for the product you are the product.
> But an IT savvy person should consider having their own email domain.
Having email domain is different than hosting your own email servers. And even that - why would I care so much? There are plenty of articles here on HN of people telling how hard it is to host your own email servers.
Plus, tech-savvy doesn't mean I want to waste 2 hours a week updating managing servers etc., while I could maybe learn ... "Flutter"? Or technology X. Or something else completely different.
In general, assuming what a group of people should or shouldn't do seems pretty naive to me.
> if you don't pay for the product you are the product.
I pay for Fastmail and it works. Until when? I can't tell - I hope they don't go bankrupt. But they offer a good service, decent price, and it gives me 1-2 hours of life back per week or month.
I understand your counterarguments, however nowadays there is enough variety that enables us to use products and services for quite some time. Even open source can get you into "vendor" lock-in, especially when a tool or product doesn't evolve anymore and the community doesn't have interest or manpower to improve it.
I said buy email as a hosted service. I consider myself IT savvy but I am not a CS guy. I tried hosting my own email before and I can assure you, if you are not absolutely sure you know what you are doing (inc. spam, greylisting, blacklisting etc.). DONT DO IT. I would possibly even be impossible to send email to services like t-online if you really host your own email.
Your citation is cut off and doesn’t show why Posteo says it won’t support this..I’m pasting the entire answer from Posteo on this topic [1] here:
> Can I use Posteo with my own domains?
> “No. We are an email provider with a particular, privacy-oriented model – and this is not compatible with incorporating own domains. One of our emphases is data economy: we do not collect any user information (names, addresses, etc) of our customers. We always answer requests from authorities for user information in the negative. On the other hand, own domains need to be registered to the name and address of a person. If you were able to use own domains with us, this would affect the entire concept of Posteo: we would need to start saving user information for all customers who use their own domains with us – and to provide these to the Federal Network Agency to be provided on request to the authorities.
Even if only the MX record pointed to us, we would still need to store the assignment of the domain in your Posteo account as user information. Thus we would possess your user information and be required to give it out. For this reason, we have decided not to offer this possibility and instead to use data economy.”
Whether this sounds fine or not and whether this is acceptable to someone or not is subjective.
The desktop client is basically a web app, little different from running it in the browser. As for the app, I have been pretty unimpressed by it; performance is sluggish, and emails are displayed poorly (lots of unreadably small fonts with no options for text resizing). Worst of all, development seems to be either inactive, or so slow as to be undetectable.
I paid for Tutanota and started switching to it from Gmail, but the accumulation of inconveniences is starting to make me consider switching back, in spite of all the Google privacy issues.
Can use Proton for accounts you will rarely check. Free accounts on Tutanota are deleted if haven't logged in 6 months. (And cannot remake one with same address unless you pay.)
Switzerland vs Germany, laws and governmental coercion history. There is also the individuals running them and their background and scale of operation, proton is much more used so it is a bigger target but it also makes more money so more resources for tech and legal stuff.
Why exactly do you believe Switzerland is better in terms of data protection than Germany? Do you not need to share data with the US as well upon request? The good thing - in both countries - is that it has legal oversight, besides the data on our servers is encrypted so we don't really see the location benefit here.
And what about data retention laws in Switzerland? In the past, you said Protonmail is exempt from this as its too small. Would be interesting to know if this is still the case?
Proton does proper email crypto that works with other providers (normal PGP) and tuta does their own thing (not saying Proto is good tho, it's still a horrible web UI and comes with its risks)
1) Does anyone know why he does not recommend Tuta(nota)?
Edit: I missed the footnote
> Do they make unfounded claims about security or privacy, or develop techniques which ultimately rely on trusting them instead of supporting or improving standards which rely on encryption?
> This also rules out ProtonMail and Tutanota, doubly damning them, especially because it provides an excuse for skipping IMAP and SMTP, which conveniently enables vendor lock-in.
I see from other comments that they don't support IMAP/SMTP and force their own apps.
2) Does anyone know why he stopped recommending mailbox.org? He changed it a few weeks ago without any explanation I can see.
cock.li is a pretty good E-Mail/VPS provider from what I heard. From their homepage:
> How can I trust you?
You can't. Cock.li doesn't parse your E-mail to provide you with targeted ads, nor does cock.li read E-mail contents unless it's for a legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). For privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our server.
Also, there's this quote from /g/:
Administering a mail host is sort of like being a nurse; there's a brief period at the start when the thought of seeing people's privates might be vaguely titillating in a theoretical sense, but that sort of thing doesn't last long when it's up against the daily reality of shit, piss, blood, and vomit.
Now that I think about it, administering a mail host is exactly like being a nurse, only people die slightly less often.
--------------------------------
They also publish all emails/call recordings when dealing with law enforcement on their transparency page.
Ah yes the alt-right paradise. "@hitler.rocks" and "@nuke.africa" are really nice domain to have :)
The administrator of cock.lu also famously hosted with oVo systems some more than sketchy boards.
As stated by Le Monde[1] Kohlchan was hosted on OvO Systems, which was owned by Vincent Canfield. If you can't read the end of the article due to the paywall, you can use the reader mode of Firefox.
You can also see that cock.li is hosted on OvO Systems on the footer.
From what I understand OvO Systems runs a VPS host (cockbox.org) and after Krautchan shut down, Bernd rented a VPS on cockbox (since they allow anonymous payments) to host a Krautchan successor named Kolchan. So yes, OvO Systems hosts it, but the admin is not actively involved, similar to how the Hetzner admins aren’t involved in Plex movie warez services being hosted on Hetzner dedis.
Cock.li on the other hand is run by the OvO systems owner himself.
Who's to say that it's distasteful? Humor is very subjective.
I'd also argue that most people that complain about those jokes unironically think that author is actually racist, like it doesn't even cross their mind that it could be a joke, even a "bad" one.
Ironically, the fact that some people react in this way makes these jokes even funnier
I'm a happy (non-German) mailbox.org customer. They are clearly committed to their core offerings and their pricing is fair.
I have previously also used Migadu, but I migrated to mailbox.org. Can't remember why exactly and looking at migadu.com again today, they seem to tick all the boxes for me when it comes to personal email. I remember they had a great UI in general, but in particular the settings UI was fantastic.
He seems to have a pretty clear idea what he is talking about.
I mentioned infomaniak.com already as an Email provider (can bring you own domain). It is also Switzerland. But regarding law enforcement, posteo.de did a pretty decent job. E.g.:
I once saw a long post from posteo with examples for idiot law enforcement trying to get customer data. Sometimes even writing from private emails (e.g. gmail). Without a court order, such requests are not legit.
Tuta is just weird. It's not really email, it's more like an encrypted chat.
If you send a "mail" to someone who does not have tuta, guess what, they are invited to tuta xD
Tutanota is one of the uglier and at the same time pretentious projects. As far as I'm concerned, this crap can't be called e-mail at all. This is some crookedly made homemade work. They don't support the usual protocols for receiving mail, the search is just terrible, all kinds of freaks use them for their dark business, so these left-handed idiots have even started to be added to ban lists. I recently spent half a month persuading the bank because I stopped receiving notifications. And I would also like to see the "engineer" who invented encrypting letters to other providers using a "password". Well, that is, this whole team of developers, managers - they were not upset by such an idea at all. Implement PGP? Let everyone post public keys and write to each other? No! What nonsense! It's better to go somewhere through a browser and enter some crappy password. And should I trust these bastards with my mail? I would spit in their face. I think this row should be filed for bankruptcy.
With no guarantee of compliance, nor guarantee of a backdoor not being added to this service - it’s hard to put Tuta ahead of any other supposed privacy-first provider. They didn’t pull a TPB and tell the court to get fucked, and exit the country. So it’s hard to assume they’ll ever not comply with a backdoor order.
So instead I’ll opt for the one least likely to go under, with the most features. And it’s not Tuta.
You know that courts exist for a reason, right? I know for a fact that the most infamous ransomware organization at the moment, the one actively targeting hospitals with double extortion and then dumping terabytes of patient data including social security numbers, medical records etc. publicly, used Tutanota at one point to communicate with victims.
This isn't an out of sight out of mind situation, if you ask for bulletproof hosting you will face consequences on way or another and you can't just ignore that in a calculation. Same as you don't ignore the consequences of abuse of political power clearly.
There is no way to verify key fingerprint of your recipient right now. So server can just man-in-the-middle you providing third-party key and read all messages silently. It is not e2e encryption if you have to trust the server. Period.