If I have an IMAP client, I can fetch my emails and download them locally.

If the Fastmail CEO sent me an email through Fastmail, with very little technical knowledge, I could set up a regular desktop client to download all those emails locally - headers and all. Even the iPhone default Mail app setup helps you do it.

The same is not true of Facebook - those messages belong to Facebook.

IMAP can also send other instructions like Delete.

You might want to consider POP3.

You can setup most IMAP clients to keep a copy of all messages.

It can't delete an automatic or manual backup I've made of all/some of my email.

I think the argument is that you have a way to export and retain emails while there is nothing you can do with messages on FB other than screenshot.

If the argument is that I can go out of my way to back something up outside of the regular framework of the software, I could do the same by saving messages from Facebook.

Email backups have been standard for decades. There are solution that follow standards and have been tested in audits. Taking screenshots of Facebook messages is very different from that.

You could either save the HTML or pretty easily use some JavaScript to extract the message contents to plain text.

But convincing courts and auditors that this is the original version of that time will be harder with a self-written script than with email backups.

I suppose that's true, but isn't there some precedent for dealing with Web pages? This can't be the first time this has come up.

> There are solution that follow standards and have been tested in audits.

I don't think their point was that you can get text vs images.

Can, but it doesn't mean that they send. My IMAP accounts keep emails on servers, and in my client.

You can but only when you're online. And in general everything can be gamed, including email, given you depend on someone in receiving information.

So FastMail's argument is just logically inconsistent. More, an agency problem is here.

I have copies of my Fastmail mail on several computers and access the mailboxes when online or offline. It syncs perfectly, is backed up through normal backup techniques and I am in control. There is no mystery here.

but wouldn't that just depend on your mail client?

its technically possible to edit the mail body on the server side and serve the modified message under the same mail ID.

I'd wager most clients would invalidate their local copy and trust the new mail from the server, but have to admit that I've never tested such a scenario.

iOS and Apple mail don’t. Some servers sometimes have the issue of reusing message identifiers and both clients would show the wrong content for the mail. You’d have to force a resync of the whole Mailbox to fix this.

Also: A backup of the mailbox would be unaffected by any server-side change.

most imap clients wouldn't even notice. Once that message is downloaded there's no reason to download it again.

FastMail, as many other e-mail providers, let you download messages. On Facebook, you cannot. Saying "the article is a lie" is an exaggeration.

"your data belongs to you"

Not the SSL certificate for your domain, which Fastmail will acquire with or without your prior knowledge or consent, and to which you have no access or control.

https://www.fastmail.com/help/files/secure-website.html

That's for their Files product (which you can use to create a website): https://www.fastmail.com/help/files/website.html

They can't request a certificate unless you already pointed your domain to their servers. So if you're already doing that for HTTP, requesting an ssl cert so they can enable HTTPS on it is a perfectly valid request... especially when browsers are starting to mark all HTTP sites as insecure.

The same goes for Hotmail and Gmail of course. I download all my gmail-mail, and then it's mine to keep. Google can't delete that unless they hack my machine. They can delete my account, my emails. But the webmail version offers one extra that downloaded mail doesn't: a reasonable guarantee that the mail is not messed with.

If I've received an email and keep it in the webmail, I cannot change that. A downloaded mail can be edited, unless it's signed with PGP. I can change content, headers, dates. An email in Gmail webmail cannot be changed by me. And while Google can do that, and maybe an excellent hacker can do that, the chance that you're the victim of that as an average Joe is very small.

> A downloaded mail can be edited, unless it's signed with PGP.

What is your threat model? Obviously, it does not include google (and by extension, the state actors that can compel it to do things). But what does it include?

Yes Google and NSA could do such things, and I wouldn't be surprised if Russia could do this as well. But for the ordinary man this won't happen, being a personal target for the big agencies.

When you're in court having having a dispute with a customer or your boss, you can't dispute Gmail timestamps etc. That's all I'm saying.

Is there no way to encrypt or sign e-mail inboxes on the server in such a way that it is tamper-proof?

Most solutions focus on preventing individual e-mails to be read or modified by a 3rd party. Does anyone apply similar techniques to a whole mailbox / account?

> Every man who must say "I am the king" is no true king.

https://youtu.be/sgYpGBGDsuE?t=2m2s