Privacy taxation without representation :)

Sigh, any free email provider might do similar things (now or in the future). If that is critical, admin your own email on an OpenBSD server, or something.

But even hints of that type of behavior would be bad for business; Google is much more sensitive than e.g. Microsoft with Hotmail (sadly, it is easier to replace a search engine than Windows).

It is arguably good business for Google to not be evil.

Actually, it's not really enough to simply admin one's own mail server. Virtually all email is sent plain text, so the owners of any of the hops the email goes through (on the TCP/IP level) on the way to the mail server could relatively easily read your email.

Of course, it's even easier to read someone else's email if you own/run their mail server. But the bar is not that much higher if you're and ISP, a colo, or any of the probably dozens of hops your email goes through before it gets delivered.

If you really want privacy, you should use encryption. The even more paranoid should use encryption and mixmaster remailers. And the ultimately paranoid should use encryption, steganography, and some carefully chosen channels for transmission.

I do, in fact think this is critical.[1] And I do administer my own mail server (on a virtual server, until I buy a plug computer). I actually think everyone (including my mom) should be able to do the same.

The "type of behaviour" I was speaking of are actual. Google do analyse your email, and they do remember your search requests. this is not outright spying like with Facebook, but this is close.

[1]: http://www.softwarefreedom.org/news/2010/feb/01/freedom-clou...

Yes, Google analyze the email for ad purposes. I thought we were talking about much worse behaviors (e.g. looking for business insider information or things usable for blackmail).

About that, I recall a (French) celebrity whose e-mail where leaked because a Paparazzi bribed an employee of the company which hosted his web-mail. So, even this worst-case scenario can happen (though I suspect they are a bit more careful at Google).

This is more about the many tiny dangers than about the few big ones, however. I don't really know all these dangers, and they add up. In the end, this tends to be a matter of principle: "If I'm not doing anything wrong, then you have nothing to see". I just feel safer that way.

No argument. For an example, the email of Chinese dissidents where accessed at the Google break in.

OTOH... certainly, a web email account isn't that safe -- but are you better than Google's security people? I haven't been a sysadmin for over a decade.

No, I'm not. However, if my server is compromised, I alone will be affected. When Google's servers are, many more people are affected. That makes Google an attractive target.